用Maxima學密碼學-Lattice Reduction應用2-找出同餘方程式較小的解

方法	範例
問題敘述
設同餘方程式為\(f(x)=a_d x^d+a_{d-1}x^{d-1}+\ldots+a_1 x+a_0\equiv 0 \pmod{N}\) 利用LLL方法可以找出比邊界\(X\)還小的解\(x_0\)(\( |\;x_0|\;<X=N^{\displaystyle \frac{2}{d(d+1)}}\)) 使得\(f(x_0)\equiv 0 \pmod{N}\)	設同餘方程式為\(f(x)=1131x^3+14531x^2+116024x+57592\equiv 0 \pmod{123107}\) \(\displaystyle d=3,X=N^{\frac{2}{3\cdot 4}}=7.0531\) 利用LLL方法可以找出比邊界\(X=7\)還小的解 使得\(f(x_0)\equiv 0 \pmod{123107}\)
步驟1.產生lattice證明向量線性組合方程式的解和原方程式相同。
將\(f(x)\)各項係數取lattice如下 \(B=\matrix{\matrix{常數項&1次方&2次方&\ldots&d-1次方&d次方&} \cr \left[\matrix{a_0&a_1X&a_2X^2&\ldots&a_{d-1}X^{d-1}&a_dX^d&\frac{1}{d+1} \cr N&0&0&0&0&0&0\cr 0&NX&0&0&0&0&0\cr 0&0&NX^2&0&0&0&0\cr &&&\ddots&&&\cr 0&0&0&0&NX^{d-1}&0&0\cr 0&0&0&0&0&NX^d&0}\right]}\) 該lattice的向量線性組合為 \(\matrix{\matrix{s\cr -s_0 \cr -s_1 \cr -s_2 \cr \vdots \cr -s_{d-1}\cr -s_d}&\left[\matrix{a_0&a_1X&a_2X^2&\ldots&a_{d-1}X^{d-1}&a_dX^d&\frac{1}{d+1} \cr N&0&0&0&0&0&0\cr 0&NX&0&0&0&0&0\cr 0&0&NX^2&0&0&0&0\cr &&&\ddots&&&\cr 0&0&0&0&NX^{d-1}&0&0\cr 0&0&0&0&0&NX^d&0}\right]}\) \(=\left[\matrix{sa_0&sa_1X&sa_2X^2&\ldots&sa_{d-1}X^{d-1}&sa_dX^d&\frac{s}{d+1}\cr -s_0N&0&0&0&0&0&0\cr 0&-s_1NX&0&0&0&0&0\cr 0&0&-s_2NX^2&0&0&0&0\cr 0&0&0&\ddots&0&0&0\cr 0&0&0&0&-s_{d-1}NX^{d-1}&0&0\cr 0&0&0&0&0&-s_dNX^d&0}\right]\) \(=[(sa_0-s_0N),(sa_1-s_1N)X,\ldots,(sa_{d-1}-s_{d-1}N)X^{d-1},(sa_d-s_dN)X^d,\frac{s}{d+1}]\) 將向量線性組合前\(d+1\)個分量除以\(X^i\)為係數的方程式 \(h(x)=(sa_0-s_0N)+(sa_1-s_1N)x+\ldots+(sa_{d-1}-s_{d-1}N)x^{d-1}+(sa_d-s_dN)x^d\) 　\(=s(a_0+a_1x+\ldots+a_{d-1}x^{d-1}+a_d x^d)-N(s_0+s_1x^1+\ldots+s_{d-1}x^{d-1}+s_dx^d)\) 　\(=sf(x)-N(s_0+s_1x^1+\ldots+s_{d-1}x^{d-1}+s_dx^d)\) 得到\(h(x)\equiv sf(x)\pmod{N}\) 若\(x=x_0\)是\(h(x)\equiv 0 \pmod{N}\)的解，那\(x=x_0\)也會是\(f(x)\equiv 0 \pmod{N}\)的解。	\(B=\left[\matrix{57592&116024\cdot 7^1&14531\cdot 7^2&1131\cdot 7^3& \frac{1}{4}\cr 123107&0&0&0&0\cr 0&123107\cdot 7^1&0&0&0\cr 0&0&123107\cdot 7^2&0&0\cr 0&0&0&123107\cdot 7^3&0}\right]\) 　　\(\left[\matrix{57592&812168&712019&387933&\frac{1}{4}\cr 123107&0&0&0&0\cr 0&861749&0&0&0\cr 0&0&6032243&0&0\cr 0&0&0&42225701&0} \right]\)
步驟2.經LLL化簡得到短向量所形成的方程式不需再同餘\(N\)。
lattice經LLL化簡後第一行為整個lattice中較短向量 取前\(d+1\)個分量\((c_0,c_1X,\ldots,c_{d-1}X^{d-1},c_dX^d)\)將每個分量除以\(X^i\)得到係數\(c_i\) 將係數\(c_i\)組成新方程式\(\displaystyle h(x)=\sum_{i=0}^d c_ix^i\) 若每個係數\(\displaystyle |\;c_i|\;<\frac{N}{(d+1)X^i}\)，要求的解\(x\)小於邊界\(X\)(\(|\;x|\;<X\))。 \(\displaystyle |\;h(x)|\;= |\;\sum_{i=0}^d c_i x^i|\;\le \sum_{i=0}^d |\;c_i|\; |\;x|\;^i<\sum_{i=0}^d \frac{N}{(d+1)X^i} X^i\) \(\displaystyle =\sum_{i=0}^d \frac{N}{d+1}=\frac{N}{d+1}\cdot (d+1)=N\)，得到\(|\;h(x)|\;<N\) 原本要解同餘方程式\(h(x)\equiv 0\pmod{N}\)，因為\(|\;h(x)|\;<N\)，變成解一般方程式\(h(x)=0\)。	\(B=\left[\matrix{-9310&13671&-4704&343&5905\cr 9310&-13671&4704&-343&\frac{99487}{4}\cr 85867&54684&-18816&1372&-\frac{28627}{4}\cr -28932&-96173&-263424&19208&-\frac{31457}{4}\cr 44745&-4151&-100499&-432523&\frac{3537}{2}}\right]\) \(\displaystyle h(x)=-9310+\frac{13671}{7^1}x-\frac{4704}{7^2}x^2+\frac{343}{7^3}x^3\) 　　\(=-9310+1953x-96x^2+x^3\) 其中各項係數符合 \(\displaystyle |\;-9310|\;<\frac{123107}{4\cdot 7^0}=30776.75\) \(\displaystyle |\;1953|\;<\frac{123107}{4\cdot 7^1}=4396.68\) \(\displaystyle |\;-96|\;<\frac{123107}{4\cdot 7^2}=628.10\) \(\displaystyle |\;1|\;<\frac{123107}{4\cdot 7^3}=89.73\)
步驟3.解一般方程式得到小於\(X\)的解\(x=x_0\)。
	\(h(x)=(x-7)(x-19)(x-70)=0\) \(x=7,19,70\)，也是\(f(x)\equiv 0 \pmod{123107}\)的解。 驗算 \(f(7)=1969712\equiv 0\pmod{123107}\) \(f(19)=15265268\equiv 0\pmod{123107}\) \(f(70)=467314172\equiv 0\pmod{123107}\)

步驟4.計算邊界\(X\)的範圍
計算行列式值\(\displaystyle det(B)\)
\(=\left|\ \matrix{a_0&a_1X&a_2X^2&\ldots&a_{d-1}X^{d-1}&a_dX^d&\frac{1}{d+1} \cr N&0&0&0&0&0&0\cr
0&NX&0&0&0&0&0\cr
0&0&NX^2&0&0&0&0\cr
&&&\ddots&&&\cr
0&0&0&0&NX^{d-1}&0&0\cr
0&0&0&0&0&NX^d&0}\right|\)
以第\(d+2\)行降階，0降階後仍是0，只剩下\(\displaystyle \frac{1}{d+1}\)再乘上餘因子
\(\displaystyle =\frac{1}{d+1}\left|\matrix{N&0&0&0&0&0\cr
0&NX&0&0&0&0\cr
0&0&NX^2&0&0&0\cr
&&&\ddots&&\cr
0&0&0&0&NX^{d-1}&0\cr
0&0&0&0&0&NX^d} \right|\)
行列式只有對角線有值，其餘為0，行列式值由對角線元素相乘
\(\displaystyle =\frac{N^{d+1}X^{\frac{d(d+1)}{2}}}{d+1}\)

經LLL化簡後的第一列向量\(\vec{b_1}\)是整個lattice中較短的向量，向量長度符合不等式\(\Vert\;\vec{b_1}\Vert\;\le 2^{(n-1)/4}\cdot (det(B))^{1/n}\)
https://en.wikipedia.org/wiki/Le ... reduction_algorithm

其中lattice有\(d+2\)列，\(n=d+2\)。將\(\displaystyle det(B)=\frac{N^{d+1}X^{\frac{d(d+1)}{2}}}{d+1}\)代入得到\(\displaystyle \Vert\;\vec{b_1}\Vert\;\le 2^{\frac{d+1}{4}}\left(\frac{N^{d+1}X^{\frac{d(d+1)}{2}}}{d+1}\right)^{\frac{1}{d+2}}\)

若想找到邊界\(X\)的範圍，需要第一列向量長度再小於\(\displaystyle \frac{N}{d+1}\)和需要\(\displaystyle 2^{\frac{d+1}{4}}\left(\frac{N^{d+1}X^{\frac{d(d+1)}{2}}}{d+1}\right)^{\frac{1}{d+2}}<\frac{N}{d+1}\)
不等式兩邊\(d+2\)次方，\(\displaystyle 2^{\frac{(d+1)(d+2)}{4}}\frac{N^{d+1}X^{\frac{d(d+1)}{2}}}{d+1}<\frac{N^{d+2}}{(d+1)^{d+2}}\)
重新整理不等式，\(\displaystyle 2^{\frac{(d+1)(d+2)}{4}}(d+1)^{d+1}X^{\frac{d(d+1)}{2}}<N\)
令\(\epsilon(d)=2^{\frac{(d+1)(d+2)}{4}}(d+1)^{d+1}\)僅和\(d\)有關的函數，當\(d\)固定時\(\epsilon(d)\)是常數
\(\epsilon(d)X^{\frac{d(d+1)}{2}}<N\)，得到邊界\(\displaystyle X<N^{\frac{2}{d(d+1)}}\)

參考資料
Håstad, J.: Solving Simultaneous Modular Equations of Low Degree. SIAM Journalon Computing 17(2), 336–341 (1988)
http://www.csc.kth.se/~johanh/rsalowexponent.pdf
http://citeseerx.ist.psu.edu/vie ... p=rep1&type=pdf
註：
原本論文以\(n\)代表邊界，但之後的資料改以\(X\)表示，本文章也以\(X\)表示能找到小於\(X\)的解\(x_0\)。



請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下
要先載入LLL.mac才能使用LLL指令
(%i1)　load("LLL.mac");
(%o1)　C:/maxima-5.43.2/share/maxima/5.43.2/LLL.mac

同餘方程式\(f(x)\)
(%i2)　fx:1131*x^3+14531*x^2+116024*x+57592;
(fx)　\(1131x^3+14531x^2+116024x+57592\)

\(f(x)\equiv 0\pmod{N}\)
(%i3)　N:123107;
(N)　\(123107\)

\(f(x)\)的次數d
(%i4)　d:hipow(fx,x);
(d)　\(3\)

希望能找到\(|\;x|\;<X=N^{2/d(d+1)}\)，\(f(x)\equiv 0\pmod{N}\)
(%i5)　X:floor(N^(2/(d*(d+1))));
(X)　\(7\)

定義lattice產生方式
(%i7)
kill(genlattice)$
genlattice[i,j]:=
if i=1 and j=d+2 then 1/(d+1)/*第1列第d+2行為1/(d+1)*/
else if i=1 then coeff(fx,x,j-1)*X^(j-1)/*第一行為f(x)係數乘上X^(j-1)*/
else if i=j+1 then N*X^(j-1)/*子對角線為NX^(j-1)*/
else 0$/*剩下元素為0*/

根據\(f(x)\)係數，產生lattice
(%i8)　latticeB:genmatrix(genlattice,d+2,d+2);
(latticeB)　\(\left[\matrix{\displaystyle 57592&812168&712019&387933&\frac{1}{4}\cr
123107&0&0&0&0\cr
0&861749&0&0&0\cr
0&0&6032243&0&0\cr
0&0&0&42225701&0}\right]\)

經LLL化簡後的lattice B
(%i9)　latticeB: LLL(latticeB);
(latticeB)　\(\left[\matrix{\displaystyle -9310&13671&-4704&343&5905\cr
9310&-13671&4704&-343&\frac{99487}{4}\cr
85867&54684&-18816&1372&-\frac{28627}{4}\cr
-28932&-96173&-263424&19208&-\frac{31457}{4}\cr
44745&-4151&-100499&-432523&\frac{3537}{2}}\right]\)

lattice第一行是整個lattice中較短的向量\(\vec{b_1}\)
(%i10)　b1:latticeB[1];
(b1)　\([-9310,13671,-4704,343,5905]\)

取\(\vec{b_1}\)前\(d+1\)個分量除以\(X^i\)乘上\(x^i\)形成\(h(x)\)
(%i11)　hx:sum(b1[i+1]/X^i*x^i,i,0,d);
(hx)　\(x^3-96x^2+1953x-9310\)

將\(h(x)\)因式分解
(%i12)　factor(hx);
(%o12)　\((x-70)(x-19)(x-7)\)

得到\(h(x)\)的解，因為這個範例比較簡單\(f(x)\equiv 0\pmod{N}\)的三個解都找出來
(%i13)　roots:solve(hx,x);
(roots)　\([x=7,x=19,x=70]\)

驗證答案
(%i14)
for root in roots do
  (print(將,root,代入f(,rhs(root),)=,ev(fx,root),≡0 (mod ,N,))
  )$
將\(x=7\)代入\(f(7)=1969712\equiv 0 \pmod{123107}\)
將\(x=19\)代入\(f(19)=15265268\equiv 0 \pmod{123107}\)
將\(x=70\)代入\(f(70)=467314172\equiv 0 \pmod{123107}\)

使用低次方公鑰\(e\)的RSA傳送線性相關訊息是不安全的，傳送超過\(\displaystyle \frac{e(e+1)}{2}\)個加密訊息能讓破解者回復原本的訊息。

設使用低次方公鑰\(e=3\)，原本訊息\(m\)，在訊息後面串接加密時間\(TimeStamp_i\)當作補綴，計算3次方後同餘\(n_i\)得到密文\(Cipertext_i\)。
\(Cipertext_i=(10000m+TimeStamp_i)^3\pmod{n_i}\)
當破解者收集超過\(\displaystyle \frac{3\cdot 4}{2}=6\)個密文\(Cipertext_i\)、加密時間\(TimeStamp_i\)和公鑰\(n_i\)，利用前一篇文章的方法可以在多項式時間內回復原本的訊息\(m\)。
此時\(\displaystyle n_1>2^{\frac{(e+1)(e+2)}{4}}(e+1)^{(e+1)}\)，\(n=min(n_i)\)，\(n_i\ge n\)
\(\displaystyle N=\prod_{i=1}^k n_i\ge n_1\prod_{i=2}^{\frac{d(d+1)}{2}+1}n_i>2^{\frac{(e+1)(e+2)}{2}}(e+1)^{(e+1)}n^{\frac{d(d+1)}{2}}\)

破解者收集到7組密文、加密時間和公鑰
\(TimeStamp_1=\)13點40分產生密文\(Cipertext_1=10117\)，公鑰\(n_1=14857\)
\(TimeStamp_2=\)13點47分產生密文\(Cipertext_2=13166\)，公鑰\(n_2=15397\)
\(TimeStamp_3=\)13點56分產生密文\(Cipertext_3=11707\)，公鑰\(n_3=16199\)
\(TimeStamp_4=\)14點09分產生密文\(Cipertext_4=1590\)，公鑰\(n_4=16463\)
\(TimeStamp_5=\)14點18分產生密文\(Cipertext_5=15758\)，公鑰\(n_5=16171\)
\(TimeStamp_6=\)14點20分產生密文\(Cipertext_6=7371\)，公鑰\(n_6=16157\)
\(TimeStamp_7=\)14點24分產生密文\(Cipertext_7=6303\)，公鑰\(n_7=16241\)

根據密文和加密時間產生多項式
\(f_i(x)=(10000x+TimeStamp_i)^3-Cipertext_i\pmod{n_i}\)
\(f_1(x)=(10000x+1340)^3-10117\equiv-7380x^3+7136x^2-5462x+2733\pmod{14857}\)
\(f_2(x)=(10000x+1347)^3-13166\equiv1351x^3+7316x^2-5044x-847\pmod{15397}\)
\(f_3(x)=(10000x+1356)^3-11707\equiv-4994x^3+4461x^2-2123x-3373\pmod{16199}\)
\(f_4(x)=(10000x+1409)^3-1590\equiv-7473x^3-3954x^2+4418x-1917\pmod{16463}\)
\(f_5(x)=(10000x+1418)^3-15758\equiv-5245x^3-2021x^2-7211x+1009\pmod{16171}\)
\(f_6(x)=(10000x+1420)^3-7371\equiv1554x^3-2117x^2-1884x+1717\pmod{16157}\)
\(f_7(x)=(10000x+1424)^3-6303\equiv4317x^3+441x^2-301x-5633\pmod{16241}\)

\(\displaystyle N=\prod_{i=1}^7 n_i=258865864180238903908838873371\)
\(X=\lfloor\;N^{2/(d(d+1))}\rfloor\;=79832\)

利用中國餘數定理計算新的方程式係數
將\(f_i(x)\)的常數項係數以中國餘數定理計算新的常數項\(c_0\)
\(c_0\equiv\cases{2733\pmod{14857}\cr
-847\pmod{15397}\cr
-3373\pmod{16199}\cr
-1917\pmod{16463}\cr
1009\pmod{16171}\cr
1717\pmod{16157}\cr
-5633\pmod{16241}}\)，\(c_0\equiv 204373190208566474382317165684\pmod{N}\)

將\(f_i(x)\)的1次方係數以中國餘數定理計算新的1次方係數\(c_1\)
\(c_1\equiv\cases{-5462\pmod{14857}\cr
-5044\pmod{15397}\cr
-2123\pmod{16199}\cr
4418\pmod{16463}\cr
-7211\pmod{16171}\cr
-1884\pmod{16157}\cr
-301\pmod{16241}}\)，\(c_1\equiv 249751034306884980399002316934\pmod{N}\)

將\(f_i(x)\)的2次方係數以中國餘數定理計算新的2次方係數\(c_2\)
\(c_2\equiv\cases{7136\pmod{14857}\cr
7316\pmod{15397}\cr
4461\pmod{16199}\cr
-3954\pmod{16463}\cr
-2021\pmod{16171}\cr
-2117\pmod{16157}\cr
441\pmod{16241}}\)，\(c_2\equiv 189008702173331023044971363347\pmod{N}\)

將\(f_i(x)\)的3次方係數以中國餘數定理計算新的3次方係數\(c_3\)
\(c_3\equiv\cases{-7380\pmod{14857}\cr
1351\pmod{15397}\cr
-4994\pmod{16199}\cr
-7473\pmod{16463}\cr
-5245\pmod{16171}\cr
1554\pmod{16157}\cr
4317\pmod{16241}}\)，\(c_3\equiv 1000000000000\pmod{N}\)

產生新的同餘方程式\(g(x)\pmod{N}\)，若\(x=x_0\)是\(g(x)\equiv 0\pmod{N}\)解，那\(x=x_0\)也會是\(f_i(x)\equiv 0\pmod{n_i}\)的解
\(g(x)=c_0+c_1x+c_2x^2+c_3x^3\pmod{N}\)
　\(=204373190208566474382317165684+249751034306884980399002316934x+189008702173331023044971363347x^2+1000000000000x^3\pmod{N}\)

產生lattice，希望能找到較小的解\(x=x_0\)\((x_0<X=78932)\)
\(B=\left[\matrix{c_0&c_1X&c_2X^2&c_3X^3&\frac{1}{d+1}\cr
N&0&0&0&0\cr
0&NX&0&0&0\cr
0&0&NX^2&0&0\cr
0&0&0&NX^3&0}\right]\)
\(\left[\matrix{
204373190208566474382317165684&19938124570787241755213152965475088&1204580474576509549683162316445791745728&508781169018368000000000000&\frac{1}{4}\cr
258865864180238903908838873371&0&0&0&0\cr
0&20665779669236832176850424938953672&0&0&0\cr
0&0&1649790522554514786342323123726549543104&0&0\cr
0&0&0&131706076996572024423280339613337903125078528&0}\right]\)

經LLL化簡lattice
\(B=\left[\matrix{
0&0&0&0&\frac{258865864180238903908838873371}{4}\cr
19032544658836594241198114925&-110020730529168337991621111320&-69821420216485869263622535616&-94549927515912701524841700864&-\frac{74058264293788734740876853939}{4}\cr
2056083148951895180465932260&8991794266570450022519459504&-157772457706749993512226999616&88218148052792936245521824256&-\frac{31442973836260991406843209159}{2}\cr
258865864180238903908838873371&0&0&0&0\cr
-60101849692113834636025787760&433902895535857979265114013016&-240340197778189487664217294976&-337639116008434960645370124800&-\frac{44674685201276114130186287835}{4}}\right]\)

第1列向量都是0，改取第2列向量
\(\vec{b_2}=[19032544658836594241198114925,-110020730529168337991621111320,-69821420216485869263622535616,-94549927515912701524841700864,-\frac{74058264293788734740876853939}{4}]\)

化簡後方程式\(h(x)\)不需要同餘\(N\)
\(\displaystyle h(x)=\frac{19032544658836594241198114925}{X^0}-\frac{110020730529168337991621111320}{X^1}x-\frac{69821420216485869263622535616}{X^2}x^2-\frac{94549927515912701524841700864}{X^3}x^3\)
　\(\displaystyle =\frac{19032544658836594241198114925}{79832^0}-\frac{110020730529168337991621111320}{79832^1}x-\frac{69821420216485869263622535616}{79832^2}x^2-\frac{94549927515912701524841700864}{79832^3}x^3\)
　\(=19032544658836594241198114925-1378153253446842594343385x-10955561955008732159x^2-185836137957573x^3\)
　\(=-(x-12345)(185836137957573x^2+13249709078094970844x+1541720912015925009412565)\)
得\(x=12345\)


參考資料
Håstad, J.: Solving Simultaneous Modular Equations of Low Degree. SIAM Journalon Computing 17(2), 336–341 (1988)
http://www.csc.kth.se/~johanh/rsalowexponent.pdf
http://citeseerx.ist.psu.edu/vie ... p=rep1&type=pdf
註：
原本論文以n代表邊界，但之後的資料改以X表示，本文章也以X表示能找到小於X的解x0。


請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下
要先載入LLL.mac才能使用LLL指令
(%i1)　load("LLL.mac");
(%o1)　C:/maxima-5.43.2/share/maxima/5.43.2/LLL.mac

有7個密文
(%i2)　Cipertext:[10117,13166,11707,1590,15758,7371,6303];
(Cipertext)　\([10117,13166,11707,1590,15758,7371,6303]\)

有7個公鑰\(n_i\)
(%i3)　n:[14857,15397,16199,16463,16171,16157,16241];
(n)　\([14857,15397,16199,16463,16171,16157,16241]\)

有7個時戳
(%i4)　Timestamp:[1340,1347,1356,1409,1418,1420,1424];
(Timestamp)　\([1340,1347,1356,1409,1418,1420,1424]\)

公鑰\(e\)
(%i5)　e:3;
(e)　3

同餘方程式最高次方\(d\)
(%i6)　d:e;
(d)　3

根據密文和時戳產生同餘方程式\(f_i(x)\)
(%i7)　fx:create_list(polymod((10000*x+Timestamp[ i ])^3-Cipertext[ i ],n[ i ]),i,1,length(n));
(fx)　\(\matrix{[-7380x^3+7136x^2-5462x+2733,\cr
1351x^3+7316x^2-5044x-847,\cr
-4994x^3+4461x^2-2123x-3373,\cr
-7473x^3-3954x^2+4418x-1917,\cr
-5245x^3-2021x^2-7211x+1009,\cr
1554x^3-2117x^2-1884x+1717,\cr
4317x^3+441x^2-301x-5633]}\)

\(f_i(x)\)的常數項係數
(%i8)　a0:create_list(coeff(fx[ i ],x,0),i,1,length(n));
(a0)　\([2733,-847,-3373,-1917,1009,1717,-5633]\)

\(f_i(x)\)的1次方係數
(%i9)　a1:create_list(coeff(fx[ i ],x,1),i,1,length(n));
(a1)　\([-5462,-5044,-2123,4418,-7211,-1884,-301]\)

\(f_i(x)\)的2次方係數
(%i10)　a2:create_list(coeff(fx[ i ],x,2),i,1,length(n));
(a2)　\([7136,7316,4461,-3954,-2021,-2117,441]\)

\(f_i(x)\)的3次方係數
(%i11)　a3:create_list(coeff(fx[ i ],x,3),i,1,length(n));
(a3)　\([-7380,1351,-4994,-7473,-5245,1554,4317]\)

利用中國餘數定理計算新的常數項\(c_0\)
(%i12)　c0:chinese(a0,n);
(c0)　\(204373190208566474382317165684\)

利用中國餘數定理計算新的1次方係數\(c_1\)
(%i13)　c1:chinese(a1,n);
(c1)　\(249751034306884980399002316934\)

利用中國餘數定理計算新的2次方係數\(c_2\)
(%i14)　c2:chinese(a2,n);
(c2)　\(189008702173331023044971363347\)

利用中國餘數定理計算新的3次方係數\(c_3\)
(%i15)　c3:chinese(a3,n);
(c3)　\(1000000000000\)

產生新的同餘方程式\(g(x)\pmod{N}\)，若\(x=x_0\)是\(g(x)\equiv 0\pmod{N}\)的解，那\(x=x_0\)也會是\(f_i(x)\equiv 0\pmod{n_i}\)的解
(%i16)　gx:c0+c1*x+c2*x^2+c3*x^3;
(gx)　\(1000000000000x^3+189008702173331023044971363347x^2+249751034306884980399002316934x+204373190208566474382317165684\)

\(N=\prod_{i=1}^7 n_i\)
(%i17)　N:product(n[ i ],i,1,length(n));
(N)　\(258865864180238903908838873371\)

希望能找到\(|\;x_0|\;<X=\lfloor\;N^{2/(d(d+1))} \rfloor\;，g(x_0)\equiv 0\pmod{N}\)
(%i18)　X:floor(N^(2/(d*(d+1))));
(X)　\(79832\)

定義lattice產生方式
(%i20)
kill(genlattice)$
genlattice[i,j]:=
if i=1 and j=d+2 then 1/(d+1)/*第1列第d+2行為1/(d+1)*/
else if i=1 then coeff(gx,x,j-1)*X^(j-1)/*第一行為f(x)係數乘上X^(j-1)*/
else if i=j+1 then N*X^(j-1)/*子對角線為NX^(j-1)*/
else 0$/*剩下元素為0*/

根據\(g(x)\)係數，產生lattice
(%i21)　latticeB:genmatrix(genlattice,d+2,d+2);
(latticeB)　\(\left[\matrix{
204373190208566474382317165684&19938124570787241755213152965475088&1204580474576509549683162316445791745728&508781169018368000000000000&\frac{1}{4}\cr
258865864180238903908838873371&0&0&0&0\cr
0&20665779669236832176850424938953672&0&0&0\cr
0&0&1649790522554514786342323123726549543104&0&0\cr
0&0&0&131706076996572024423280339613337903125078528&0}\right]\)

經LLL化簡後的lattice B
(%i22)　latticeB: LLL(latticeB);
(latticeB)　\(\left[\matrix{
0&0&0&0&\frac{258865864180238903908838873371}{4}\cr
19032544658836594241198114925&-110020730529168337991621111320&-69821420216485869263622535616&-94549927515912701524841700864&-\frac{74058264293788734740876853939}{4}\cr
2056083148951895180465932260&8991794266570450022519459504&-157772457706749993512226999616&88218148052792936245521824256&-\frac{31442973836260991406843209159}{2}\cr
258865864180238903908838873371&0&0&0&0\cr
-60101849692113834636025787760&433902895535857979265114013016&-240340197778189487664217294976&-337639116008434960645370124800&-\frac{44674685201276114130186287835}{4}}\right]\)

第1列向量都是0，改取第2列向量
(%i23)　b2:latticeB[2];
(b2)　\([19032544658836594241198114925,-110020730529168337991621111320,-69821420216485869263622535616,-94549927515912701524841700864,-\frac{74058264293788734740876853939}{4}]\)

化簡後方程式\(h(x)\)不需要同餘\(N\)
(%i24)　hx:sum(b2[i+1]/X^i*x^i,i,0,d);
(hx)　\(-185836137957573x^3-10955561955008732159x^2-1378153253446842594343385x+19032544658836594241198114925\)

將h(x)因式分解
(%i25)　factor(hx);
(%o25)　\(-(x-12345)(185836137957573x^2+13249709078094970844x+1541720912015925009412565)\)

得到較小的解\(x\)
(%i26)　x:12345;
(x)　\(12345\)

驗證答案\(f_i(12345)\equiv 0 \pmod{n_i}\)
(%i27)　create_list(mod(ev(fx[ i ],x=x),n[ i ]),i,1,length(n));
(%o27)　\([0,0,0,0,0,0,0]\)

Rabin加密法請參閱wiki。https://en.wikipedia.org/wiki/Rabin_cryptosystem

公式	範例
產生金鑰 1.選擇兩個不相同的大質數\(p\)和\(q\)，其中\(p\equiv 3\pmod{4}\)和\(q\equiv 3\pmod{4}\) 2.計算\(n=pq\) \(n\)是公鑰和\((p,q)\)是私鑰	私鑰\(p=7\)和\(q=11\) 公鑰\(n=77\)
加密 訊息\(M\)轉換成數字\(m\)(\(m<n\)) 計算密文\(c=m^2\pmod{n}\)	明文\(m=20\) 密文\(c=20^2=400=15\pmod{77}\)
解密 計算密文\(c\)在同餘\(n\)的平方根得到\(m\) 1.計算\(c\)在同餘\(p\)和\(q\)的平方根 \(m_p=c^{\frac{1}{4}(p+1)}\pmod{p}\) \(m_q=c^{\frac{1}{4}(q+1)}\pmod{q}\) 2.使用擴展歐幾里得演算法計算\(y_p\)和\(y_q\)使得\(y_p\cdot p+y_q\cdot q=1\)。 3.使用中國餘數定理\(c\)在同餘\(n\)的平方根 \(r_1=(y_p\cdot p\cdot m_q+y_q\cdot q\cdot m_p)\pmod{n}\) \(r_2=n-r_1\) \(r_3=(y_p\cdot p\cdot m_q-y_q\cdot q\cdot m_p)\pmod{n}\) \(r_4=n-r_3\) 4個\(r_i\)值其中一個會是明文\(m\)	1.計算\(m_p=15^{\frac{1}{4}(7+1)}=15^2=1\pmod{7}\) \(m_q=15^{\frac{1}{4}(11+1)}=15^3=9\pmod{11}\) 2.使用擴展歐幾里得演算法計算\(y_p\)和\(y_q\) \(p=7\)，\(q=11\) \(q-p=11-7=4\) \(p-(q-p)=7-4\)，\(2p-q=3\) \((q-p)-(2p-q)=4-3\)，\(-3p+2q=1\) \(y_p=-3\)和\(y_q=2\) 3.計算4個\(r_i\)值 \(r_1=(-3\cdot 7\cdot 9+2\cdot 11\cdot 1)\pmod{77}=64\) \(r_2=77-64=13\) \(r_3=(-3\cdot 7\cdot 9-2\cdot 11\cdot 1)\pmod{77}=20\) \(r_4=77-20=57\) 其中\(r_3=20\)是當初的明文

使用Rabin加密函數傳送線性相關訊息是不安全的，傳送3個加密訊息能讓破解者在多項式時間內回復原本的訊息。

設原本訊息\(m\)，在訊息後面串接加密時間\(TimeStamp_i\)當作補綴，計算2次方後同餘\(n_i\)得到密文\(Cipertext_i\)。
\(Cipertext_i=(10000m+TimeStamp_i)^2\pmod{n_i}\)
破解者收集到3組密文、加密時間和公鑰
\(TimeStamp_1=\)13點40分產生密文\(Cipertext_1=5926\)，公鑰\(n_1=14857\)
\(TimeStamp_2=\)13點47分產生密文\(Cipertext_2=3031\)，公鑰\(n_2=15397\)
\(TimeStamp_3=\)13點56分產生密文\(Cipertext_3=5421\)，公鑰\(n_3=16199\)

根據密文和加密時間產生多項式
\(f_i(x)=(10000x+TimeStamp_i)^2-Cipertext_i\pmod{n_i}\)
\(f_1(x)=-2467x^2-2028x+6834\pmod{14857}\)
\(f_2(x)=-3515x^2-4750x-5468\pmod{15397}\)
\(f_3(x)=3573x^2+2874x+2828\pmod{16199}\)

\(\displaystyle N=\prod_{i=1}^3 n_i=3705573556571\)
\(X=\lfloor\;N^{2/(d(d+1))}\rfloor\;=15474\)

利用中國餘數定理計算新的方程式係數
將\(f_i(x)\)的常數項係數以中國餘數定理計算新的常數項\(c_0\)
\(c_0\equiv\cases{6834\pmod{14857}\cr -5468\pmod{15397}\cr 2828\pmod{16199}}\)，\(c_0\equiv 489114568907 \pmod{N}\)

將\(f_i(x)\)的1次方係數以中國餘數定理計算新的1次方係數\(c_1\)
\(c_1\equiv\cases{-2028 \pmod{14857}\cr -4750\pmod{15397}\cr 2874\pmod{16199}}\)，\(c_1\equiv 3243065948060 \pmod{N}\)

將\(f_i(x)\)的2次方係數以中國餘數定理計算新的2次方係數\(c_1\)
\(c_2\equiv\cases{-2467 \pmod{14857}\cr -3515\pmod{15397}\cr 3573\pmod{16199}}\)，\(c_2\equiv 100000000 \pmod{N}\)

產生新的同餘方程式\(g(x)\pmod{N}\)，若\(x=x_0\)是\(g(x)\equiv 0\pmod{N}\)解，那\(x=x_0\)也會是\(f_i(x)\equiv 0\pmod{n_i}\)的解
\(g(x)=c_0+c_1x+c_2x^2\pmod{N}\)
　\(=489114568907+3243065948060x+100000000x^2\pmod{N}\)

產生lattice，希望能找到較小的解\(x=x_0\)\((x_0<X=15474)\)
\(B=\left[\matrix{c_0&c_1X&c_2X^2&\frac{1}{d+1}\cr
N&0&0&0\cr
0&NX&0&0\cr
0&0&NX^2&0}\right]\)
\(\left[\matrix{489114568907&50183202480280440&23944467600000000&\frac{1}{3}\cr
3705573556571&0&0&0\cr
0&57340045214379654&0&0\cr
0&0&887279859647310765996&0}\right]\)

經LLL化簡lattice
\(B=\left[\matrix{0&0&0&\frac{3705573556571}{3}\cr
3705573556571&0&0&0\cr
-705084292305&-1585793949534&3095540771328&\frac{167522755129}{3}\cr
233266894054&-3534864776520&-1757763366516&240304851747}\right]\)

第1,2列向量都有0，改取第3列向量
\(\displaystyle \vec{b_3}=[-705084292305,-1585793949534,3095540771328,\frac{167522755129}{3}]\)

化簡後方程式\(h(x)\)不需要同餘\(N\)
\(\displaystyle h(x)=-\frac{705084292305}{X^0}-\frac{1585793949534}{X^1}x+\frac{3095540771328}{X^2}x^2\)
　\(\displaystyle =-\frac{705084292305}{15474^0}-\frac{1585793949534}{15474^1}x+\frac{3095540771328}{15474^2}x^2\)
　\(=-705084292305-102481191x+12928x^2\)
　\(=(x-12345)(12928x+57114969)\)
得\(x=12345\)


參考資料
Håstad, J.: Solving Simultaneous Modular Equations of Low Degree. SIAM Journalon Computing 17(2), 336–341 (1988)
http://www.csc.kth.se/~johanh/rsalowexponent.pdf
http://citeseerx.ist.psu.edu/vie ... p=rep1&type=pdf
註：
原本論文以n代表邊界，但之後的資料改以X表示，本文章也以X表示能找到小於X的解x0。


請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下
要先載入LLL.mac才能使用LLL指令
(%i1)　load("LLL.mac");
(%o1)　C:/maxima-5.43.2/share/maxima/5.43.2/LLL.mac

有3個密文
(%i2)　Cipertext:[5926,3031,5421];
(Cipertext)　\([5926,3031,5421]\)

有3個公鑰\(n_i\)
(%i3)　n:[14857,15397,16199];
(n)　\([14857,15397,16199]\)

有3個時戳
(%i4)　Timestamp:[1340,1347,1356];
(Timestamp)　\([1340,1347,1356]\)

同餘方程式最高次方\(d\)
(%i5)　d:2;
(d)　2

根據密文和時戳產生同餘方程式\(f_i(x)\)
(%i6)　fx:create_list(polymod((10000*x+Timestamp[ i ])^3-Cipertext[ i ],n[ i ]),i,1,length(n));
(fx)　\(\matrix{[-2467x^2-2028x+6834,\cr -3515x^2-4750x-5468,\cr 3573x^2+2874x+2828]}\)

\(f_i(x)\)的常數項係數
(%i7)　a0:create_list(coeff(fx[ i ],x,0),i,1,length(n));
(a0)　\([6834,-5468,2828]\)

\(f_i(x)\)的1次方係數
(%i8)　a1:create_list(coeff(fx[ i ],x,1),i,1,length(n));
(a1)　\([-2028,-4750,2874]\)

\(f_i(x)\)的2次方係數
(%i9)　a2:create_list(coeff(fx[ i ],x,2),i,1,length(n));
(a2)　\([-2467,-3515,3573]\)

利用中國餘數定理計算新的常數項\(c_0\)
(%i10)　c0:chinese(a0,n);
(c0)　\(489114568907\)

利用中國餘數定理計算新的1次方係數\(c_1\)
(%i11)　c1:chinese(a1,n);
(c1)　\(3243065948060\)

利用中國餘數定理計算新的2次方係數\(c_2\)
(%i12)　c2:chinese(a2,n);
(c2)　\(100000000\)

產生新的同餘方程式\(g(x)\pmod{N}\)，若\(x=x_0\)是\(g(x)\equiv 0\pmod{N}\)的解，那\(x=x_0\)也會是\(f_i(x)\equiv 0\pmod{n_i}\)的解
(%i13)　gx:c0+c1*x+c2*x^2+c3*x^3;
(gx)　\(100000000x^2+3243065948060x+489114568907\)

\(\displaystyle N=\prod_{i=1}^3 n_i\)
(%i14)　N:product(n[ i ],i,1,length(n));
(N)　\(3705573556571\)

希望能找到\(|\;x_0|\;<X=\lfloor\;N^{2/(d(d+1))} \rfloor\;，g(x_0)\equiv 0\pmod{N}\)
(%i15)　X:floor(N^(2/(d*(d+1))));
(X)　\(15474\)

定義lattice產生方式
(%i17)
kill(genlattice)$
genlattice[i,j]:=
if i=1 and j=d+2 then 1/(d+1)/*第1列第d+2行為1/(d+1)*/
else if i=1 then coeff(gx,x,j-1)*X^(j-1)/*第一行為f(x)係數乘上X^(j-1)*/
else if i=j+1 then N*X^(j-1)/*子對角線為NX^(j-1)*/
else 0$/*剩下元素為0*/

根據\(g(x)\)係數，產生lattice
(%i18)　latticeB:genmatrix(genlattice,d+2,d+2);
(latticeB)　\(\left[\matrix{
489114568907&50183202480280440&23944467600000000&\frac{1}{3}\cr
3705573556571&0&0&0\cr
0&57340045214379654&0&0\cr
0&0&887279859647310765996&0}\right]\)

經LLL化簡後的lattice B
(%i19)　latticeB: LLL(latticeB);
(latticeB)　\(\left[\matrix{\displaystyle 0&0&0&\frac{3705573556571}{3}\cr
3705573556571&0&0&0\cr
-705084292305&-1585793949534&3095540771328&\frac{167522755129}{3}\cr
233266894054&-3534864776520&-1757763366516&240304851747}\right]\)

第1,2列向量都有0，改取第3列向量
(%i20)　b3:latticeB[3];
(b3)　\(\displaystyle [-705084292305,-1585793949534,3095540771328,\frac{167522755129}{3}]\)

化簡後方程式\(h(x)\)不需要同餘\(N\)
(%i21)　hx:sum(b2[i+1]/X^i*x^i,i,0,d);
(hx)　\(12928x^2-102481191x-705084292305\)

將\(h(x)\)因式分解
(%i22)　factor(hx);
(%o22)　\((x-12345)(12928x+57114969)\)

得到較小的解\(x\)
(%i23)　x:12345;
(x)　\(12345\)

驗證答案\(f_i(12345)\equiv 0 \pmod{n_i}\)
(%i24)　create_list(mod(ev(fx[ i ],x=x),n[ i ]),i,1,length(n));
(%o24)　\([0,0,0]\)

Håstad方法	Coppersmith方法
可以找出比邊界\(X\)還小的解\(x_0\)(\(\displaystyle |\;x_0|\;<X=N^{\displaystyle \frac{2}{d(d+1)}}\))	可以找出比邊界\(X\)還小的解\(x_0\)(\(\displaystyle |\;x_0|\;<X=\frac{1}{2}N^{\displaystyle \frac{1}{d}}\))
將\(f(x)\)各項係數取lattice如下 \(B=\matrix{\matrix{常數項&1次方&2次方&\ldots&d-1次方&d次方&} \cr \left[\matrix{a_0&a_1X&a_2X^2&\ldots&a_{d-1}X^{d-1}&a_dX^d&\frac{1}{d+1} \cr N&0&0&0&0&0&0\cr 0&NX&0&0&0&0&0\cr 0&0&NX^2&0&0&0&0\cr &&&\ddots&&&\cr 0&0&0&0&NX^{d-1}&0&0\cr 0&0&0&0&0&NX^d&0}\right]}\) 該lattice的向量線性組合為 \(\matrix{\matrix{s\cr -s_0 \cr -s_1 \cr -s_2 \cr \vdots \cr -s_{d-1}\cr -s_d}&\left[\matrix{a_0&a_1X&a_2X^2&\ldots&a_{d-1}X^{d-1}&a_dX^d&\frac{1}{d+1} \cr N&0&0&0&0&0&0\cr 0&NX&0&0&0&0&0\cr 0&0&NX^2&0&0&0&0\cr &&&\ddots&&&\cr 0&0&0&0&NX^{d-1}&0&0\cr 0&0&0&0&0&NX^d&0}\right]}\) \(=\left[\matrix{sa_0&sa_1X&sa_2X^2&\ldots&sa_{d-1}X^{d-1}&sa_dX^d&\frac{s}{d+1}\cr -s_0N&0&0&0&0&0&0\cr 0&-s_1NX&0&0&0&0&0\cr 0&0&-s_2NX^2&0&0&0&0\cr 0&0&0&\ddots&0&0&0\cr 0&0&0&0&-s_{d-1}NX^{d-1}&0&0\cr 0&0&0&0&0&-s_dNX^d&0}\right]\) \(=[(sa_0-s_0N),(sa_1-s_1N)X,\ldots,(sa_{d-1}-s_{d-1}N)X^{d-1},(sa_d-s_dN)X^d,\frac{s}{d+1}]\) 將向量線性組合前\(d+1\)個分量除以\(X^i\)為係數的方程式 \(h(x)=(sa_0-s_0N)+(sa_1-s_1N)x+\ldots+(sa_{d-1}-s_{d-1}N)x^{d-1}+(sa_d-s_dN)x^d\) 　\(=s(a_0+a_1x+\ldots+a_{d-1}x^{d-1}+a_d x^d)-N(s_0+s_1x^1+\ldots+s_{d-1}x^{d-1}+s_dx^d)\) 　\(=sf(x)-N(s_0+s_1x^1+\ldots+s_{d-1}x^{d-1}+s_dx^d)\) 得到\(h(x)\equiv sf(x)\pmod{N}\) 若\(x=x_0\)是\(h(x)\equiv 0 \pmod{N}\)的解，那\(x=x_0\)也會是\(f(x)\equiv 0 \pmod{N}\)的解。	將\(f(x)\)各項係數取lattice如下 \(B=\left[\matrix{1&0&0&\ldots&0&0&a_0 \cr 0&X^{-1}&0&0&0&0&a_1\cr 0&0&X^{-2}&0&0&0&a_2\cr 0&0&0&X^{-3}&0&0&a_3\cr &&&\ddots&&&\cr 0&0&0&0&X^{-(d-1)}&0&a_{d-1}\cr 0&0&0&0&0&X^{-d}&a_d\cr 0&0&0&0&0&0&N}\right] \matrix{常數項\cr 1次方\cr 2次方\cr 3次方\cr \vdots \cr d-1次方\cr d次方}\) 該lattice的向量線性組合為 \(\matrix{\matrix{1\cr x_0 \cr x_0^2 \cr x_0^3 \cr \vdots \cr x_0^{d-1}\cr x_0^d\cr -y_0}&\left[\matrix{1&0&0&\ldots&0&0&a_0 \cr 0&X^{-1}&0&0&0&0&a_1\cr 0&0&X^{-2}&0&0&0&a_2\cr 0&0&0&X^{-3}&0&0&a_3\cr &&&\ddots&&&\cr 0&0&0&0&X^{-(d-1)}&0&a_{d-1}\cr 0&0&0&0&0&X^{-d}&a_d\cr 0&0&0&0&0&0&N}\right]}\) \(=\left[\matrix{1&0&0&\ldots&0&0&a_0 \cr 0&x_0^1X^{-1}&0&0&0&0&a_1x_0^1\cr 0&0&x_0^2X^{-2}&0&0&0&a_2x_0^2\cr 0&0&0&x_0^3X^{-3}&0&0&a_3x_0^3\cr &&&\ddots&&&\cr 0&0&0&0&x_0^{(d-1)}X^{-(d-1)}&0&a_{d-1}x_0^{(d-1)}\cr 0&0&0&0&0&x_0^{d}X^{-d}&a_dx_0^d\cr 0&0&0&0&0&0&-y_0N}\right]\) \(\displaystyle =\left[1,\left(\frac{x_0}{X}\right),\left(\frac{x_0}{X}\right)^2,,\left(\frac{x_0}{X}\right)^3,\ldots,,\left(\frac{x_0}{X}\right)^{d-1},\left(\frac{x_0}{X}\right)^d,f(x_0)-y_0N\right]\) 若能找到\(x_0,y_0\)使得\(|\;x_0|\;<X\)、\(f(x_0)-y_0N\equiv 0\pmod{N}\) 此時向量長度\(\sqrt{1^2+\left(\frac{x_0}{X}\right)^2+\left(\frac{x_0}{X}\right)^4+\ldots+\left(\frac{x_0}{X}\right)^{2d}+0^2}<\sqrt{d+1}\)是短向量。

上面是Håstad和Coppersmith所用的lattice比較表，Håstad僅針對一個方程式\(h(x_0)=sf(x_0)\pmod{N}\)來產生lattice，而Coppersmith增加方程式個數，產生更大的lattice雖然增加LLL執行時間，但能提高解的上界。
\(f(x_0)-y_0N=0\)
\(x_0f(x_0)-x_0y_0N=0\)
\((f(x_0))^2-y_0^2N^2=0\)
\(x_0(f(x_0))^2-x_0y_0^2N^2=0\)
…
Coppersmith方法如下：

方法	範例
問題敘述
設同餘方程式為\(p(x)=x^k+a_{k-1}x^{k-1}+\ldots+a_1 x+a_0\equiv 0 \pmod{N}\) 且\(p(x)\)為monic(最高次方項係數為1)且不可分解。 利用LLL方法可以找出比邊界\(X\)還小的解\(x_0\)(\(\displaystyle |\;x_0|\;<X=\frac{1}{2}N^{\displaystyle \frac{1}{k}}\)) 使得\(p(x_0)\equiv 0 \pmod{N}\)	設同餘方程式為\(p(x)=x^2+14x+19\equiv 0\pmod{35}\) 且\(p(x)\)為monic(最高次方項係數為1)且不可分解。 利用LLL方法可以找出比邊界\(X\)還小的解 使得\(p(x_0)\equiv 0 \pmod{35}\)
步驟1：計算參數\(h\)和\(X\)
步驟3需要\(hk\ge7\)、\(\displaystyle h-1\ge (hk-1)(\frac{1}{k}-\epsilon)\)和\(\displaystyle X=\frac{1}{2}N^{\frac{1}{k}}\) \(hk\ge7\)化簡為\(\displaystyle h\ge \frac{7}{k}\) \(\displaystyle h-1\ge (hk-1)(\frac{1}{k}-\epsilon)\)化簡為 \(\displaystyle h-1\ge h-\epsilon hk-\frac{1}{k}+\epsilon\) \(\displaystyle \epsilon hk\ge \frac{k+\epsilon k-1}{k}\) \(\displaystyle h\ge \frac{k+\epsilon k-1}{\epsilon k^2}\) 兩個條件合併一起 \(\displaystyle h\ge max\left(\frac{7}{k},\frac{k+\epsilon k-1}{\epsilon k^2}\right)\)	\(p(x)\)最高次方為2次方\((k=2)\) 設\(\epsilon=0.1\) \(\displaystyle h\ge max\left(\frac{7}{2},\frac{2+0.1\cdot 2-1}{0.1\cdot 2^2}\right)=max(3.5,3)\) \(h\ge 4\)但本範例取\(h=3\)就能得到答案 \(\displaystyle X=\frac{1}{2}35^{1/2}=2.958\)，取\(X=2\)
步驟2：產生矩陣\(M\)
矩陣\(M\)是大小\((2hk-k)\times(2hk-k)\)的上三角矩陣 \(M=\left[\matrix{D&A\cr0_{hk}&D'}\right]\) 左上角矩陣\(D=(d(i,j))\)是大小\(hk\times hk\)的對角矩陣， 對角線元素為\(d_{i,i}=\delta X^{1-i}\)，\(\displaystyle \delta=\frac{1}{\sqrt{hk}}\) 右上角矩陣\(A=(a_{i,j})\)是大小\((hk\times (h-1)k)\)矩陣， 矩陣元素\(a_{i,j}\)是\(x^u(p(x))^v\)的\(x^i\)項係數 其中\(\displaystyle v=\lfloor\;\frac{k+j-1}{k}\rfloor\;\)和\(u=(j-1)-k(v-1)\) 左下角\(0_{hk}\)為零矩陣 右下角矩陣\(D'=(d_{i,j}')\)是大小\(((h-1)k\times (h-1)k)\)的對角矩陣， 對角線元素為\(d_{i,i}'=N^v\) \(M\)為上三角矩陣，行列式值為對角線元素相乘 \(\displaystyle det(M)=\prod_{g=0}^{hk-1}\delta X^{-g}\prod_{\gamma(i,j)=hk}^{2hk-k}N^j\) 　　\(\displaystyle =\delta^{hk} X^{-{\frac{hk(hk-1)}{2}}}N^{\frac{hk(h-1)}{2}}\) 　　\(\displaystyle =(N^{h-1}X^{-(hk-1)}(hk)^{-1})^{\frac{hk}{2}}\) －－－－－－－－－－－－－－－－－－－ \(p(x)=x^2+ax+b\equiv 0\pmod{N}\) \(xp(x)=x^3+ax^2+bx\equiv 0\pmod{N}\) \((p(x))^2=x^4+cx^3+dx^2+ex+f\equiv 0\pmod{N^2}\) \(x(p(x))^2=x^5+cx^4+dx^3+ex^2+fx\equiv 0\pmod{N^2}\) \(M=\left[\matrix{\matrix{\delta&&&&&\cr&\delta X^{-1}&&&&\cr&&\delta X^{-2}&&&\cr&&&\delta X^{-3}&&\cr&&&&\delta X^{-4}&\cr&&&&&\delta X^{-5}}&\matrix{│\cr │\cr │\cr │}& \matrix{ b&0&f&0\cr a&b&e&f\cr 1&a&d&e\cr &1&c&d\cr &&1&c\cr &&&1}\cr ―――――――――&┼&――――――― \cr \matrix{0}&\matrix{│\cr │\cr │}&\matrix{N&&&\cr &N&&\cr &&N^2&\cr &&&N^2}}\right]\) 設\(r\)向量左手邊為\(r_g=x_0^g\)，右手邊為\(x_0\)和\(y_0\)的非負次方\(r_{\gamma(i,j)}=-x_0^iy_0^j\) \(r=[1,x_0,x_0^2,x_0^3,x_0^4,x_0^5,-y_0,-x_0y_0,-y_0^2,-x_0y_0^2]\) 計算向量線性組合\(s=rM\) \(\displaystyle s=[1,\delta\frac{x_0}{X},\delta\left(\frac{x_0}{X}\right)^2,\delta\left(\frac{x_0}{X}\right)^3,\delta\left(\frac{x_0}{X}\right)^4,\delta\left(\frac{x_0}{X}\right)^5,\) \(-p(x_0)-y_0N,x_0p(x_0)-x_0y_0N,(p(x_0))^2-y_0^2N^2,x_0(p(x_0))^2-x_0y_0^2N^2]\) 存在\(|\;x_0|\;<X\)和\(y_0\)使得\(p(x_0)-y_0N=0\) \(\displaystyle s=\left[1,\delta\frac{x_0}{X},\delta\left(\frac{x_0}{X}\right)^2,\delta\left(\frac{x_0}{X}\right)^3,\delta\left(\frac{x_0}{X}\right)^4,\delta\left(\frac{x_0}{X}\right)^5,0,0,0,0\right]\) 計算向量\(s\)長度比1短 \(\displaystyle \Vert\;s\Vert\;=\sqrt{\sum_{k=0}^{hk-1}\left(\delta \left( \frac{x_0}{X}\right)^{k}\right)^2}<\sqrt{\sum_{k=0}^{hk-1}(\delta \cdot 1)^2}=\sqrt{\delta^2\cdot hk}=1\)	\(p(x)=x^2+14x+19\equiv 0\pmod{35}\) \(xp(x)=x^3+14x^2+19x\equiv 0\pmod{35}\) \(p(x)^2=x^4+28x^3+234x^2+532x+361\equiv 0\pmod{35^2}\) \(xp(x)^2=x^5+28x^4+234x^3+532x^2+361x\equiv 0\pmod{35^2}\) 原本\(\displaystyle \delta=\frac{1}{\sqrt{hk}}=\frac{1}{\sqrt{6}}\)，但本範例忽略\(\delta\)也能算出答案 \(M=\left[\matrix{\matrix{1&&&&&\cr&2^{-1}&&&&\cr&&2^{-2}&&&\cr&&&2^{-3}&&\cr&&&&2^{-4}&\cr&&&&&2^{-5}}&\matrix{│\cr │\cr │\cr │}& \matrix{ 19&0&361&0\cr 14&19&532&361\cr 1&14&234&532\cr &1&28&234\cr &&1&28\cr &&&1}\cr ―――――――――&┼&――――――― \cr \matrix{0}&\matrix{│\cr │\cr │}&\matrix{35&&&\cr &35&&\cr &&1225&\cr &&&1225}}\right]\) \(det(M)=1\cdot 2^{-1}\ldots 2^{-5}\cdot 35 \cdot 35 \cdot 1225 \cdot 1225\) 　　\(=2^{-15}35^6\)
步驟3：矩陣\(M\)基本列運算得到\(\widehat{M}\)
因為\(p(x)\)為monic(最高次方項係數為1)，在矩陣\(A\)的對角線元素為1，進行基本列運算將右上角化簡為零，右下角化簡為零，再將對角線元素為1的一整列移到整個矩陣下方。 \(\widetilde{M}=\left[\matrix{\widehat{M}&│&0_{(hk\times (h-1)k)}\cr ―&┼&――――――\cr A'&│&I_{(h-1)k}}\right]\) 得到左上角矩陣\(\widehat{M}\) －－－－－－－－－－－－－－－－－－－ \(|\;det(M)|\;=|\;det(\widetilde{M})|\;=|\;det(\widehat{M})det(I)|\;=|\;det(\widehat{M})|\;\) 得到\(\displaystyle det(M)=(N^{h-1}X^{-(hk-1)}(hk)^{-1})^{\frac{hk}{2}}=det(\widehat{M})\) 設\(hk\ge 7\)，可推得\(\displaystyle hk<2^{\frac{hk-1}{2}}\)，\((hk)^{-1}>2^{-\frac{(hk-1)}{2}}\) \(\displaystyle det(\widehat{M})>(N^{h-1}X^{-(hk-1)}2^{-\frac{(hk-1)}{2}})^{\frac{hk}{2}}\) 設\(\displaystyle X=\frac{1}{2}N^{\frac{1}{k}-\epsilon}\)，可推得\(\displaystyle X^{-1}=2N^{-(\frac{1}{k}-\epsilon)}\)，\(\displaystyle X^{-(hk-1)}=2^{hk-1}N^{-(hk-1)(\frac{1}{k}-\epsilon)}\) \(\displaystyle det(\widehat{M})>(N^{n-1-(hk-1)(\frac{1}{k}-\epsilon)}\cdot 2^{+\frac{(hk-1)}{2}})^{\frac{hk}{2}}\) 設\(\displaystyle n-1\ge (hk-1)(\frac{1}{k}-\epsilon)\) \(\displaystyle det(\widehat{M})>(N^0\cdot 2^{+\frac{(hk-1)}{2}})2^{\frac{hk}{2}}=2^{\frac{(hk)(hk-1)}{4}}\) 設\(n=hk=dim(\widehat{M})\) \(\displaystyle det(\widehat{M})>2^{\frac{n(n-1)}{4}}\) \(\displaystyle det(\widehat{M})^{\frac{1}{n}}>2^{\frac{n-1}{4}}\) \(\displaystyle det(\widehat{M})^{\frac{1}{n}}\cdot 2^{-\frac{n-1}{4}}>1\) 由步驟2結論可知向量\(s\)長度小於1(\(1>\Vert\;s\Vert\;\)) 得到\(\displaystyle det(\widehat(M))^{\frac{1}{n}}\cdot 2^{-\frac{n-1}{4}}>\Vert\;s\Vert\;\)	將右上角化簡為零 \(\widetilde{M}=\left[\matrix{\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr &\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr &&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}\cr &&&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}\cr &&&&\frac{1}{16}&-\frac{7}{8}\cr &&&&&\frac{1}{32}}&\matrix{│\cr│\cr│\cr│\cr│\cr│}&\matrix{\displaystyle 0&0&0&0\cr 0&0&0&0\cr 1&0&0&0\cr &1&0&0\cr &&1&0\cr &&&1}\cr ――――――――――――――&┼&―――――――――\cr \matrix{0}&\matrix{│\cr│\cr│\cr│}&\matrix{35&&&\cr&35&&\cr&&1225&\cr&&&1225}}\right]\) 將右下角化簡為零 \(\widetilde{M}=\left[\matrix{\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr &\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr &&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}\cr &&&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}\cr &&&&\frac{1}{16}&-\frac{7}{8}\cr &&&&&\frac{1}{32}}&\matrix{│\cr│\cr│\cr│\cr│\cr│}&\matrix{\displaystyle 0&0&0&0\cr 0&0&0&0\cr 1&0&0&0\cr &1&0&0\cr &&1&0\cr &&&1}\cr ――――――――――――――&┼&―――\cr \matrix{\displaystyle &&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&-\frac{3675}{2}\cr &&&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr &&&&-\frac{1225}{16}&-\frac{8575}{8}\cr &&&&&-\frac{1225}{32}}&\matrix{│\cr│\cr│\cr│}&\matrix{0&&&\cr&0&&\cr&&0&\cr&&&0}}\right]\) 將對角線元素為1的一整列移到整個矩陣下方 \(\widetilde{M}=\left[\matrix{\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr &\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr &&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&-\frac{3675}{2}\cr &&&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr &&&&-\frac{1225}{16}&-\frac{8575}{8}\cr &&&&&-\frac{1225}{32}}&\matrix{│\cr│\cr│\cr│\cr│\cr│}&\matrix{\displaystyle 0&0&0&0\cr 0&0&0&0\cr 0&0&0&0\cr &0&0&0\cr &&0&0\cr &&&0}\cr ――――――――――――――&┼&―――\cr \matrix{\displaystyle 　　&　&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}\cr &&&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}\cr &&&&\frac{1}{16}&-\frac{7}{8}\cr &&&&&\frac{1}{32}\cr}&\matrix{│\cr│\cr│\cr│}&\matrix{1&&&\cr&1&&\cr&&1&\cr&&&1}}\right]\) 得到左上角矩陣\(\widehat{M}\) \(\widehat{M}=\left[\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr &\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr &&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&-\frac{3675}{2}\cr &&&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr &&&&-\frac{1225}{16}&-\frac{8575}{8}\cr &&&&&-\frac{1225}{32}}\right]\) \(\displaystyle det(\widehat{M})=1\cdot \frac{1}{2}\cdot \frac{-35}{4}\cdot \frac{-35}{8}\cdot \frac{-1225}{16}\cdot \frac{-1225}{35}\) 　　\(\displaystyle =2^{-15}35^6\) \(\widehat{M}\)乘32倍變成整數 \(\widehat{M}=\left[\matrix{ 32&0&-152&1064&-6726&42028\cr &16&-112&708&-4424&27605\cr &&-280&1960&-11060&58800\cr &&&-140&1960&-19250\cr &0&&&-2450&34300\cr &&&&&-1225}\right]\)
步驟4：經LLL化簡和Gram-Schmidt正交化後得到不需要同餘\(N\)的方程式
矩陣\(\widehat{M}\)經LLL化簡為\(B\) \(B=LLL(\widehat{M})\) 矩陣\(B\)經Gram-Schmidt正交化得到\(B^{*}\) \(B^{*}=\)Gram-Schmidt\((B)\) －－－－－－－－－－－－－－－－－－－ 引理1： 假設lattice \(L\)經LLL化簡後向量為\(b_1,b_2,\ldots,b_n\)，經Gram-Schmidt化簡後向量為\(b_1^{*},b_2^{*},\ldots,b_n^{*}\)，則\(\displaystyle \Vert\;b_n^{*}\Vert\;\ge det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}\)。 [證明] \(\displaystyle det(L)^2=\prod_{i=1}^n \Vert\;b_i^{*}\Vert\;^2=\Vert\;b_1^{*}\Vert\;^2 \Vert\;b_2^{*}\Vert\;^2\cdot \Vert\;b_n^{*}\Vert\;^2\) 經LLL化簡後向量長度滿足\(\Vert\;b_i^{*}\Vert\;^2\le 2\Vert\;b_{i+1}^{*}\Vert\;^2\)　\((i=1,2,\ldots,n-1)\) \(\displaystyle det(L)^2 \le \left(2^{n-1}\Vert\;b_n^{*}\Vert\;^2\right)\left(2^{n-2}\Vert\;b_n^{*}\Vert\;^2\right)\ldots \left(\Vert\;b_n^{*}\Vert\;^2\right)\left(\Vert\;b_n^{*}\Vert\;^2\right)\) \(\displaystyle det(L)^2 \le 2^{\frac{n(n-1)}{2}}\Vert\;b_n^{*}\Vert\;^{2n}\) \(\displaystyle \Vert\;b_n^{*}\Vert\;^{2n}\ge det(L)^2 2^{-\frac{n(n-1)}{2}}\) 兩邊各加上\(\displaystyle \frac{1}{2n}\)次方\(\Vert\;b_n^{*}\Vert\;\ge det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}\) 引理2： 假設lattice \(L\)其中一個元素\(s\)滿足\(\displaystyle det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}>\Vert\;s\Vert\;\)，則\(s\)會落在由\(b_1,b_2,\ldots,b_{n-1}\)所展開的超平面上。 [證明] 將lattice 元素\(s\)表示成\(b_1,b_2,\ldots,b_n\)的線性組合\(\displaystyle s=\sum_{i=1}^n a_ib_i\)，其中\(a_i\)是整數 向量長度\(\Vert\;s\Vert\;=\Vert\;a_1b_1+a_2b_2+\ldots+a_nb_n\Vert\;\ge \Vert\;a_nb_n\Vert\;=|\;a_n|\;\Vert\;b_n\Vert\;\ge |\;a_n|\;\Vert\;b_n^{*}\Vert\;\) 由引理1可知\(\Vert\;b_n^{*}\Vert\;\ge det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}\)、\(\displaystyle det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}>\Vert\;s\Vert\;\)和 \(\Vert\;s\Vert\;\ge |\;a_n|\;\Vert\;b_n^{*}\Vert\;\)，得到\(\Vert\;b_n^{*}\Vert\;>|\;a_n|\;\Vert\;b_n^{*}\Vert\;\)，\(a_n=0\) \(s\)可表示成\(b_1,b_2,\ldots,b_{n-1}\)的線性組合，\(s\)落在由\(b_1,b_2,\ldots,b_{n-1}\)所展開的超平面上。 －－－－－－－－－－－－－－－－－－－ \(\displaystyle s=\left[1,\delta \frac{x_0}{X},\ldots,\delta\left(\frac{x_0}{X}\right)^{hk-1}\right]\)是lattice\(\widehat{M}\)的向量元素， 由步驟3結論可知\(\displaystyle det(\widehat{M})^{\frac{1}{n}}2^{-\frac{n-1}{4}}>\Vert\;s\Vert\;\) 由上面引理2可知\(s\)落在由\(b_1,b_2,\ldots,b_{n-1}\)所展開的超平面上。 而這個超平面會和Gram-Schmidt的向量\(b_n^{*}\)正交，得到\(s\cdot b_n^{*}=0\)，可得到一個不需要同餘\(N\)的方程式。	LLL化簡 \(B=\left[\matrix{0&160&0&-60&0&-100\cr -64&-64&-88&80&-72&-51\cr 64&-48&32&4&-180&16\cr 128&-80&-48&16&116&-13\cr -32&-96&-16&-132&90&-108\cr -64&-32&248&96&-30&-141}\right]\) Gram-Schmidt正交化 \(B^{*}=\left[\matrix{\displaystyle 0&160&0&-60&0&-100\cr -64&-\frac{164}{7}&-88&\frac{907}{14}&-72&-\frac{1069}{14}\cr \frac{4327744}{55201}&-\frac{213712}{55201}&\frac{2859392}{55201}&-\frac{1388192}{55201}&-\frac{9041940}{55201}&\frac{490976}{55201}\cr \frac{2396089600}{17933807}&-\frac{673016640}{17933807}&-\frac{1044380280}{17933807}&\frac{154688960}{17933807}&\frac{745216000}{17933807}&-\frac{1169640000}{17933807}\cr -\frac{2184694400}{45963969}&-\frac{1521655800}{15321323}&\frac{344724800}{15321323}&-\frac{6338718400}{45963969}&\frac{172362400}{45963969}&-\frac{1166905600}{15321323}\cr -\frac{117600}{17929}&-\frac{627200}{17929}&\frac{3763200}{17929}&\frac{2508800}{17929}&\frac{627200}{17929}&-\frac{2508800}{17929}}\right]\) 取最後一列向量乘上\(\displaystyle \frac{17929}{39200}\)變成整數 \([−3, −16, 96, 64, 16, −64]\) 形成不需要再同餘\(N\)的方程式 \(\displaystyle h(x)=-3-16\left(\frac{x}{2}\right)+96\left(\frac{x}{2}\right)^2+64\left(\frac{x}{2}\right)^3+16\left(\frac{x}{2}\right)^4-64\left(\frac{x}{2}\right)^5\) 　\(=-3-8x+24x^2+8x^3+x^4-2x^5\) 　\(=-(x-3)(2x-1)(x^3+3x^2+5x+1)\) 解方程式得到答案 \(x=3\)

參考資料：
D. Coppersmith. Finding a small root of a univariate modular equation. In Proceedings of Eurocrypt 1996, volume 1070 of Lecture Notes in Computer Science, pages 155–165. Springer, 1996.
https://link.springer.com/chapter/10.1007/3-540-68339-9_14
N. Howgrave-Graham. Finding small roots of univariate modular equations revisited. In Cryptography and Coding– Proc. IMA ’97, volume 1355 of Lecture Notes in Computer Science, pages 131–142. Springer, 1997.
https://link.springer.com/chapter/10.1007/BFb0024458
有二次同餘方程式範例
Finding Small Roots of Polynomial Equations Using Lattice Basis Reduction
https://ntnuopen.ntnu.no/ntnu-xm ... e=1&isAllowed=y
有三次同餘方程式範例
Lattice Basis Reduction：An Introduction to the LLL Algorithm and Its Applications
https://www.routledge.com/Lattic ... /book/9781439807026
有一整章關於Coppersmith方法的介紹



請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下
要先載入LLL.mac才能使用LLL指令
(%i1)　load("LLL.mac");
(%o1)　C:/maxima-5.43.2/share/maxima/5.43.2/share/LLL.mac

要先載入eigen.mac才能使用gramschmidt指令
(%i2)　load("eigen.mac");
(%o2)　C:/maxima-5.43.2/share/maxima/5.43.2/share/matrix/eigen.mac

要先載入diag.mac才能使用diag指令
(%i3)　load("diag.mac");
(%o3)　C:/maxima-5.43.2/share/maxima/5.43.2/share/contrib/diag.mac

同餘方程式\(p(x)\)
(%i4)　px:x^2+14*x+19;
(px)　\(x^2+14x+19\)

\(p(x)\equiv 0\pmod{N}\)
(%i5)　N:35;
(N)　\(35\)

\(p(x)\)的次數\(k\)
(%i6)　k:hipow(px,x);
(k)　\(2\)

設誤差值\(\epsilon=0.1\)
(%i7)　epsilon:0.1;
(epsilon)　\(0.1\)

參數\(h\)，按照公式應該是\(h=4\)，但\(h=3\)也能算出來
(%i9)
h:ceiling(max(7/k,(k+epsilon*k-1)/(epsilon*k^2)));
h:3;
(h)　4
(h)　3

\(\widehat{M}\)的維度\(n=hk\)
(%i10)　n:h*k;
(n)　6

參數\(\delta\)，按照公式應該是\(\displaystyle \delta=\frac{1}{\sqrt{6}}\)，改成\(\delta=1\)方便計算
(%i12)
delta:1/sqrt(h*k);
delta:1;
(delta)　\(\displaystyle \frac{1}{\sqrt{6}}\)
(delta)　1

希望能找到\(|\;x|\;<X=\frac{1}{2}N^{1/k}\)，\(p(x)\equiv 0\pmod{N}\)
(%i13)　X:floor(1/2*N^(1/k));
(X)　2

左上角矩陣對角線元素\(\delta X^{-i}\)
(%i14)　Xpower:create_list(delta*X^-(i-1),i,1,h*k);
(Xpower)　\(\displaystyle \left[1,\frac{1}{2},\frac{1}{4},\frac{1}{8},\frac{1}{16},\frac{1}{32}\right]\)

左上角矩陣
(%i15)　D1:diag(Xpower);
(D1)　\(\left[\matrix{\displaystyle 1&0&0&0&0&0\cr
0&\frac{1}{2}&0&0&0&0\cr
0&0&\frac{1}{4}&0&0&0\cr
0&0&0&\frac{1}{8}&0&0\cr
0&0&0&0&\frac{1}{16}&0\cr
0&0&0&0&0&\frac{1}{32}}\right]\)

多項式\(x^u\cdot p(x)^v\)
(%i16)　xpxpower:create_list(x^u*px^v,v,1,h-1,u,0,k-1);
(xpxpower)　\([x^2+14x+19,x(x^2+14x+19),(x^2+14x+19)^2,x(x^2+14x+19)^2]\)

\(x^1,x^2,\ldots,x^{n-1}\)
(%i17)　xpower:create_list(x^i,i,1,n-1);
(xpower)　\([x,x^2,x^3,x^4,x^5]\)

取多項式\(x^u\cdot p(x)^v\)係數，形成右上角矩陣(常數項在最後一行)
(%i18)　A:augcoefmatrix(xpxpower,xpower);
(A)　\(\left[\matrix{14&1&0&0&0&19\cr
19&14&1&0&0&0\cr
532&234&28&1&0&361\cr
361&532&234&28&1&0}\right]\)

將常數項移到第一行
(%i19)　A:addcol(col(A,h*k),submatrix(A,h*k));
(A)　\(\left[ \matrix{
19&14&1&0&0&0\cr
0&19&14&1&0&0\cr
361&532&234&28&1&0\cr
0&361&532&234&28&1}\right]\)

矩陣\(A\)轉置
(%i20)　A:transpose(A);
(A)　\(\left[ \matrix{
19&0&361&0\cr
14&19&532&361\cr
1&14&234&532\cr
0&1&28&234\cr
0&0&1&28\cr
0&0&0&1}\right]\)

左下角0矩陣
(%i21)　Zero:zeromatrix((h-1)*k,h*k);
(Zero)　\(\left[ \matrix{
0&0&0&0&0&0\cr
0&0&0&0&0&0\cr
0&0&0&0&0&0\cr
0&0&0&0&0&0}\right]\)

右下角矩陣元素\(N^v\)
(%i22)　Npower:create_list(N^v,v,1,h-1,u,0,k-1);
(Npower)　\([35,35,1225,1225]\)

右下角矩陣
(%i23)　D2:diag(Npower);
(D2)　\(\left[ \matrix{
35&0&0&0\cr
0&35&0&0\cr
0&0&1225&0\cr
0&0&0&1225}\right]\)

4個子矩陣合併成矩陣\(M\)
(%i24)　M:addrow(addcol(D1,A),addcol(Zero,D2));
(M)　\(\left[ \matrix{\displaystyle
1&0&0&0&0&0&19&0&361&0\cr
0&\frac{1}{2}&0&0&0&0&14&19&532&361\cr
0&0&\frac{1}{4}&0&0&0&1&14&234&532\cr
0&0&0&\frac{1}{8}&0&0&0&1&28&234\cr
0&0&0&0&\frac{1}{16}&0&0&0&1&28\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1\cr
0&0&0&0&0&0&35&0&0&0\cr
0&0&0&0&0&0&0&35&0&0\cr
0&0&0&0&0&0&0&0&1225&0\cr
0&0&0&0&0&0&0&0&0&1225}\right]\)

將矩陣\(M\)複製成另一個矩陣\(\widetilde{M}\)，進行矩陣列運算
(%i25)　M_tilde:copymatrix(M)$

將右上角化簡為零
(%i27)
for i:k+1 thru n do
  (for j:1 thru i-1 do
     (print("第",j,"列=第",j,"列-",M_tilde[j,i+n-k],"*第",i,"列=",
               M_tilde[j]:M_tilde[j]-M_tilde[j,i+n-k]*M_tilde[ i ])
     )
  )$
M_tilde;
第1列=第1列-19*第3列\(\displaystyle =[1,0,-\frac{19}{4},0,0,0,0,-266,-4085,-10108]\)
第2列=第2列-14*第3列\(\displaystyle =[0,\frac{1}{2},-\frac{7}{2},0,0,0,0,-177,-2744,-7087]\)
第1列=第1列--266*第4列\(\displaystyle =[1,0,-\frac{19}{4},\frac{133}{4},0,0,0,0,3363,52136]\)
第2列=第2列--177*第4列\(\displaystyle =[0,\frac{1}{2},-\frac{7}{2},\frac{177}{8},0,0,0,0,2212,34331]\)
第3列=第3列-14*第4列\(\displaystyle =[0,0,\frac{1}{4},-\frac{7}{4},0,0,1,0,-158,-2744]\)
第1列=第1列-3363*第5列\(\displaystyle =[1,0,-\frac{19}{4},\frac{133}{4},-\frac{3363}{16},0,0,0,0,-42028]\)
第2列=第2列-2212*第5列\(\displaystyle =[0,\frac{1}{2},-\frac{7}{2},\frac{177}{8},-\frac{553}{4},0,0,0,0,-27605]\)
第3列=第3列--158*第5列\(\displaystyle =[0,0,\frac{1}{4},-\frac{7}{4},\frac{79}{8},0,1,0,0,1680]\)
第4列=第4列-28*第5列\(\displaystyle =[0,0,0,\frac{1}{8},-\frac{7}{4},0,0,1,0,-550]\)
第1列=第1列--42028*第6列\(\displaystyle =[1,0,-\frac{19}{4},\frac{133}{4},-\frac{3363}{16},\frac{10507}{8},0,0,0,0]\)
第2列=第2列--27605*第6列\(\displaystyle =[0,\frac{1}{2},-\frac{7}{2},\frac{177}{8},-\frac{553}{4},\frac{27605}{32},0,0,0,0]\)
第3列=第3列-1680*第6列\(\displaystyle =[0,0,\frac{1}{4},-\frac{7}{4},\frac{79}{8},-\frac{105}{2},1,0,0,0]\)
第4列=第4列--550*第6列\(\displaystyle =[0,0,0,\frac{1}{8},-\frac{7}{4},\frac{275}{16},0,1,0,0]\)
第5列=第5列-28*第6列\(\displaystyle =[0,0,0,0,\frac{1}{16},-\frac{7}{8},0,0,1,0]\)
(%o27)　\(\left[ \matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}&0&0&0&0\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}&0&0&0&0\cr
0&0&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}&1&0&0&0\cr
0&0&0&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}&0&1&0&0\cr
0&0&0&0&\frac{1}{16}&-\frac{7}{8}&0&0&1&0\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1\cr
0&0&0&0&0&0&35&0&0&0\cr
0&0&0&0&0&0&0&35&0&0\cr
0&0&0&0&0&0&0&0&1225&0\cr
0&0&0&0&0&0&0&0&0&1225}\right]\)

將右下角化簡為零
(%i29)
for i:k+1 thru n do
  (j:i+n-k,
   print("第",j,"列=第",j,"列-",M_tilde[j,j],"*第",i,"列=",
    M_tilde[j]:M_tilde[j]-M_tilde[j,j]*M_tilde[ i ])
  )$
M_tilde;
第7列=第7列-35*第3列\(\displaystyle =[0,0,-\frac{35}{4},\frac{245}{4},-\frac{2765}{8},\frac{3675}{2},0,0,0,0]\)
第8列=第8列-35*第4列\(\displaystyle =[0,0,0,-\frac{35}{8},\frac{245}{4},-\frac{9625}{16},0,0,0,0]\)
第9列=第9列-1225*第5列\(\displaystyle =[0,0,0,0,-\frac{1225}{16},\frac{8575}{8},0,0,0,0]\)
第10列=第10列-1225*第6列\(\displaystyle =[0,0,0,0,0,-\frac{1225}{32},0,0,0,0]\)
(%o29)　\(\left[ \matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}&0&0&0&0\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}&0&0&0&0\cr
0&0&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}&1&0&0&0\cr
0&0&0&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}&0&1&0&0\cr
0&0&0&0&\frac{1}{16}&-\frac{7}{8}&0&0&1&0\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1\cr
0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}&0&0&0&0\cr
0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}&0&0&0&0\cr
0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}&0&0&0&0\cr
0&0&0&0&0&-\frac{1225}{32}&0&0&0&0}\right]\)

將對角線元素為1的一整列移到整個矩陣下方
(%i31)
for i:k+1 thru n do
  (j:i+n-k,
   print("第",i,"列和第",j,"列交換"),
   [M_tilde[j],M_tilde[ i ]]:[M_tilde[ i ],M_tilde[j]]
  )$
M_tilde;
第3列和第7列交換
第4列和第8列交換
第5列和第9列交換
第6列和第10列交換
(%o31)　\(\left[ \matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}&0&0&0&0\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}&0&0&0&0\cr
0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}&0&0&0&0\cr
0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}&0&0&0&0\cr
0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}&0&0&0&0\cr
0&0&0&0&0&-\frac{1225}{32}&0&0&0&0\cr
0&0&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}&1&0&0&0\cr
0&0&0&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}&0&1&0&0\cr
0&0&0&0&\frac{1}{16}&-\frac{7}{8}&0&0&1&0\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1}\right]\)

得到左上角矩陣\(\widehat{M}\)
(%i32)　M_hat:genmatrix(lambda([i,j],M_tilde[i,j]),n,n);
(M_hat)　\(\left[ \matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr
0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}\cr
0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr
0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}\cr
0&0&0&0&0&-\frac{1225}{32}}\right]\)

\(\widehat{M}\)乘32倍變成整數
(%i33)　M_hat:M_hat*1/delta*X^(n-1);
(M_hat)　\(\left[ \matrix{
32&0&-152&1064&-6726&42028\cr
0&16&-112&708&-4424&27605\cr
0&0&-280&1960&-11060&58800\cr
0&0&0&-140&1960&-19250\cr
0&0&0&0&-2450&34300\cr
0&0&0&0&0&-1225}\right]\)

LLL化簡
(%i34)　B: LLL(M_hat);
(B)　\(\left[ \matrix{
0&160&0&-60&0&-100\cr
-64&-64&-88&80&-72&-51\cr
64&-48&32&4&-180&16\cr
128&-80&-48&16&116&-13\cr
-32&-96&-16&-132&90&-108\cr
-64&-32&248&96&-30&-141}\right]\)

Gram-Schmidt正交化
(%i35)　Bstar:apply(matrix,expand(gramschmidt(B)));
(Bstar)　\(\left[ \matrix{\displaystyle
0&160&0&-60&0&-100\cr
-64&-\frac{164}{7}&-88&\frac{907}{14}&-72&-\frac{1069}{14}\cr
\frac{4327744}{55201}&-\frac{213712}{55201}&\frac{2859392}{55201}&-\frac{1388192}{55201}&-\frac{9041940}{55201}&\frac{490976}{55201}\cr
\frac{2396089600}{17933807}&-\frac{673016640}{17933807}&-\frac{1044380280}{17933807}&\frac{154688960}{17933807}&\frac{745216000}{17933807}&-\frac{1169640000}{17933807}\cr
-\frac{2184694400}{45963969}&-\frac{1521655800}{15321323}&\frac{344724800}{15321323}&-\frac{6338718400}{45963969}&\frac{172362400}{45963969}&-\frac{1166905600}{15321323}\cr
-\frac{117600}{17929}&-\frac{627200}{17929}&\frac{3763200}{17929}&\frac{2508800}{17929}&\frac{627200}{17929}&-\frac{2508800}{17929}}\right]\)

取最後一個正交向量
(%i36)　Bstar_n:Bstar[n];
(Bstar_n)　\(\displaystyle \left[-\frac{117600}{17929},-\frac{627200}{17929},\frac{3763200}{17929},\frac{2508800}{17929},\frac{627200}{17929},-\frac{2508800}{17929}\right]\)

取各分數的分母
(%i37)　Denom:map('denom,Bstar_n);
(Denom)　\([17929,17929,17929,17929,17929,17929]\)

求最大的分母
(%i38)　MaxDenom:lmax(%);
(MaxDenom)　17929

正交向量化為整數
(%i39)　Bstar_n:Bstar_n*MaxDenom;
(Bstar_n)　\([-117600,-627200,3763200,2508800,627200,-2508800]\)

計算最大公因數
(%i40)　GCD:lreduce('gcd,Bstar_n);
(GCD)　39200

同除最大公因數，得到化簡的正交向量
(%i41)　Bstar_n:Bstar_n/GCD;
(Bstar_n)　\([-3,-16,96,64,16,-64]\)

正交向量和\(\displaystyle \left(\frac{x}{X}\right)^i\)相乘
(%i42)　hx:sum(Bstar_n[i+1]*(x/X)^i,i,0,n-1);
(hx)　\(-2x^5+x^4+8x^3+24x^2-8x-3\)

將\(h(x)\)因式分解
(%i43)　factor(hx);
(%o43)　\(-(x-3)(2x-1)(x^3+3x^2+5x+1)\)

得到\(h(x)\)的解
(%i44)　x:3;
(x)　3

驗證答案
(%i45)　ev(mod(px,N),x=3);
(%o45)　0

解三次同餘方程式\(p(x)=x^3-4x^2-3x-10\pmod{1131}\)。

參考資料
Finding Small Roots of Polynomial Equations Using Lattice Basis Reduction
https://ntnuopen.ntnu.no/ntnu-xm ... e=1&isAllowed=y



請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下
要先載入LLL.mac才能使用LLL指令
(%i1)　load("LLL.mac");
(%o1)　C:/maxima-5.43.2/share/maxima/5.43.2/share/LLL.mac

要先載入eigen.mac才能使用gramschmidt指令
(%i2)　load("eigen.mac");
(%o2)　C:/maxima-5.43.2/share/maxima/5.43.2/share/matrix/eigen.mac

要先載入diag.mac才能使用diag指令
(%i3)　load("diag.mac");
(%o3)　C:/maxima-5.43.2/share/maxima/5.43.2/share/contrib/diag.mac

同餘方程式\(p(x)\)
(%i4)　px:x^3-4*x^2-3*x-10;
(px)　\(x^3-4x^2-3x-10\)

\(p(x)\equiv 0\pmod{N}\)
(%i5)　N:1131;
(N)　1131

\(p(x)\)的次數\(k\)
(%i6)　k:hipow(px,x);
(k)　3

設誤差值\(epsilon=0.1\)
(%i7)　epsilon:0.1;
(epsilon)　0.1

參數h
(%i8)　h:ceiling(max(7/k,(k+epsilon*k-1)/(epsilon*k^2)));
(h)　3

\(\widehat{M}\)的維度\(n=hk\)
(%i9)　n:h*k;
(n)　9

參數\(\delta\)，按照公式應該是\(\displaystyle \delta=\frac{1}{3}\)，本範例\(\displaystyle \delta=\frac{1}{9}\)
(%i11)
delta:1/sqrt(h*k);
delta:1/9;
(delta)　\(\displaystyle \frac{1}{3}\)
(delta)　\(\displaystyle \frac{1}{9}\)

希望能找到\(|\;x|\;<X=\frac{1}{2}N^{1/k}\)，\(p(x)\equiv 0\pmod{N}\)
按照公式應該是5，本範例\(X=6\)
(%i13)
X:floor(1/2*N^(1/k));
X:6;
(X)　5
(X)　6


(%i14)　Xpower:create_list(delta*X^-(i-1),i,1,h*k);
(Xpower)　\(\displaystyle \left[\frac{1}{9},\frac{1}{54},\frac{1}{324},\frac{1}{1944},\frac{1}{11664},\frac{1}{69984},\frac{1}{419904},\frac{1}{2519424},\frac{1}{15116544}\right]\)

左上角矩陣
(%i15)　D1:diag(Xpower);
(D1)　\(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&0&0&0&0&0&0\cr
0&\frac{1}{54}&0&0&0&0&0&0&0\cr
0&0&\frac{1}{324}&0&0&0&0&0&0\cr
0&0&0&\frac{1}{1944}&0&0&0&0&0\cr
0&0&0&0&\frac{1}{11664}&0&0&0&0\cr
0&0&0&0&0&\frac{1}{69984}&0&0&0\cr
0&0&0&0&0&0&\frac{1}{419904}&0&0\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&0\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}}\right]\)

多項式\(x^u\cdot p(x)^v\)
(%i16)　xpxpower:create_list(x^u*px^v,v,1,h-1,u,0,k-1);
(xpxpower)　\([x^3-4x^2-3x-10,x(x^3-4x^2-3x-10),x^2(x^3-4x^2-3x-10),(x^3-4x^2-3x-10)^2,x(x^3-4x^2-3x-10)^2,x^2(x^3-4x^2-3x-10)^2]\)

\(x^1,x^2,\ldots,x^{n-1}\)
(%i17)　xpower:create_list(x^i,i,1,n-1);
(xpower)　\([x,x^2,x^3,x^4,x^5,x^6,x^7,x^8]\)

取多項式\(x^u\cdot(x)^v\)係數，形成右上角矩陣(常數項在最後一行)
(%i8)　A:augcoefmatrix(xpxpower,xpower);
(A)　\(\left[\matrix{\displaystyle
-3&-4&1&0&0&0&0&0&-10\cr
-10&-3&-4&1&0&0&0&0&0\cr
0&-10&-3&-4&1&0&0&0&0\cr
60&89&4&10&-8&1&0&0&100\cr
100&60&89&4&10&-8&1&0&0\cr
0&100&60&89&4&10&-8&1&0}\right]\)

將常數項移到第一行
(%i19)　A:addcol(col(A,h*k),submatrix(A,h*k));
(A)　\(\left[\matrix{\displaystyle
-10&-3&-4&1&0&0&0&0&0\cr
0&-10&-3&-4&1&0&0&0&0\cr
0&0&-10&-3&-4&1&0&0&0\cr
100&60&89&4&10&-8&1&0&0\cr
0&100&60&89&4&10&-8&1&0\cr
0&0&100&60&89&4&10&-8&1}\right]\)

矩陣\(A\)轉置
(%i20)　A:transpose(A);
(A)　\(\left[\matrix{\displaystyle
-10&0&0&100&0&0\cr
-3&-10&0&60&100&0\cr
-4&-3&-10&89&60&100\cr
1&-4&-3&4&89&60\cr
0&1&-4&10&4&89\cr
0&0&1&-8&10&4\cr
0&0&0&1&-8&10\cr
0&0&0&0&1&-8\cr
0&0&0&0&0&1}\right]\)

左下角0矩陣
(%i21)　Zero:zeromatrix((h-1)*k,h*k);
(Zero)　\(\left[\matrix{\displaystyle
0&0&0&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0}\right]\)

右下角矩陣元素\(N^v\)
(%i22)　Npower:create_list(N^v,v,1,h-1,u,0,k-1);
(Npower)　\([1131,1131,1131,1279161,1279161,1279161]\)

右下角矩陣
(%i23)　D2:diag(Npower);
(D2)　\(\left[\matrix{\displaystyle
1131&0&0&0&0&0\cr
0&1131&0&0&0&0\cr
0&0&1131&0&0&0\cr
0&0&0&1279161&0&0\cr
0&0&0&0&1279161&0\cr
0&0&0&0&0&1279161}\right]\)

4個子矩陣合併成矩陣\(M\)
(%i24)　M:addrow(addcol(D1,A),addcol(Zero,D2));
(M)　\(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&0&0&0&0&0&0&-10&0&0&100&0&0\cr
0&\frac{1}{54}&0&0&0&0&0&0&0&-3&-10&0&60&100&0\cr
0&0&\frac{1}{324}&0&0&0&0&0&0&-4&-3&-10&89&60&100\cr
0&0&0&\frac{1}{1944}&0&0&0&0&0&1&-4&-3&4&89&60\cr
0&0&0&0&\frac{1}{11664}&0&0&0&0&0&1&-4&10&4&89\cr
0&0&0&0&0&\frac{1}{69984}&0&0&0&0&0&1&-8&10&4\cr
0&0&0&0&0&0&\frac{1}{419904}&0&0&0&0&0&1&-8&10\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&0&0&0&0&0&1&-8\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1\cr
0&0&0&0&0&0&0&0&0&1131&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&1131&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&1131&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&1279161&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&1279161&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&0&1279161}\right]\)

將矩陣\(M\)複製成另一個矩陣\(\widetilde{M}\)，進行矩陣列運算
(%i25)　M_tilde:copymatrix(M)$

將右上角化簡為零
(%i27)
for i:k+1 thru n do
  (for j:1 thru i-1 do
     (print("第",j,"列=第",j,"列-",M_tilde[j,i+n-k],"*第",i,"列=",
               M_tilde[j]:M_tilde[j]-M_tilde[j,i+n-k]*M_tilde[ i ])
     )
  )$
M_tilde;
(%o27)
第1列=第1列--10*第4列\(\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},0,0,0,0,0,0,-40,-30,140,890,600\right]\)
第2列=第2列--3*第4列\(\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},0,0,0,0,0,0,-22,-9,72,367,180\right]\)
第3列=第3列--4*第4列\(\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},0,0,0,0,0,0,-19,-22,105,416,340\right]\)
第1列=第1列--40*第5列\(\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},0,0,0,0,0,0,-190,540,1050,4160\right]\)
第2列=第2列--22*第5列\(\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},0,0,0,0,0,0,-97,292,455,2138\right]\)
第3列=第3列--19*第5列\(\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},0,0,0,0,0,0,-98,295,492,2031\right]\)
第4列=第4列--4*第5列\(\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},0,0,0,0,1,0,-19,44,105,416\right]\)
第1列=第1列--190*第6列\(\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},\frac{95}{34992},0,0,0,0,0,0,-980,2950,4920\right]\)
第2列=第2列--97*第6列\(\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},\frac{97}{69984},0,0,0,0,0,0,-484,1425,2526\right]\)
第3列=第3列--98*第6列\(\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},\frac{49}{34992},0,0,0,0,0,0,-489,1472,2423\right]\)
第4列=第4列--19*第6列\(\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},\frac{19}{69984},0,0,0,1,0,0,-108,295,492\right]\)
第5列=第5列--4*第6列\(\displaystyle =\left[0,0,0,0,\frac{1}{11664},\frac{1}{17496},0,0,0,0,1,0,-22,44,105\right]\)
第1列=第1列--980*第7列\(\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},\frac{95}{34992},\frac{245}{104976},0,0,0,0,0,0,-4890,14720\right]\)
第2列=第2列--484*第7列\(\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},\frac{97}{69984},\frac{121}{104976},0,0,0,0,0,0,-2447,7366\right]\)
第3列=第3列--489*第7列\(\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},\frac{49}{34992},\frac{163}{139968},0,0,0,0,0,0,-2440,7313\right]\)
第4列=第4列--108*第7列\(\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},\frac{19}{69984},\frac{1}{3888},0,0,1,0,0,0,-569,1572\right]\)
第5列=第5列--22*第7列\(\displaystyle =\left[0,0,0,0,\frac{1}{11664},\frac{1}{17496},\frac{11}{209952},0,0,0,1,0,0,-132,325\right]\)
第6列=第6列--8*第7列\(\displaystyle =\left[0,0,0,0,0,\frac{1}{69984},\frac{1}{52488},0,0,0,0,1,0,-54,84\right]\)
第1列=第1列--4890*第8列\(\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},\frac{95}{34992},\frac{245}{104976},\frac{815}{419904},0,0,0,0,0,0,-24400\right]\)
第2列=第2列--2447*第8列\(\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},\frac{97}{69984},\frac{121}{104976},\frac{2447}{2519424},0,0,0,0,0,0,-12210\right]\)
第3列=第3列--2440*第8列\(\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},\frac{49}{34992},\frac{163}{139968},\frac{305}{314928},0,0,0,0,0,0,-12207\right]\)
第4列=第4列--569*第8列\(\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},\frac{19}{69984},\frac{1}{3888},\frac{569}{2519424},0,1,0,0,0,0,-2980\right]\)
第5列=第5列--132*第8列\(\displaystyle =\left[0,0,0,0,\frac{1}{11664},\frac{1}{17496},\frac{11}{209952},\frac{11}{209952},0,0,1,0,0,0,-731\right]\)
第6列=第6列--54*第8列\(\displaystyle =\left[0,0,0,0,0,\frac{1}{69984},\frac{1}{52488},\frac{1}{46656},0,0,0,1,0,0,-348\right]\)
第7列=第7列--8*第8列\(\displaystyle =\left[0,0,0,0,0,0,\frac{1}{419904},\frac{1}{314928},0,0,0,0,1,0,-54\right]\)
第1列=第1列--24400*第9列\(\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},\frac{95}{34992},\frac{245}{104976},\frac{815}{419904},\frac{1525}{944784},0,0,0,0,0,0\right]\)
第2列=第2列--12210*第9列\(\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},\frac{97}{69984},\frac{121}{104976},\frac{2447}{2519424},\frac{2035}{2519424},0,0,0,0,0,0\right]\)
第3列=第3列--12207*第9列\(\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},\frac{49}{34992},\frac{163}{139968},\frac{305}{314928},\frac{4069}{5038848},0,0,0,0,0,0\right]\)
第4列=第4列--2980*第9列\(\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},\frac{19}{69984},\frac{1}{3888},\frac{569}{2519424},\frac{745}{3779136},1,0,0,0,0,0\right]\)
第5列=第5列--731*第9列\(\displaystyle =\left[0,0,0,0,\frac{1}{11664},\frac{1}{17496},\frac{11}{209952},\frac{11}{209952},\frac{731}{15116544},0,1,0,0,0,0\right]\)
第6列=第6列--348*第9列\(\displaystyle =\left[0,0,0,0,0,\frac{1}{69984},\frac{1}{52488},\frac{1}{46656},\frac{29}{1259712},0,0,1,0,0,0\right]\)
第7列=第7列--54*第9列\(\displaystyle =\left[0,0,0,0,0,0,\frac{1}{419904},\frac{1}{314928},\frac{1}{279936},0,0,0,1,0,0\right]\)
第8列=第8列--8*第9列\(\displaystyle =\left[0,0,0,0,0,0,0,\frac{1}{2519424},\frac{1}{1889568},0,0,0,0,1,0\right]\)
\(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}&0&0&0&0&0&0\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}&0&0&0&0&0&0\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}&0&0&0&0&0&0\cr
0&0&0&\frac{1}{1944}&\frac{1}{2916}&\frac{19}{69984}&\frac{1}{3888}&\frac{569}{2519424}&\frac{745}{3779136}&1&0&0&0&0&0\cr
0&0&0&0&\frac{1}{11664}&\frac{1}{17496}&\frac{11}{209952}&\frac{11}{209952}&\frac{731}{15116544}&0&1&0&0&0&0\cr
0&0&0&0&0&\frac{1}{69984}&\frac{1}{52488}&\frac{1}{46656}&\frac{29}{1259712}&0&0&1&0&0&0\cr
0&0&0&0&0&0&\frac{1}{419904}&\frac{1}{314928}&\frac{1}{279936}&0&0&0&1&0&0\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&\frac{1}{1889568}&0&0&0&0&1&0\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1\cr
0&0&0&0&0&0&0&0&0&1131&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&1131&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&1131&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&1279161&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&1279161&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&0&1279161}\right]\)

將右下角化簡為零
(%i29)
for i:k+1 thru n do
  (j:i+n-k,
   print("第",j,"列=第",j,"列-",M_tilde[j,j],"*第",i,"列=",
    M_tilde[j]:M_tilde[j]-M_tilde[j,j]*M_tilde[ i ])
  )$
M_tilde;
(%o29)
第10列=第10列-1131*第4列\(\displaystyle =\left[0,0,0,-\frac{377}{648},-\frac{377}{972},-\frac{7163}{23328},-\frac{377}{1296},-\frac{214513}{839808},-\frac{280865}{1259712},0,0,0,0,0,0\right]\)
第11列=第11列-1131*第5列\(\displaystyle =\left[0,0,0,0,-\frac{377}{3888},-\frac{377}{5832},-\frac{4147}{69984},-\frac{4147}{69984},-\frac{275587}{5038848},0,0,0,0,0,0\right]\)
第12列=第12列-1131*第6列\(\displaystyle =\left[0,0,0,0,0,-\frac{377}{23328},-\frac{377}{17496},-\frac{377}{15552},-\frac{10933}{419904},0,0,0,0,0,0\right]\)
第13列=第13列-1279161*第7列\(\displaystyle =\left[0,0,0,0,0,0,-\frac{142129}{46656},-\frac{142129}{34992},-\frac{142129}{31104},0,0,0,0,0,0\right]\)
第14列=第14列-1279161*第8列\(\displaystyle =\left[0,0,0,0,0,0,0,-\frac{142129}{279936},-\frac{142129}{209952},0,0,0,0,0,0\right]\)
第15列=第15列-1279161*第9列\(\displaystyle =\left[0,0,0,0,0,0,0,0,-\frac{142129}{1679616},0,0,0,0,0,0\right]\)
\(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}&0&0&0&0&0&0\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}&0&0&0&0&0&0\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}&0&0&0&0&0&0\cr
0&0&0&\frac{1}{1944}&\frac{1}{2916}&\frac{19}{69984}&\frac{1}{3888}&\frac{569}{2519424}&\frac{745}{3779136}&1&0&0&0&0&0\cr
0&0&0&0&\frac{1}{11664}&\frac{1}{17496}&\frac{11}{209952}&\frac{11}{209952}&\frac{731}{15116544}&0&1&0&0&0&0\cr
0&0&0&0&0&\frac{1}{69984}&\frac{1}{52488}&\frac{1}{46656}&\frac{29}{1259712}&0&0&1&0&0&0\cr
0&0&0&0&0&0&\frac{1}{419904}&\frac{1}{314928}&\frac{1}{279936}&0&0&0&1&0&0\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&\frac{1}{1889568}&0&0&0&0&1&0\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1\cr
0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}&0&0&0&0&0&0\cr
0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}&0&0&0&0&0&0\cr
0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}&0&0&0&0&0&0\cr
0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&-\frac{142129}{1679616}&0&0&0&0&0&0}\right]\)

將對角線元素為1的一整列移到整個矩陣下方
(%i31)
for i:k+1 thru n do
  (j:i+n-k,
   print("第",i,"列和第",j,"列交換"),
   [M_tilde[j],M_tilde[ i ]]:[M_tilde[ i ],M_tilde[j]]
  )$
M_tilde;
(%o31)
第4列和第10列交換
第5列和第11列交換
第6列和第12列交換
第7列和第13列交換
第8列和第14列交換
第9列和第15列交換
\(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}&0&0&0&0&0&0\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}&0&0&0&0&0&0\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}&0&0&0&0&0&0\cr
0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}&0&0&0&0&0&0\cr
0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}&0&0&0&0&0&0\cr
0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}&0&0&0&0&0&0\cr
0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&-\frac{142129}{1679616}&0&0&0&0&0&0\cr
0&0&0&\frac{1}{1944}&\frac{1}{2916}&\frac{19}{69984}&\frac{1}{3888}&\frac{569}{2519424}&\frac{745}{3779136}&1&0&0&0&0&0\cr
0&0&0&0&\frac{1}{11664}&\frac{1}{17496}&\frac{11}{209952}&\frac{11}{209952}&\frac{731}{15116544}&0&1&0&0&0&0\cr
0&0&0&0&0&\frac{1}{69984}&\frac{1}{52488}&\frac{1}{46656}&\frac{29}{1259712}&0&0&1&0&0&0\cr
0&0&0&0&0&0&\frac{1}{419904}&\frac{1}{314928}&\frac{1}{279936}&0&0&0&1&0&0\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&\frac{1}{1889568}&0&0&0&0&1&0\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1}\right]\)

得到左上角矩陣\(\widehat{M}\)
(%i32)　M_hat:genmatrix(lambda([i,j],M_tilde[i,j]),n,n);
(M_hat)　\(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}\cr
0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}\cr
0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}\cr
0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}\cr
0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}\cr
0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}\cr
0&0&0&0&0&0&0&0&-\frac{142129}{1679616}}\right]\)

\(\widehat{M}\)變成整數
(%i33)　M_hat:M_hat*1/delta*X^(n-1);
(M_hat)　\(\left[\matrix{\displaystyle
1679616&0&0&77760&51840&41040&35280&29340&24400\cr
0&279936&0&23328&28512&20952&17424&14682&12210\cr
0&0&46656&31104&24624&21168&17604&14640&12207\cr
0&0&0&-8794656&-5863104&-4641624&-4397328&-3861234&-3370380\cr
0&0&0&0&-1465776&-977184&-895752&-895752&-826761\cr
0&0&0&0&0&-244296&-325728&-366444&-393588\cr
0&0&0&0&0&0&-46049796&-61399728&-69074694\cr
0&0&0&0&0&0&0&-7674966&-10233288\cr
0&0&0&0&0&0&0&0&-1279161}\right]\)

LLL化簡
(%i34)　B: LLL(M_hat);
(B)　\(\left[\matrix{\displaystyle
0&0&46656&31104&24624&21168&17604&14640&12207\cr
0&279936&-46656&-7776&3888&-216&-180&42&3\cr
0&0&186624&124416&98496&-159624&-255312&-307884&-344760\cr
0&0&-46656&-31104&-24624&223128&308124&351804&-897780\cr
0&0&513216&342144&-1194912&-255744&-50652&-1824&94692\cr
1679616&0&-46656&46656&27216&19872&17676&14700&12193\cr
0&0&-513216&-342144&-270864&2210112&3063636&-4171566&-35880\cr
0&559872&3825792&-6197472&610416&67608&-231696&55866&135297\cr
0&0&-559872&-373248&-4692816&20511144&-17352684&1982268&-265239}\right]\)

Gram-Schmidt正交化
(%i35)　Bstar:apply(matrix,expand(gramschmidt(B)));
(Bstar)　矩陣太大不列出來

取最後一個正交向量
(%i36)　Bstar_n:Bstar[n];
(Bstar_n)　\(\displaystyle \left[-\frac{6714060256800}{194554091},-\frac{24170616924480}{194554091},-\frac{215118490627872}{194554091},-\frac{58009480618752}{194554091},-\frac{870142209281280}{194554091},\frac{4176682604550144}{194554091},-\frac{3132511953412608}{194554091},0,0\right]\)

取各分數的分母
(%i37)　Denom:map('denom,Bstar_n);
(Denom)　\(\left[194554091,194554091,194554091,194554091,194554091,194554091,194554091,1,1\right]\)

求最大的分母
(%i38)　MaxDenom:lmax(%);
(MaxDenom)　194554091

正交向量化為整數
(%i39)　Bstar_n:Bstar_n*MaxDenom;
(Bstar_n)　\(\left[-6714060256800,-24170616924480,-215118490627872,-58009480618752,-870142209281280,4176682604550144,-3132511953412608,0,0\right]\)

計算最大公因數
(%i40)　GCD:lreduce('gcd,Bstar_n);
(GCD)　268562410272

同除最大公因數，得到化簡的正交向量
(%i41)　Bstar_n:Bstar_n/GCD;
(Bstar_n)　\(\left[-25,-90,-801,-216,-3240,15552,-11664,0,0\right]\)

正交向量和\(\displaystyle \left(\frac{x}{X}\right)^{i}\)相乘
(%i42)　hx:sum(Bstar_n[i+1]*(x/X)^i,i,0,n-1);
(hx)　\(\displaystyle -\frac{1}{4}x^6+2x^5-\frac{5}{2}x^4-x^3-\frac{89}{4}x^2-15x-25\)

取\(h(x)\)各項係數
(%i43)　coef:augcoefmatrix([hx],xpower);
(coef)　\(\left[\matrix{\displaystyle -15&-\frac{89}{4}&-1&-\frac{5}{2}&2&-\frac{1}{4}&0&0&-25}\right]\)

取\(h(x)\)係數的分母
(%i44)　Denom:map('denom,args(coef)[1]);
(Denom)　\([1,4,1,2,1,4,1,1,1]\)

求最大的分母
(%i45)　MaxDenom:lmax(Denom);
(MaxDenom)　4

將\(h(x)\)化成整數
(%i46)　hx:expand(hx*MaxDenom);
(hx)　\(-x^6+8x^5-10x^4-4x^3-89x^2-60x-100\)

將\(h(x)\)因式分解
(%i47)　factor(hx);
(%o47)　\(-(x-5)^2(x^2+x+2)^2\)

得到\(h(x)\)的解
(%i48)　x:5;
(x)　5

驗證答案
(%i49)　ev(mod(px,N),x=5);
(%o49)　0

Howgrave-Graham論文中回顧Coppersmith方法，但步驟3,4又和Coppersmith有些許不同，本文章就之前範例說明。

方法	範例
步驟1：計算參數\(h\)和\(X\)(和Coppersmith相同)
步驟2：產生矩陣\(M\)(和Coppersmith相同)
步驟3：矩陣\(M\)基本列運算得到\(\widehat{M}\)，計算\([r(x)H_1^{-1}]_{sh}\)
因為\(p(x)\)為monic(最高次方項係數為1)，在矩陣\(A\)的對角線元素為1，進行基本列運算將右上角化簡為零，右下角化簡為零，再將對角線元素為1的一整列移到整個矩陣下方。 \(\widetilde{M}=H_1M=\left[\matrix{\widehat{M}&│&0_{(hk\times (h-1)k)}\cr ―&┼&――――――\cr A'&│&I_{(h-1)k}}\right]\) 得到左上角矩陣\(\widehat{M}\) 計算矩陣\(H_1^{-1}=M\widetilde{M}^{-1}\) \(r(x)=[1,x_0,x_0^2,x_0^3,x_0^4,x_0^5,-y_0,-x_0y_0,-y_0^2,-x_0y_0^2]\) 又\(p(x_0)\equiv 0\pmod{N}\)，\(p(x_0)=y_0N\)，\(\displaystyle y_0=\frac{p(x_0)}{N}\) \(\displaystyle r(x)=[1,x_0,x_0^2,x_0^3,x_0^4,x_0^5,-\frac{p(x_0)}{N},-\frac{x_0p(x_0)}{N},-\frac{p^2(x_0)}{N},-\frac{x_0p^2(x_0)}{N}]\) 計算\(\displaystyle p(x_0)H_1^{-1}\) 將後面的0刪除\(\displaystyle [p(x_0)H_1^{-1}]_{sh}\)	\(H_1^{-1}=M\widetilde{M}^{-1}=\left[\matrix{ 1&&&&&&19&0&361&0\cr &1&&&&&14&19&532&361\cr &&&&&&1&14&234&532\cr &&&&&&&1&28&234\cr &&&&&&&&1&28\cr &&&&&&&&&1\cr &&1&&&&35&&&\cr &&&1&&&&35&&\cr &&&&1&&&&1225&\cr &&&&&1&&&&1225} \right]\) \(\displaystyle r(x)=(1,x,x^2,x^3,x^4,x^5,-\frac{p(x)}{35},-\frac{xp(x)}{35},-\frac{p^2(x)}{35^2},-\frac{xp^2(x)}{35^2})\) \(r(x)H_1^{-1}=(1,x,-\frac{p(x)}{35},-\frac{xp(x)}{35},-\frac{p^2(x)}{35^2},-\frac{xp^2(x)}{35^2},\) 　　　　　\(19+14x+x^2-p(x),\) 　　　　　\(19x+14x^2+x^3-xp(x),\) 　　　　　\(361+532x+234x^2+28x^3+x^4-p^2(x),\) 　　　　　\(361x+532x^2+234x^3+28x^4+x^5-xp^2(x))\) \(r(x)H_1^{-1}=(1,x,-\frac{p(x)}{35},-\frac{xp(x)}{35},-\frac{p^2(x)}{35^2},-\frac{xp^2(x)}{35^2},0,0,0,0)\) \(\left[r(x)H_1^{-1}\right]_{sh}=(1,x,-\frac{p(x)}{35},-\frac{xp(x)}{35},-\frac{p^2(x)}{35^2},-\frac{xp^2(x)}{35^2})\)
步驟4：經LLL化簡和計算矩陣\(H_2^{-1}\)得到不需要同餘\(N\)的方程式
\(B_2=LLL(\widehat{M})\) 計算\(B_2=H_2\widehat{M}\)，\(H_2^{-1}=\widehat{M}B_2^{-1}\) \(r'_{hk}(x)=[r(x)H_1^{-1}]_{sh}\cdot ((H_2^{-1})_{hk})^T\) 解出\(x\)	\(\widehat{M}=\left[\matrix{ 32&0&-152&1064&-6726&42028\cr &16&-112&708&-4424&27605\cr &&-280&1960&-11060&58800\cr &&&-140&1960&-19250\cr &0&&&-2450&34300\cr &&&&&-1225}\right]\) \(B=LLL(\widehat{M})=\left[\matrix{0&160&0&-60&0&-100\cr -64&-64&-88&80&-72&-51\cr 64&-48&32&4&-180&16\cr 128&-80&-48&16&116&-13\cr -32&-96&-16&-132&90&-108\cr -64&-32&248&96&-30&-141}\right]\) \(H_2^{-1}=\widehat{M}B_2^{-1}=\left[\matrix{-166&-125&-9&-111&-73&-70\cr -109&-82&-6&-73&-48&-46\cr -231&-171&-7&-157&-104&-98\cr 77&60&8&50&32&32\cr -138&-109&-18&-88&-56&-57\cr 5&4&1&3&2&2}\right]\) \(((H_2^{-1})_{6})^T=\left[-70,-46,-98,32,-57,2\right]\) \(\displaystyle [r(x)H_1^{-1}]_{sh}\cdot ((H_2^{-1})_6)^T=-70\cdot 1-46x+98\frac{p(x)}{35}-32\frac{xp(x)}{35}+57\frac{p^2(x)}{35^2}-2\frac{xp^2(x)}{35^2}\) \(\displaystyle h(x)=\frac{-1}{1225}(2x^5-x^4-8x^3-24x^2+8x+3)\) 　　\(\displaystyle =\frac{-1}{1225}(x-3)(2x-1)(x^3+3x^2+5x+1)\) 解方程式得到答案 \(x=3\)

註：
1.原論文用\(c(x)\)，本文章和Coppersmith一致用\(r(x)\)。
2.原論文的\(\widehat{M}\)有行列互換，但本文章沒有行列互換，但不影響計算過程。
原論文
\(\widetilde{M}=\left[\matrix{
-1225&&&&&\cr
34300&-2450&&&&\cr
-19250&1960&-140&&&\cr
58800&-11060&1960&-280&&\cr
27605&-4424&708&-112&16&\cr
42028&-6726&1064&-152&0&32}\right]\)，\(H_2^{-1}=\left[\matrix{
-5&4&-2&1&-1&-2\cr
138&-109&56&-18&31&57\cr
-77&60&-32&8&-18&-32\cr
231&-171&104&-7&59&98\cr
109&-82&48&-6&27&46\cr
166&-125&73&-9&41&70}\right]\)
本文章
\(\widetilde{M}=\left[\matrix{
32&0&-152&1064&-6726&42028\cr
&16&-112&708&-4424&27605\cr
&&-280&1960&-11060&58800\cr
&&&-140&1960&-19250\cr
&&&&-2450&34300\cr
&&&&&-1225}\right]\)，\(H_2^{-1}=\left[\matrix{
-166&-125&-9&-111&-73&-70\cr
-109&-82&-6&-73&-48&-46\cr
-231&-171&-7&-157&-104&-98\cr
77&60&8&50&32&32\cr
-138&-109&-18&-88&-56&-57\cr
5&4&1&3&2&2}\right]\)


參考資料：
N. Howgrave-Graham. Finding small roots of univariate modular equations revisited. In Cryptography and Coding– Proc. IMA ’97, volume 1355 of Lecture Notes in Computer Science, pages 131–142. Springer, 1997.
https://link.springer.com/chapter/10.1007/BFb0024458



請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.45.0\share\maxima\5.45.0\share目錄下
要先載入LLL.mac才能使用LLL指令
(%i1)　load("LLL.mac");
(%o1)　C:/maxima-5.45.0/share/maxima/5.45.0/share/LLL.mac

同餘方程式
(%i2)　px:x^2+14*x+19;
(px)　\(x^2+14x+19\)

\(p(x)\equiv 0\pmod{N}\)
(%i3)　N:35;
(N)　35

\(p(x)\)的次數\(k\)
(%i4)　k:hipow(px,x);
(k)　2

設誤差值\(epsilon=0.1\)
(%i5)　epsilon:0.1;
(epsilon)　0.1

參數\(h\)
(%i7)
h:ceiling(max(7/k,(k+epsilon*k-1)/(epsilon*k^2)));
h:3;
(h)　4
(h)　3

\(\widehat{M}\)的維度\(n=hk\)
(%i8)　n:h*k;
(n)　6

參數\(\delta\)，按照公式應該是\(\displaystyle \delta=\frac{1}{\sqrt{6}}\)，本範例\(\delta=1\)
(%i10)
delta:1/sqrt(h*k);
delta:1;
(delta)　\(\displaystyle \frac{1}{\sqrt{6}}\)
(delta)　1

希望能找到\(|\;x|\;<X=\frac{1}{2}N^{1/k}\)，\(p(x)\equiv 0\pmod{N}\)
(%i11)　X:floor(1/2*N^(1/k));
(X)　2

產生矩陣\(M\)
(%i14)
kill(genlattice)$
genlattice[i,j]:=(
v:floor((k+j-h*k-1)/k),
u: (j-h*k-1)-k*(v-1),
if i<=h*k and j<=h*k then if i=j then delta*X^(1-i) else 0/*左上角矩陣*/
else if i<=h*k and j>h*k then (coeff(expand(x^u*px^v),x,i-1))/*右上角矩陣*/
else if i>h*k and j<=h*k then 0/*左下角矩陣*/
else if i>h*k and j>h*k then if i=j then N^v else 0)$/*右下角矩陣*/
M:genmatrix(genlattice,2*h*k-k,2*h*k-k);
(M)　\(\left[\matrix{\displaystyle
1&0&0&0&0&0&19&0&361&0\cr
0&\frac{1}{2}&0&0&0&0&14&19&532&361\cr
0&0&\frac{1}{4}&0&0&0&1&14&234&532\cr
0&0&0&\frac{1}{8}&0&0&0&1&28&234\cr
0&0&0&0&\frac{1}{16}&0&0&0&1&28\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1\cr
0&0&0&0&0&0&35&0&0&0\cr
0&0&0&0&0&0&0&35&0&0\cr
0&0&0&0&0&0&0&0&1225&0\cr
0&0&0&0&0&0&0&0&0&1225}\right]\)

將矩陣\(M\)複製成另一個矩陣\(\widetilde{M}\)
(%i15)　M_tilde:copymatrix(M)$

矩陣\(\widetilde{M}\)進行矩陣列運算
(%i17)
for i:n thru k+1 step -1 do
  (for j:1 thru i-1 do
      (M_tilde:rowop(M_tilde,j,i,M_tilde[j,i+n-k])),/*消掉右上角*/
   j:i+n-k,
   M_tilde:rowop(M_tilde,j,i,M_tilde[j,j]),/*消掉右下角N^v*/
   M_tilde:rowswap(M_tilde,i,j)/*列交換*/
   )$
M_tilde;
(%o17)　\(\left[\matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}&0&0&0&0\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}&0&0&0&0\cr
0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}&0&0&0&0\cr
0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}&0&0&0&0\cr
0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}&0&0&0&0\cr
0&0&0&0&0&-\frac{1225}{32}&0&0&0&0\cr
0&0&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}&1&0&0&0\cr
0&0&0&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}&0&1&0&0\cr
0&0&0&0&\frac{1}{16}&-\frac{7}{8}&0&0&1&0\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1}\right]\)

計算矩陣\(H_1^{-1}=M\widetilde{M}^{-1}\)
(%i18)　H1_inv:M.invert(M_tilde);
(H1_inv)　\(\left[\matrix{\displaystyle
1&0&0&0&0&0&19&0&361&0\cr
0&1&0&0&0&0&14&19&532&361\cr
0&0&0&0&0&0&1&14&234&532\cr
0&0&0&0&0&0&0&1&28&234\cr
0&0&0&0&0&0&0&0&1&28\cr
0&0&0&0&0&0&0&0&0&1\cr
0&0&1&0&0&0&35&0&0&0\cr
0&0&0&1&0&0&0&35&0&0\cr
0&0&0&0&1&0&0&0&1225&0\cr
0&0&0&0&0&1&0&0&0&1225}\right]\)

產生\(r(x)\)
(%i19)　rx:create_list(x^i,i,0,h*k-1);
(rx)　\(\left[1,x,x^2,x^3,x^4,x^5\right]\)

產生\(r(x)\)
(%i21)
for j:1 thru h*k-k do
  (print("j=",j,
           ",v=floor(","k+j-1"/"k",")=floor(",(k+j-1)/k,")=",v:floor((k+j-1)/k),
            ",u=(j-1)-k(v-1)=(",j,"-1)-",k,"(",v,"-1)","=",u: (j-1)-k*(v-1),
            ",-","x"^"u"*"p(x)"^"v"/"N"^"v","=","-","x"^u*"p(x)"^v/"N"^v),
   rx:append(rx,[-x^u*px^v/N^v])
  )$
rx;
\(\displaystyle j=1,v=floor(\frac{k+j-1}{k})=floor(1)=1,u=(j-1)-k(v-1)=(1-1)-2(1-1)=0,-\frac{p(x)^v x^u}{N^v}=-\frac{p(x)}{N}\)
\(\displaystyle j=2,v=floor(\frac{k+j-1}{k})=floor(\frac{3}{2})=1,u=(j-1)-k(v-1)=(2-1)-2(1-1)=1,-\frac{p(x)^v x^u}{N^v}=-\frac{p(x)x}{N}\)
\(\displaystyle j=3,v=floor(\frac{k+j-1}{k})=floor(2)=2,u=(j-1)-k(v-1)=(3-1)-2(2-1)=0,-\frac{p(x)^v x^u}{N^v}=-\frac{p(x)^2}{N^2}\)
\(\displaystyle j=4,v=floor(\frac{k+j-1}{k})=floor(\frac{5}{2})=2,u=(j-1)-k(v-1)=(4-1)-2(2-1)=1,-\frac{p(x)^v x^u}{N^v}=-\frac{p(x)^2x}{N^2}\)
(%o21)　\(\displaystyle \left[1,x,x^2,x^3,x^4,x^5,\frac{-x^2-14x-19}{35},-\frac{x(x^2+14x+19)}{35},-\frac{(x^2+14x+19)^2}{1225},-\frac{x(x^2+14x+19)^2}{1225}\right]\)

計算\(r(x)H_1^{-1}\)
(%i22)　rxH1_inv:args(rx.H1_inv)[1];
(rxH1_inv)　\(\displaystyle [1,x,\frac{-x^2-14x-19}{35},-\frac{x(x^2+14*x+19)}{35},-\frac{(x^2+14x+19)^2}{1225},-\frac{x(x^2+14x+19)^2}{1225},0,\)
　　　　　　\(x^3-x(x^2+14x+19)+14x^2+19x,\)
　　　　　　\(-(x^2+14x+19)^2+x^4+28x^3+234x^2+532x+361,\)
　　　　　　\(-x(x^2+14x+19)^2+x^5+28x^4+234x^3+532x^2+361x]\)

其中\(r(x)H_1^{-1}\)後面化簡為0
(%i23)　rxH1_inv:ratsimp(rxH1_inv);
(rxH1_inv)　\(\displaystyle \left[1,x,-\frac{x^2+14x+19}{35},-\frac{x^3+14x^2+19x}{35},-\frac{x^4+28x^3+234x^2+532x+361}{1225},-\frac{x^5+28x^4+234x^3+532x^2+361x}{1225},0,0,0,0\right]\)

縮短\(r(x)H_1^{-1}\)長度
(%i24)　rxH1_inv_short:rest(rxH1_inv,-(h*k-k));
(rxH1_inv_short)　\(\displaystyle \left[1,x,-\frac{x^2+14x+19}{35},-\frac{x^3+14x^2+19x}{35},-\frac{x^4+28x^3+234x^2+532x+361}{1225},-\frac{x^5+28x^4+234x^3+532x^2+361x}{1225}\right]\)

得到左上角矩陣\(\widehat{M}\)
(%i25)　M_hat:genmatrix(lambda([i,j],M_tilde[i,j]),n,n);
(M_hat)　\(\left[\matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr
0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}\cr
0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr
0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}\cr
0&0&0&0&0&-\frac{1225}{32}}\right]\)

\(\widehat{M}\)乘32倍變成整數
(%i26)　M_hat:M_hat*1/delta*X^(n-1);
(M_hat)　\(\left[\matrix{\displaystyle
32&0&-152&1064&-6726&42028\cr
0&16&-112&708&-4424&27605\cr
0&0&-280&1960&-11060&58800\cr
0&0&0&-140&1960&-19250\cr
0&0&0&0&-2450&34300\cr
0&0&0&0&0&-1225}\right]\)

LLL化簡
(%i27)　B2: LLL(M_hat);
(B2)　\(\left[\matrix{\displaystyle
0&160&0&-60&0&-100\cr
-64&-64&-88&80&-72&-51\cr
64&-48&32&4&-180&16\cr
128&-80&-48&16&116&-13\cr
-32&-96&-16&-132&90&-108\cr
-64&-32&248&96&-30&-141}\right]\)

計算矩陣\(H_2^{-1}=\widehat{M}B_2^{-1}\)
(%i28)　H2_inv:M_hat.invert(B2);
(H2_inv)　\(\left[\matrix{\displaystyle
-166&-125&-9&-111&-73&-70\cr
-109&-82&-6&-73&-48&-46\cr
-231&-171&-7&-157&-104&-98\cr
77&60&8&50&32&32\cr
-138&-109&-18&-88&-56&-57\cr
5&4&1&3&2&2}\right]\)

取矩陣\(H_2^{-1}\)最後一行
(%i29)　H2_inv_lastcolumn:transpose(col(H2_inv,n));
(H2_inv_lastcolumn)　\([\matrix{-70&-46&-98&32&-57&2}]\)

將\([r(x)H_1^{-1}]_{sh}\cdot ((H_2^{-1})_{hk})^T\)相乘
(%i30)　hx:rxH1_inv_short.H2_inv_lastcolumn;
(hx)　\(\displaystyle -\frac{2(x^5+28x^4+234x^3+532x^2+361x)}{1225}+\frac{57(x^4+28x^3+234x^2+532x+361)}{1225}-\frac{32(x^3+14x^2+19x)}{35}+\frac{14(x^2+14x+19)}{5}-46x-70\)

將\(h(x)\)因式分解
(%i31)　factor(hx);
(%o31)　\(\displaystyle -\frac{(x-3)(2x-1)(x^3+3x^2+5x+1)}{1225}\)

得到\(h(x)\)的解
(%i32)　x:3;
(x)　3

驗證答案
(%i33)　ev(mod(px,N),x=3);
(%o33)　0

解三次同餘方程式\(p(x)=x^3-4x^2-3x-10\pmod{1131}\)。

參考資料
Finding Small Roots of Polynomial Equations Using Lattice Basis Reduction
https://ntnuopen.ntnu.no/ntnu-xm ... e=1&isAllowed=y



請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.45.0\share\maxima\5.45.0\share目錄下
要先載入LLL.mac才能使用LLL指令
(%i1)　load("LLL.mac");
(%o1)　C:/maxima-5.45.0/share/maxima/5.45.0/share/LLL.mac

同餘方程式\(p(x)\)
(%i2)　px:x^3-4*x^2-3*x-10;
(px)　\(x^3-4x^2-3x-10\)

\(p(x)\equiv 0\pmod{N}\)
(%i3)　N:1131;
(N)　1131

\(p(x)\)的次數\(k\)
(%i4)　k:hipow(px,x);
(k)　3

設誤差值\(\epsilon=0.1\)
(%i5)　epsilon:0.1;
(epsilon)　0.1

參數\(h\)
(%i6)　h:ceiling(max(7/k,(k+epsilon*k-1)/(epsilon*k^2)));
(h)　3

\(\widehat{M}\)的維度\(n=hk\)
(%i7)　n:h*k;
(n)　9

參數\(\delta\)，按照公式應該是\(\displaystyle \delta=\frac{1}{3}\)，本範例\(\displaystyle \delta=\frac{1}{9}\)
(%i9)
delta:1/sqrt(h*k);
delta:1/9;
(delta)　\(\displaystyle \frac{1}{3}\)
(delta)　\(\displaystyle \frac{1}{9}\)

希望能找到\(\displaystyle |\;x|\;<X=\frac{1}{2}N^{1/k}\)，\(p(x)\equiv 0\pmod{N}\)
按照公式應該是5，本範例\(X=6\)
(%i11)
X:floor(1/2*N^(1/k));
X:6;
(X)　5
(X)　6

產生矩陣\(M\)
(%i14)
kill(genlattice)$
genlattice[i,j]:=(
v:floor((k+j-h*k-1)/k),
u: (j-h*k-1)-k*(v-1),
if i<=h*k and j<=h*k then if i=j then delta*X^(1-i) else 0/*左上角矩陣*/
else if i<=h*k and j>h*k then (coeff(expand(x^u*px^v),x,i-1))/*右上角矩陣*/
else if i>h*k and j<=h*k then 0/*左下角矩陣*/
else if i>h*k and j>h*k then if i=j then N^v else 0)$/*右下角矩陣*/
M:genmatrix(genlattice,2*h*k-k,2*h*k-k);
(M)　\(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&0&0&0&0&0&0&-10&0&0&100&0&0\cr
0&\frac{1}{54}&0&0&0&0&0&0&0&-3&-10&0&60&100&0\cr
0&0&\frac{1}{324}&0&0&0&0&0&0&-4&-3&-10&89&60&100\cr
0&0&0&\frac{1}{1944}&0&0&0&0&0&1&-4&-3&4&89&60\cr
0&0&0&0&\frac{1}{11664}&0&0&0&0&0&1&-4&10&4&89\cr
0&0&0&0&0&\frac{1}{69984}&0&0&0&0&0&1&-8&10&4\cr
0&0&0&0&0&0&\frac{1}{419904}&0&0&0&0&0&1&-8&10\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&0&0&0&0&0&1&-8\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1\cr
0&0&0&0&0&0&0&0&0&1131&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&1131&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&1131&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&1279161&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&1279161&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&0&1279161}\right]\)

將矩陣\(M\)複製成另一個矩陣\(\widetilde{M}\)
(%i15)　M_tilde:copymatrix(M)$

矩陣\(\widetilde{M}\)進行矩陣列運算
(%i17)
for i:n thru k+1 step -1 do
  (for j:1 thru i-1 do
      (M_tilde:rowop(M_tilde,j,i,M_tilde[j,i+n-k])),/*消掉右上角*/
   j:i+n-k,
   M_tilde:rowop(M_tilde,j,i,M_tilde[j,j]),/*消掉右下角N^v*/
   M_tilde:rowswap(M_tilde,i,j)/*列交換*/
   )$
M_tilde;
(%o17)　\(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}&0&0&0&0&0&0\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}&0&0&0&0&0&0\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}&0&0&0&0&0&0\cr
0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}&0&0&0&0&0&0\cr
0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}&0&0&0&0&0&0\cr
0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}&0&0&0&0&0&0\cr
0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&-\frac{142129}{1679616}&0&0&0&0&0&0\cr
0&0&0&\frac{1}{1944}&\frac{1}{2916}&\frac{19}{69984}&\frac{1}{3888}&\frac{569}{2519424}&\frac{745}{3779136}&1&0&0&0&0&0\cr
0&0&0&0&\frac{1}{11664}&\frac{1}{17496}&\frac{11}{209952}&\frac{11}{209952}&\frac{731}{15116544}&0&1&0&0&0&0\cr
0&0&0&0&0&\frac{1}{69984}&\frac{1}{52488}&\frac{1}{46656}&\frac{29}{1259712}&0&0&1&0&0&0\cr
0&0&0&0&0&0&\frac{1}{419904}&\frac{1}{314928}&\frac{1}{279936}&0&0&0&1&0&0\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&\frac{1}{1889568}&0&0&0&0&1&0\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1}\right]\)

計算矩陣\(H_1^{-1}=M\widetilde{M}^{-1}\)
(%i18)　H1_inv:M.invert(M_tilde);
(H1_inv)　\(\left[\matrix{\displaystyle
1&0&0&0&0&0&0&0&0&-10&0&0&100&0&0\cr
0&1&0&0&0&0&0&0&0&-3&-10&0&60&100&0\cr
0&0&1&0&0&0&0&0&0&-4&-3&-10&89&60&100\cr
0&0&0&0&0&0&0&0&0&1&-4&-3&4&89&60\cr
0&0&0&0&0&0&0&0&0&0&1&-4&10&4&89\cr
0&0&0&0&0&0&0&0&0&0&0&1&-8&10&4\cr
0&0&0&0&0&0&0&0&0&0&0&0&1&-8&10\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&1&-8\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&0&1\cr
0&0&0&1&0&0&0&0&0&1131&0&0&0&0&0\cr
0&0&0&0&1&0&0&0&0&0&1131&0&0&0&0\cr
0&0&0&0&0&1&0&0&0&0&0&1131&0&0&0\cr
0&0&0&0&0&0&1&0&0&0&0&0&1279161&0&0\cr
0&0&0&0&0&0&0&1&0&0&0&0&0&1279161&0\cr
0&0&0&0&0&0&0&0&1&0&0&0&0&0&1279161}\right]\)

產生\(r(x)\)
(%i19)　rx:create_list(x^i,i,0,h*k-1);
(rx)　\([1,x,x^2,x^3,x^4,x^5,x^6,x^7,x^8]\)

產生\(r(x)\)
(%i21)
for j:1 thru h*k-k do
  (print("j=",j,
           ",v=floor(","k+j-1"/"k",")=floor(",(k+j-1)/k,")=",v:floor((k+j-1)/k),
            ",u=(j-1)-k(v-1)=(",j,"-1)-",k,"(",v,"-1)","=",u: (j-1)-k*(v-1),
            ",-","x"^"u"*"p(x)"^"v"/"N"^"v","=","-","x"^u*"p(x)"^v/"N"^v),
   rx:append(rx,[-x^u*px^v/N^v])
  )$
rx;
\(\displaystyle j=1,v=floor(\frac{k+j-1}{k})=floor(1)=1,u=(j-1)-k(v-1)=(1-1)-3(1-1)=0,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)}{N}\)
\(\displaystyle j=2,v=floor(\frac{k+j-1}{k})=floor(4/3)=1,u=(j-1)-k(v-1)=(2-1)-3(1-1)=1,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)x}{N}\)
\(\displaystyle j=3,v=floor(\frac{k+j-1}{k})=floor(5/3)=1,u=(j-1)-k(v-1)=(3-1)-3(1-1)=2,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)x^2}{N}\)
\(\displaystyle j=4,v=floor(\frac{k+j-1}{k})=floor(2)=2,u=(j-1)-k(v-1)=(4-1)-3(2-1)=0,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)^2}{N^2}\)
\(\displaystyle j=5,v=floor(\frac{k+j-1}{k})=floor(7/3)=2,u=(j-1)-k(v-1)=(5-1)-3(2-1)=1,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)^2x}{N^2}\)
\(\displaystyle j=6,v=floor(\frac{k+j-1}{k})=floor(8/3)=2,u=(j-1)-k(v-1)=(6-1)-3(2-1)=2,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)^2*x^2}{N^2}\)
(%o21)　\(\displaystyle [1,x,x^2,x^3,x^4,x^5,x^6,x^7,x^8,\frac{-x^3+4x^2+3x+10}{1131},-\frac{x(x^3-4x^2-3x-10)}{1131},-\frac{x^2(x^3-4x^2-3x-10)}{1131},\)
　　　　　\(\displaystyle -\frac{(x^3-4x^2-3x-10)^2}{1279161},-\frac{x(x^3-4x^2-3x-10)^2}{1279161},-\frac{x^2(x^3-4x^2-3x-10)^2}{1279161}]\)

計算\(r(x)H_1^{-1}\)
(%i22)　rxH1_inv:args(rx.H1_inv)[1];
(rxH1_inv)　\(\displaystyle [1,x,x^2,\frac{-x^3+4x^2+3x+10}{1131},-\frac{x(x^3-4x^2-3x-10)}{1131},-\frac{x^2(x^3-4x^2-3x-10)}{1131},-\frac{(x^3-4x^2-3x-10)^2}{1279161},-\frac{x(x^3-4x^2-3x-10)^2}{1279161},-\frac{x^2(x^3-4x^2-3x-10)^2}{1279161},0,\)
　　　　　\(x^4-x(x^3-4x^2-3x-10)-4x^3-3x^2-10x,\)
　　　　　\(x^5-4x^4-x^2(x^3-4x^2-3x-10)-3x^3-10x^2,\)
　　　　　\(-(x^3-4x^2-3x-10)^2+x^6-8x^5+10x^4+4x^3+89x^2+60x+100,\)
　　　　　\(-x(x^3-4x^2-3x-10)^2+x^7-8x^6+10x^5+4x^4+89x^3+60x^2+100x,\)
　　　　　\(-x^2(x^3-4x^2-3x-10)^2+x^8-8x^7+10x^6+4x^5+89x^4+60x^3+100x^2]\)

其中\(r(x)H_1^{-1}\)後面化簡為0
(%i23)　rxH1_inv:ratsimp(rxH1_inv);
(rxH1_inv)　\(\displaystyle \left[1,x,x^2,\frac{-x^3+4x^2+3x+10}{1131},-\frac{x(x^3-4x^2-3x-10)}{1131},-\frac{x^2(x^3-4x^2-3x-10)}{1131},-\frac{(x^3-4x^2-3x-10)^2}{1279161},-\frac{x(x^3-4x^2-3x-10)^2}{1279161},-\frac{x^2(x^3-4x^2-3x-10)^2}{1279161},0,0,0,0,0,0\right]\)

縮短\(r(x)H)_1^{-1}\)長度
(%i24)　rxH1_inv_short:rest(rxH1_inv,-(h*k-k));
(rxH1_inv_short)　\(\displaystyle \left[1,x,x^2,\frac{-x^3+4x^2+3x+10}{1131},-\frac{x(x^3-4x^2-3x-10)}{1131},-\frac{x^2(x^3-4x^2-3x-10)}{1131},-\frac{(x^3-4x^2-3x-10)^2}{1279161},-\frac{x(x^3-4x^2-3x-10)^2}{1279161},-\frac{x^2(x^3-4x^2-3x-10)^2}{1279161}\right]\)

得到左上角矩陣\(\widehat{M}\)
(%i25)　M_hat:genmatrix(lambda([i,j],M_tilde[i,j]),n,n);
(M_hat)　\(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}\cr
0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}\cr
0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}\cr
0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}\cr
0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}\cr
0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}\cr
0&0&0&0&0&0&0&0&-\frac{142129}{1679616}}\right]\)

\(\widehat{M}\)乘1679616變成整數
(%i26)　M_hat:M_hat*1/delta*X^(n-1);
(M_hat)　\(\left[\matrix{\displaystyle
1679616&0&0&77760&51840&41040&35280&29340&24400\cr
0&279936&0&23328&28512&20952&17424&14682&12210\cr
0&0&46656&31104&24624&21168&17604&14640&12207\cr
0&0&0&-8794656&-5863104&-4641624&-4397328&-3861234&-3370380\cr
0&0&0&0&-1465776&-977184&-895752&-895752&-826761\cr
0&0&0&0&0&-244296&-325728&-366444&-393588\cr
0&0&0&0&0&0&-46049796&-61399728&-69074694\cr
0&0&0&0&0&0&0&-7674966&-10233288\cr
0&0&0&0&0&0&0&0&-1279161}\right]\)

LLL化簡
(%i27)　B2: LLL(M_hat);
(B2)　\(\left[\matrix{\displaystyle
0&0&46656&31104&24624&21168&17604&14640&12207\cr
0&279936&-46656&-7776&3888&-216&-180&42&3\cr
0&0&186624&124416&98496&-159624&-255312&-307884&-344760\cr
0&0&-46656&-31104&-24624&223128&308124&351804&-897780\cr
0&0&513216&342144&-1194912&-255744&-50652&-1824&94692\cr
1679616&0&-46656&46656&27216&19872&17676&14700&12193\cr
0&0&-513216&-342144&-270864&2210112&3063636&-4171566&-35880\cr
0&559872&3825792&-6197472&610416&67608&-231696&55866&135297\cr
0&0&-559872&-373248&-4692816&20511144&-17352684&1982268&-265239}\right]\)

計算矩陣\(H_2^{-1}=\widehat{M}B_2^{-1}\)
(%i28)　H2_inv:M_hat.invert(B2);
(H2_inv)　\(\left[\matrix{\displaystyle
1&0&0&0&0&1&0&0&0\cr
1&1&0&0&0&0&0&0&0\cr
1&0&0&0&0&0&0&0&0\cr
-141&-2&6&0&3&0&0&1&0\cr
-19&0&2&0&1&0&0&0&0\cr
-4&0&1&0&0&0&0&0&0\cr
-477&0&145&14&-3&0&4&0&1\cr
-44&0&15&5&0&0&1&0&0\cr
-3&0&1&1&0&0&0&0&0}\right]\)

取矩陣\(H_2^{-1}\)最後一行
(%i29)　H2_inv_lastcolumn:transpose(col(H2_inv,n));
(H2_inv_lastcolumn)　\([\matrix{0&0&0&0&0&0&1&0&0}]\)

將\([r(x)H_1^{-1}]_{sh}\cdot ((H_2^{-1})_{hk})^T\)相乘
(%i30)　hx:rxH1_inv_short.H2_inv_lastcolumn;
(hx)　\(\displaystyle -\frac{x^6-8x^5+10x^4+4x^3+89x^2+60x+100}{1279161}\)

將\(h(x)\)因式分解
(%i31)　factor(hx);
(%o31)　\(\displaystyle -\frac{(x-5)^2(x^2+x+2)^2}{1279161}\)

得到\(h(x)\)的解
(%i32)　x:5;
(x)　5

驗證答案
(%i33)　ev(mod(px,N),x=5);
(%o33)　0

當初Coppersmith的方法比較麻煩，Howgrave-Graham提供改良的方法，方法如下。

方法	範例
問題敘述
設同餘方程式為\(p(x)=x^k+a_{k-1}x^{k-1}+\ldots+a_1 x+a_0\equiv 0 \pmod{N}\) 且\(p(x)\)為monic(最高次方項係數為1)且不可分解。 利用LLL方法可以找出比邊界\(X\)還小的解\(x_0\)(\(\displaystyle |\;x_0|\;<X\)) 使得\(p(x_0)\equiv 0 \pmod{N}\)	設同餘方程式為\(p(x)=x^2+14x+19\equiv 0\pmod{35}\) 且\(p(x)\)為monic(最高次方項係數為1)且不可分解。 利用LLL方法可以找出比邊界\(X\)還小的解 使得\(p(x_0)\equiv 0 \pmod{35}\)
步驟1：計算參數\(h\)和\(X\)
\(h\ge 2\) \(\displaystyle X=\lceil\;2^{-\frac{1}{2}}(hk)^{-\frac{1}{hk-1}}N^{\frac{h-1}{hk-1}}\rceil\;-1\)	\(h=3\) \(k=2\) \(X=\lceil\;2^{-\frac{1}{2}}\cdot 6^{-\frac{1}{5}}\cdot 35^{\frac{2}{5}}\rceil\;-1=\lceil\;2.0487\rceil\;-1=3-1=2\)
步驟2：產生矩陣\(M\)
定義三角\((hk)\times(hk)\)矩陣\(M=(m_{i,j})\)，\(m_{i,j}=e_{i,j}X^{j-1}\) \(e_{i,j}\)是\(q_{u,v}(x)=N^{(h-1-v)}x^u(p(x))^v\)的\(\displaystyle x^{j-1}\)項係數 其中\(\displaystyle v=\lfloor\;\frac{i-1}{k}\rfloor\;\)和\(u=(i-1)-kv\) 注意到對所有\(u,v\ge 0\)，\(q_{u,v}(x_0)\equiv 0\pmod{N^{h-1}}\) －－－－－－－－－－－－－－－－－－－－－－－ 以\(h=3,k=2\)為例計算\(det(M)\) \(M=\left[\matrix{N^2&&&&&\cr 0&N^2X^1&&&&\cr *&*&NX^2&&&\cr 0&*&*&NX^3&&\cr *&*&*&*&X^4&\cr 0&*&*&*&*&X^5}\right]\) *代表非零數字 因為\(M\)為下三角矩陣，行列式值為對角線元素相乘 \(det(M)=(N^2\cdot N^2X^1)\cdot (NX^2\cdot NX^3)\cdot(X^4\cdot X^5)\) 　　　\(=X^{0+1+2+3+4+5}N^{2(2+1+0)}\) 　　　\(=X^{15}N^6\) －－－－－－－－－－－－－－－－－－－－－－－ 有上面的經驗改計算\(det(M)\)的一般式 維度\((hk)\times(hk)\)矩陣\(M\)的對角線元素為 \(\displaystyle [(N^{h-1},N^{h-1}X^1,\ldots,N^{h-1}X^{k-1}),\)有\(k\)個 \(\displaystyle (N^{h-2}X^k,N^{h-2},X^{k+1},\ldots,N^{h-2}X^{2k-1}),\)有\(k\)個 ⋯ \(\displaystyle (X^{hk-k},\ldots,X^{hk-1})]\)有\(k\)個 因為\(M\)為下三角矩陣，行列式值為對角線元素相乘 \(det(M)=X^{0+1+\ldots+(hk-1)}N^{k[(h-1)+(h-2)+\ldots+0]}\) 　　　\(=X^{\frac{hk(hk-1)}{2}}N^{\frac{hk(h-1)}{2}}\)	\(i=1\)，\(\displaystyle v=\lfloor\;\frac{1-1}{2}\rfloor\;=0\)，\(u=(1-1)-2\cdot 0=0\) \(q_{0,0}(x)=N^{3-1-0}x^0(x^2+14x+19)^0=1225\) \(i=2\)，\(\displaystyle v=\lfloor\;\frac{2-1}{2}\rfloor\;=0\)，\(u=(2-1)-2\cdot 0=1\) \(q_{1,0}(x)=N^{3-1-0}x^1(x^2+14x+19)^0=1225x\) \(i=3\)，\(\displaystyle v=\lfloor\;\frac{3-1}{2}\rfloor\;=1\)，\(u=(3-1)-2\cdot 1=0\) \(q_{0,1}(x)=N^{3-1-1}x^0(x^2+14x+19)^1=665+490x+35x^2\) \(i=4\)，\(\displaystyle v=\lfloor\;\frac{4-1}{2}\rfloor\;=1\)，\(u=(4-1)-2\cdot 1=1\) \(q_{1,1}(x)=N^{3-1-1}x^1(x^2+14x+19)^1=665x+490x^2+35x^3\) \(i=5\)，\(\displaystyle v=\lfloor\;\frac{5-1}{2}\rfloor\;=2\)，\(u=(5-1)-2\cdot 2=0\) \(q_{0,2}(x)=N^{3-1-2}x^0(x^2+14x+19)^2=361+532x+234x^2+28x^3+x^4\) \(i=6\)，\(\displaystyle v=\lfloor\;\frac{6-1}{2}\rfloor\;=2\)，\(u=(6-1)-2\cdot 2=1\) \(q_{1,2}(x)=N^{3-1-2}x^1(x^2+14x+19)^2=361x+532x^2+234x^3+28x^4+x^5\) \(m_{i,j}=e_{i,j}X^{j-1}\)，\(x^{j-1}\)次方係數乘上\(2^{j-1}\) 　　　　　常數項　1次方　　2次方　　3次方　　4次方　　5次方 \(M=\matrix{q_{0,0}(x)\cr q_{1,0}(x)\cr q_{0,1}(x)\cr q_{1,1}(x)\cr q_{0,2}(x)\cr q_{1,2}(x)}\left[\matrix{1225&&&&0&\cr 0&1225\times 2&&&&\cr 665&490\times 2&35\times 2^2&&&\cr 0&665\times 2&490\times 2^2&35\times 2^3&&\cr 361&532\times 2&234 \times 2^2&28\times 2^3&2^4&\cr 0&361\times 2&532\times 2^2&234\times 2^3&28\times 2^4&2^5} \right]\) \(det(M)=2^{15}35^6\)
步驟3：經LLL化簡後的短向量產生不需要同餘\(N^{h-1}\)的方程式
矩陣\(M\)經LLL化簡為\(B\) \(B=LLL(M)\) lattice經LLL化簡後第一行\(b_1\)為整個lattice中較短向量 所形成的方程式不需要再同餘\(N\) －－－－－－－－－－－－－－－－－－－ 設\(B\)是矩陣\(M\)經LLL化簡後的矩陣，矩陣\(B\)的第一列短向量\(b_1\) 從\(\displaystyle det(M)=X^{\frac{hk(hk-1)}{2}}N^{\frac{hk(h-1)}{2}}\)和引理\(\Vert\;b_1\Vert\;\le 2^{(n-1)/4}\cdot (det(L))^{1/n}\) 得知\(\Vert\;b_1\Vert\;\le 2^{\frac{hk-1}{4}}X^{\frac{hk-1}{2}}N^{\frac{h-1}{2}}\) 設整數向量\(c\)，長度為\(n\)，\((c\in Z^n)\) \(b_1=cM\)，其中\(\displaystyle b_{1,j}=\sum_{i=1}^{hk}c_im_{i,j}=\sum_{i=1}^{hk}c_ie_{i,j}X^{j-1}\) \([b_{1,1},b_{1,2},\ldots,b_{1,hk}]=[c_1,c_2,\ldots,c_{hk}]\left[\matrix{m_{1,1}&m_{1,2}&\ldots&m_{1,hk}\cr m_{2,1}&m_{2,2}&\ldots&m_{2,hk}\cr \vdots&\vdots&&\vdots\cr m_{hk,1}&m_{hk,2}&\ldots&m_{hk,hk}}\right]\) \([b_{1,1},b_{1,2},\ldots,b_{1,hk}]=[c_1,c_2,\ldots,c_{hk}]\left[\matrix{e_{1,1}&e_{1,2}X&\ldots&e_{1,hk}X^{hk-1}\cr e_{2,1}&e_{2,2}X&\ldots&e_{2,hk}X^{hk-1}\cr \vdots&\vdots&&\vdots\cr e_{hk,1}&e_{hk,2}X&\ldots&e_{hk,hk}X^{hk-1}}\right]\) 設向量長度\(\displaystyle \Vert\;b_1\Vert\;_2=\sqrt{\sum_{j=1}^{hk} b_{1j}^2}\)，\(\displaystyle \Vert\;b_1\Vert\;_1=\sum_{j=1}^{hk} |\;b_{1j}|\;\) https://en.wikipedia.org/wiki/Norm_(mathematics) \(\displaystyle \Vert\;b_1\Vert\;_2\ge \frac{1}{\sqrt{hk}}\Vert\;b_1\Vert\;_1\) 　　　\(\displaystyle =\frac{1}{\sqrt{hk}}\left(\Bigg|\sum_{i=1}^{hk}c_i m_{i,1}\Bigg|+\Bigg|\sum_{i=1}^{hk}c_i m_{i,2}\Bigg|+\ldots+\Bigg|\sum_{i=1}^{hk}c_i m_{i,hk}\Bigg|\right)\) 　　　\(\displaystyle =\frac{1}{\sqrt{hk}}\left(\Bigg|\sum_{i=1}^{hk}c_i e_{i,1}\Bigg|+\Bigg|\left(\sum_{i=1}^{hk}c_i e_{i,2}\right)X\Bigg|+\ldots+\Bigg|\left(\sum_{i=1}^{hk}c_i e_{i,hk}\right)X^{hk-1}\Bigg|\right)\) 　　　\(\displaystyle \ge \frac{1}{\sqrt{hk}}|\;r(x)|\;\)對所有\(|\;x|\;\le X\) 其中\(\displaystyle r(x)=\sum_{i}^{hk}c_ie_{i,1}+\left(\sum_{i=1}^{hk}c_i e_{i,2}\right)x+\ldots+\left(\sum_{i=1}^{hk}c_i e_{i,hk}\right)x^{hk-1}\) 從\(\displaystyle \frac{1}{\sqrt{hk}}|\;r(x)|\;\le \Vert\;b_1\Vert\;\)，\(\Vert\;b_1\Vert\;\le 2^{\frac{hk-1}{4}}X^{\frac{hk-1}{2}}N^{\frac{h-1}{2}}\) 得到\(\displaystyle |\;r(x)|\;\le \left(2^{\frac{hk-1}{4}}\sqrt{hk}\right)X^{\frac{hk-1}{2}}X^{\frac{h-1}{2}}\) 選擇\(\displaystyle X=\lceil\;\left(2^{-\frac{1}{2}}(hk)^{-\frac{1}{hk-1}}\right)N^{\frac{h-1}{hk-1}}\rceil\;-1\)，\(\displaystyle X^{\frac{hk-1}{2}}<2^{-\frac{hk-1}{4}}(hk)^{-\frac{1}{2}}N^{\frac{h-1}{2}}\) \(\displaystyle |\;r(x)|\;\le\left(2^{\frac{hk-1}{4}}\sqrt{hk}\right)\left(2^{-\frac{hk-1}{4}}(hk)^{-\frac{1}{2}}N^{\frac{h-1}{2}}\right)N^{\frac{h-1}{2}}=N^{h-1}\) 原本要解同餘方程式\(r(x)\equiv 0\pmod{N^{h-1}}\)，對所有\(|\;x|\;<X\)，\(|\;r(x)|\;<N^{h-1}\) 變成解一般方程式\(r(x)=0\)	LLL化簡 \(B=LLL(M)=\left[\matrix{3&8\times 2&-24\times 2^2&-8 \times 2^3&-1\times 2^4&2\times 2^5\cr 49&50\times 2&0&20\times 2^3&0&2\times 2^5\cr 115&-83\times 2&4\times 2^2&13\times 2^3&6\times 2^4&2\times 2^5\cr 61&16\times 2&37\times 2^2&-16\times 2^3&3\times 2^4&4\times 2^5\cr 21&-37\times 2&-14\times 2^2&2\times 2^3&14\times 2^4&-4\times 2^5\cr -201&4\times 2&33\times 2^2&-4\times 2^3&-3\times 2^4&1\times 2^5} \right]\) 取第一列向量形成不需要再同餘\(N^{h-1}\)的方程式 \(\displaystyle r(x)=3+8\times 2\left(\frac{x}{2}\right)-24\times 2^2\left(\frac{x}{2}\right)^2-8\times 2^3\left(\frac{x}{2}\right)^3-1\times 2^4\left(\frac{x}{2}\right)^4+2\times 2^5\left(\frac{x}{2}\right)^5\) 　　\(=3+8x-24x^2-8x^3-x^4+2x^5\) 　　\(=(x-3)(2x-1)(x^3+3x^2+5x+1)\) 解方程式得到答案 \(x=3\) －－－－－－－－－－－－－－－－－－－ \(b_1=[\matrix{3&16&-96&-64&-16&64}]\) \(c=[\matrix{70&46&-98&32&-57&2}]\) \((m_{i,j})=\left[\matrix{1225&&&&&\cr 0&2450&&&&\cr 665&980&140&&&\cr 0&1330&1960&280&&\cr 361&1064&936&224&16&\cr 0&722&2128&1872&448&32}\right]\) \((e_{i,j}X^{j-1})=\left[\matrix{1225&&&&&\cr 0&1225\times 2&&&&\cr 665&490\times 2&35\times 2^2&&&\cr 0&665\times 2&490\times 2^2&35\times 2^3&&\cr 361&532\times 2&234\times 2^2&28\times 2^3&2^4&\cr 0&361\times 2&532\times 2^2&234\times 2^3&28\times 2^4& 2^5}\right]\)

引理1：
假設lattice \(L\)經LLL化簡後向量\(b_1,b_2,\ldots,b_n\)，則\(\Vert\;b_1 \Vert\;\le 2^{(n-1)/4}\cdot(det(L))^{1/n}\)。
[證明]
設\(b_i\)是LLL化簡後的向量，符合以下兩個條件
(1)(size-reduced)對\(1\le j<i\le n\)，\(\displaystyle |\;\mu_{i,j}|\;\le \frac{1}{2}\)
(2)(Lovász condition)對\(i=2,3,\ldots,n\)，\(\displaystyle \frac{3}{4}\Vert\;b_{i-1}^2\Vert\;\le \Vert\;b_i^*\Vert\;^2+\mu_{i,i-1}^2 \Vert\;b_{i-1}^*\Vert\;^2\)
https://en.wikipedia.org/wiki/Le ... reduction_algorithm
將(2)式移項\(\displaystyle (\frac{3}{4}-\mu_{i,i-1}^2) \Vert\;b_{i-1}^2\Vert\;^2\le \Vert\;b_i^*\Vert\;^2\)
將(1)式平方\(\mu_{i,i-1}^2\le \frac{1}{4}\)代入上式，得到對\(1<i\le n\)，\(\displaystyle \frac{1}{2}\Vert\;b_{i-1}^*\Vert\;^2\le \Vert\;b_i^*\Vert\;^2\)，\(\displaystyle \Vert\;b_{i-1}^*\Vert\;^2\le 2^{i-(i-1)} \Vert\;b_i^*\Vert\;^2\)
由數學歸納法得知，對\(1\le j\le i\le n\)，\(\Vert\;b_j^*\Vert\;^2\le 2^{i-j}\cdot \Vert\;b_i^*\Vert\;^2\)
由Gram-Schmidt正交化可知\(\displaystyle b_i^*=b_i-\sum_{j=1}^{i-1}\mu_{ij}b_j^*\)，\(\displaystyle b_i=b_i^*+\sum_{j=1}^{i-1}\mu_{ij}b_j^*\)
\(\displaystyle \Vert\;b_i\Vert\;^2=\Vert\;b_i^*\Vert\;^2+2\sum_{j=1}^{i-1}\mu_{ij}b_i^*\cdot b_j^*+\sum_{j=1}^{i-1}\mu_{ij}^2\Vert\;b_j^*\Vert\;^2\)
因為Gram-Schmidt正交化，\(b_i^*\cdot b_j^*=0\)代入上式
\(\displaystyle \Vert\;b_i\Vert\;^2=\Vert\;b_i^*\Vert\;^2+\sum_{j=1}^{i-1}\mu_{ij}^2\Vert\;b_j^*\Vert\;^2\)
　　\(\displaystyle \le \Vert\;b_i^*\Vert\;^2+\sum_{j=1}^{i-1}\frac{1}{4}2^{i-j}\Vert\;b_i^*\Vert\;^2\)
　　\(\displaystyle =(1+\frac{1}{4}(2^i-2))\cdot \Vert\;b_i^*\Vert\;^2\)
　　\(\le 2^{i-1}\cdot \Vert\;b_i^*\Vert\;^2\)
對\(1\le j\le i\le n\)，\(\Vert\;b_j\Vert\;^2\le 2^{j-1}\cdot \Vert\;b_j^*\Vert\;^2\le 2^{i-1}\cdot \Vert\;b_i^*\Vert\;^2\)
\(\Vert\;b_1\Vert\;^2\le 2^{n-1}\Vert\;b_n^*\Vert\;^2\)
\(\Vert\;b_1\Vert\;^2\le 2^{n-2}\Vert\;b_{n-1}^*\Vert\;^2\)
⋯
\(\Vert\;b_1\Vert\;^2\le 2^{0}\Vert\;b_1^*\Vert\;^2\)
將上面各式相乘\(\displaystyle \Vert\;b_1\Vert\;^{2n}\le 2^{0+1+\ldots+(n-2)+(n-1)}\prod_{i=1}^n \Vert\;b_i^*\Vert\;^2\)
\(\displaystyle \Vert\;b_1\Vert\;^{2n}\le 2^{\frac{n(n-1)}{2}}\cdot det(L)^2\)
\(\displaystyle \Vert\;b_1\Vert\;\le 2^{\frac{n-1}{4}}\cdot det(L)^{\frac{1}{n}}\)



參考資料：
N. Howgrave-Graham. Finding small roots of univariate modular equations revisited. In Cryptography and Coding– Proc. IMA ’97, volume 1355 of Lecture Notes in Computer Science, pages 131–142. Springer, 1997.
https://link.springer.com/chapter/10.1007/BFb0024458



請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.45.0\share\maxima\5.45.0\share目錄下
要先載入LLL.mac才能使用LLL指令
(%i1)　load("LLL.mac");
(%o1)　C:/maxima-5.45.0/share/maxima/5.45.0/share/LLL.mac

同餘方程式
(%i2)　px:x^2+14*x+19;
(px)　\(x^2+14x+19\)

\(p(x)\equiv 0\pmod{N}\)
(%i3)　N:35;
(N)　35

\(p(x)\)的次數\(k\)
(%i4)　k:hipow(px,x);
(k)　2

參數\(h\ge 2\)
(%i5)　h:3;
(h)　3

希望能找到\(|\;x|\;<X\)，\(p(x)\equiv 0\pmod{N}\)
(%i6)　X:ceiling(2^(-1/2)*(h*k)^(-1/(h*k-1))*N^((h-1)/(h*k-1)))-1;
(X)　2

產生\(q_{u,v}(x)\)方程組
(%i7)
q_uv:create_list((v:floor((i-1)/k),
                             u: (i-1)-k*v,
                             N^(h-1-v)*x^u*px^v),i,1,h*k);
(q_uv)　\([1225,1225x,35(x^2+14x+19),35x(x^2+14x+19),(x^2+14x+19)^2,x(x^2+14x+19)^2]\)

用\(Xx\)取代原本的\(x\)
(%i8)　q_uv:ev(q_uv,x=x*X);
(q_uv)　\([1225,2450x,35(4x^2+28x+19),70x(4x^2+28x+19),(4x^2+28x+19)^2,2x(4x^2+28x+19)^2]\)

\(x^1,x^2,\ldots,x^{hk-1}\)
(%i9)　xpower:create_list(x^i,i,1,h*k-1);
(xpower)　\([x,x^2,x^3,x^4,x^5]\)

取多項式\(q_{u,v}(x)\)係數(常數項在最後一行)
(%i10)　M:augcoefmatrix(q_uv,xpower);
(M)　\(\left[\matrix{0&0&0&0&0&1225\cr
2450&0&0&0&0&0\cr
980&140&0&0&0&665\cr
1330&1960&280&0&0&0\cr
1064&936&224&16&0&361\cr
722&2128&1872&448&32&0}\right]\)

將常數項移到第一行
(%i11)　M:addcol(col(M,h*k),submatrix(M,h*k));
(M)　\(\left[\matrix{1225&0&0&0&0&0\cr
0&2450&0&0&0&0\cr
665&980&140&0&0&0\cr
0&1330&1960&280&0&0\cr
361&1064&936&224&16&0\cr
0&722&2128&1872&448&32}\right]\)

LLL化簡
(%i12)　B: LLL(M);
(B)　\(\left[\matrix{3&16&-96&-64&-16&64\cr
49&100&0&160&0&64\cr
115&-166&16&104&96&64\cr
61&32&148&-128&48&128\cr
21&-74&-56&16&224&-128\cr
-201&8&132&-32&-48&32}\right]\)

第一列短向量\(b_1\)
(%i13)　B[1];
(%o13)　\([3,16,-96,-64,-16,64]\)

產生的方程式不需要再同餘\(N^{h-1}\)
(%i14)　rx:sum(B[1][i+1]*(x/X)^i,i,0,h*k-1);
(rx)　\(2x^5-x^4-8x^3-24x^2+8x+3\)

將\(r(x)\)因式分解
(%i15)　factor(rx);
(%o15)　\((x-3)(2x-1)(x^3+3x^2+5x+1)\)

得到\(r(x)\)的解
(%i16)　x:3;
(x)　3

驗證答案
(%i17)　ev(mod(px,N),x=3);
(%o17)　0

－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－
解三次同餘方程式\(p(x)=x^3-4x^2-3x-10\pmod{1131}\)。

參考資料
Finding Small Roots of Polynomial Equations Using Lattice Basis Reduction
https://ntnuopen.ntnu.no/ntnu-xm ... e=1&isAllowed=y



請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.45.0\share\maxima\5.45.0\share目錄下
要先載入LLL.mac才能使用LLL指令
(%i1)　load("LLL.mac");
(%o1)　C:/maxima-5.45.0/share/maxima/5.45.0/share/LLL.mac

同餘方程式
(%i2)　px:x^3-4*x^2-3*x-10;
(px)　\(x^3-4x^2-3x-10\)

\(p(x)\equiv 0\pmod{N}\)
(%i3)　N:1131;
(N)　1131

\(p(x)\)的次數\(k\)
(%i4)　k:hipow(px,x);
(k)　3

參數\(h\ge 2\)
(%i5)　h:3;
(h)　3

希望能找到\(|\;x|\;<X\)，\(p(x)\equiv 0\pmod{N}\)
按照公式應該是3，本範例\(X=6\)
(%i7)
X:ceiling(2^(-1/2)*(h*k)^(-1/(h*k-1))*N^((h-1)/(h*k-1)))-1;
X:6;
(X)　3
(X)　6

產生\(q_{u,v}(x)\)方程組
(%i8)
q_uv:create_list((v:floor((i-1)/k),
                             u: (i-1)-k*v,
                             N^(h-1-v)*x^u*px^v),i,1,h*k);
(q_uv)　\([1279161,1279161x,1279161x^2,1131(x^3-4x^2-3x-10),1131x(x^3-4x^2-3x-10),1131x^2(x^3-4x^2-3x-10),\)
　　　　\((x^3-4x^2-3x-10)^2,x(x^3-4x^2-3x-10)^2,x^2(x^3-4x^2-3x-10)^2]\)

用\(Xx\)取代原本的\(x\)
(%i8)　q_uv:ev(q_uv,x=x*X);
(q_uv)　\([1279161,7674966x,46049796x^2,1131(216x^3-144x^2-18x-10),6786x(216x^3-144x^2-18x-10),\)
　　　\(40716x^2(216x^3-144x^2-18x-10),(216x^3-144x^2-18x-10)^2,6x(216x^3-144x^2-18x-10)^2,36x^2(216x^3-144x^2-18x-10)^2]\)

\(x^1,x^2,\ldots,x^{hk-1}\)
(%i9)　xpower:create_list(x^i,i,1,h*k-1);
(xpower)　\([x,x^2,x^3,x^4,x^5,x^6,x^7,x^8]\)

取多項式\(q_{u,v}(x)\)係數(常數項在最後一行)
(%i11)　M:augcoefmatrix(q_uv,xpower);
(M)　\(\left[\matrix{0&0&0&0&0&0&0&0&1279161\cr
7674966&0&0&0&0&0&0&0&0\cr
0&46049796&0&0&0&0&0&0&0\cr
-20358&-162864&244296&0&0&0&0&0&-11310\cr
-67860&-122148&-977184&1465776&0&0&0&0&0\cr
0&-407160&-732888&-5863104&8794656&0&0&0&0\cr
360&3204&864&12960&-62208&46656&0&0&100\cr
600&2160&19224&5184&77760&-373248&279936&0&0\cr
0&3600&12960&115344&31104&466560&-2239488&1679616&0}\right]\)

將常數項移到第一行
(%i12)　M:addcol(col(M,h*k),submatrix(M,h*k));
(M)　\(\left[\matrix{1279161&0&0&0&0&0&0&0&0\cr
0&7674966&0&0&0&0&0&0&0\cr
0&0&46049796&0&0&0&0&0&0\cr
-11310&-20358&-162864&244296&0&0&0&0&0\cr
0&-67860&-122148&-977184&1465776&0&0&0&0\cr
0&0&-407160&-732888&-5863104&8794656&0&0&0\cr
100&360&3204&864&12960&-62208&46656&0&0\cr
0&600&2160&19224&5184&77760&-373248&279936&0\cr
0&0&3600&12960&115344&31104&466560&-2239488&1679616}\right]\)

LLL化簡
(%i12)　B: LLL(M);
(M)　\(\left[\matrix{
100&360&3204&864&12960&-62208&46656&0&0\cr
-11310&-20358&-162864&244296&0&0&0&0&0\cr
400&2040&14976&22680&57024&-171072&-186624&279936&0\cr
1279161&0&0&0&0&0&0&0&0\cr
-22920&-109656&-457488&-491184&1426896&186624&-139968&0&0\cr
1400&8040&59256&121176&322704&-451008&-746496&-839808&1679616\cr
-53360&-196668&-1128060&-794880&-859248&972000&1632960&1959552&1679616\cr
-22620&7634250&-325728&488592&0&0&0&0&0\cr
-267849&3713268&20770668&14244552&11153376&9020160&7231680&5598720&5038848}\right]\)

第一列短向量\(b_1\)
(%i14)　B[1];
(%o14)　\([100,360,3204,864,12960,-62208,46656,0,0]\)

產生的方程式不需要再同餘\(N^{h-1}\)
(%i15)　rx:sum(B[1][i+1]*(x/X)^i,i,0,h*k-1);
(rx)　\(x^6-8x^5+10x^4+4x^3+89x^2+60x+100\)

將\(r(x)\)因式分解
(%i16)　factor(rx);
(%o16)　\((x-5)^2(x^2+x+2)^2\)

得到\(r(x)\)的解
(%i17)　x:5;
(x)　5

驗證答案
(%i18)　ev(mod(px,N),x=5);
(%o18)　0

將Coppersmith和Howgrave-Graham方法寫成副程式，放入LLL.zip，提供將來範例直接使用。

111.3.6補充
發現ceiling指令在處理超大浮點數會出現錯誤，改用bigfloat numbers。

修正前	修正後
h:3$ k:3$ N:10^150$ X:ceiling(2^(-1/2)*(h*k)^(-1/(h*k-1))*N^((h-1)/(h*k-1)))-1; 16990442448471225139289591175253590015錯誤	h:3$ k:3$ N:10^150$ fpprec:100$/*設定小數點以下100為有效位數*/ X:ceiling(bfloat(2^(-1/2)*(h*k)^(-1/(h*k-1))*N^((h-1)/(h*k-1))))-1; 16990442448471225207917914988908164235正確

請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.45.0\share\maxima\5.45.0\share目錄下
要先載入LLL.mac才能使用Coppersmith_Howgrave指令
(%i1)　load("LLL.mac");
(%o1)　C:/maxima-5.45.0/share/maxima/5.45.0/share/LLL.mac

Coppersmith_Howgrave方法副程式
(%i2)
Coppersmith_Howgrave(px,N,h):=block
([ak,inv_ak,k,X,q_uv,M,B,i,rx,x],
px:expand(px),/*先expand()確保coeff()取得到係數,例子3(x^2+x+1),x^2係數為0*/
if (ak:coeff(px,x,hipow(px,x)))#1 then
  (print("p(x)不是monic多項式，同乘",ak^"-1","≡",inv_ak:inv_mod(ak,N),"mod(",N,")"),
   print("p(x)變成monic多項式，",inv_ak,"(",px,")=",px:polymod(inv_ak*px,N),"(mod",N,")")
  ),
if h<2 then (print("參數h要≥2"),return([])),
fpprec:100,/*設定小數點以下100為有效位數*/
print("參數h=",h),
print("p(x)最高次方k=",k:hipow(px,x)),
print("X=ceiling(",2^(-1/2),"(hk)"^"-1/(hk-1)","N"^"(h-1)/(hk-1)",")=ceiling(",
        2^(-1/2),h*k,""^("-1"/(h*k-1)),N^((h-1)/(h*k-1)),")=",X:ceiling(bfloat(2^(-1/2)*(h*k)^(-1/(h*k-1))*N^((h-1)/(h*k-1))))-1),
print("q_uv=N"^"h-1-v","x"^"u","p(x)"^"v","=",q_uv:create_list((v:floor((i-1)/k),u: (i-1)-k*v,N^(h-1-v)*x^u*px^v),i,1,h*k)),
print("用",X,"x取代x,得到q_uv=",q_uv:ev(q_uv,x=x*X)),
M:augcoefmatrix(q_uv,create_list(x^i,i,1,h*k-1)),
print("產生矩陣M=",M:addcol(col(M,h*k),submatrix(M,h*k))),
print("LLL化簡B=",B: LLL(M)),
print("產生不需要同餘N"^(h-1),"的方程式"),
printList:["r(x)=",B[1][1]],
for i:2 thru h*k do
  (if B[1][ i ]>=0 then printList:append(printList,["+"]),
   printList:append(printList,[B[1][ i ],"(",x/X,")"^(i-1)])
  ),
apply(print,printList),/*再用apply(print,)將全部內容印在同一行*/
print("r(x)=",rx:sum(B[1][i+1]*(x/X)^i,i,0,h*k-1),"=",factor(rx)),
print("整數解為",x:sublist(solve(rx,x),lambda([x],integerp(rhs(x))))),
return(x)
)$

二次同餘方程式
(%i5)
px:x^2+14*x+19;
N:35;
h:3;
(px)　\(x^2+14x+19\)
(N)　35
(h)　3


(%i6)　solution:Coppersmith_Howgrave(px,N,h);
參數\(h=3\)
\(p(x)\)最高次方\(k=2\)
\(\displaystyle X=ceiling(\frac{1}{\sqrt{2}}(hk)^{-1/(hk-1)}N^{(h-1)/(hk-1)})=ceiling(\frac{1}{\sqrt{2}}6^{-1/5}35^{2/5})=2\)
\(q_{uv}=N^{h-1-v}x^{u}p(x)^{v}=[1225,1225x,35(x^2+14x+19),35x(x^2+14x+19),(x^2+14x+19)^2,x(x^2+14x+19)^2]\)
用\(2x\)取代\(x\),得到\(q_{uv}=[1225,2450x,35(4x^2+28x+19),70x(4x^2+28x+19),(4x^2+28x+19)^2,2x(4x^2+28x+19)^2]\)
產生矩陣\(M=\left[\matrix{1225&0&0&0&0&0\cr
0&2450&0&0&0&0\cr
665&980&140&0&0&0\cr
0&1330&1960&280&0&0\cr
361&1064&936&224&16&0\cr
0&722&2128&1872&448&32}\right]\)
LLL化簡\(B=\left[\matrix{3&16&-96&-64&-16&64\cr
49&100&0&160&0&64\cr
115&-166&16&104&96&64\cr
61&32&148&-128&48&128\cr
21&-74&-56&16&224&-128\cr
-201&8&132&-32&-48&32}\right]\)
產生不需要同餘\(N^2\)的方程式
\(\displaystyle r(x)= 3 + 16\left(\frac{x}{2}\right)-96\left(\frac{x}{2}\right)^2 -64\left(\frac{x}{2}\right)^3-16\left(\frac{x}{2}\right)^4 + 64\left(\frac{x}{2}\right)^5 \)
\(r(x)=2x^5-x^4-8x^3-24x^2+8x+3=(x-3)(2x-1)(x^3+3x^2+5x+1)\)
整數解為\([x=3]\)
(solution)　\([x=3]\)

驗證答案
(%i7)　ev(mod(px,N),solution);
(%o7)　0

三次同餘方程式
(%i10)
px:x^3-4*x^2-3*x-10;
N:1131;
h:3;
(px)　\(x^3-4x^2-3x-10\)
(N)　1131
(h)　3


(%i11)　solution:Coppersmith_Howgrave(px,N,h);
參數\(h=3\)
\(p(x)\)最高次方\(k=3\)
\(\displaystyle X=ceiling(\frac{1}{\sqrt{2}}(hk)^{-1/(hk-1)} N^{(h-1)/(hk-1)})=ceiling(\frac{1}{\sqrt{2}} 9 ^{-1/8} 1131^{1/4})=3\)
\(q_{uv}=N^{h-1-v} x^u p(x)^v =[1279161,1279161x,1279161x^2,1131(x^3-4x^2-3x-10),\)
\(1131x(x^3-4x^2-3x-10),1131x^2(x^3-4x^2-3x-10),(x^3-4x^2-3x-10)^2,x(x^3-4x^2-3x-10)^2,x^2(x^3-4x^2-3x-10)^2]\)
用\(3x\)取代\(x\)得到\(q_{uv}=1279161,3837483x,11512449x^2,1131(27x^3-36x^2-9x-10),\)
\(3393x(27x^3-36x^2-9x-10),10179x^2(27x^3-36x^2-9x-10),(27x^3-36x^2-9x-10)^2,3x(27x^3-36x^2-9x-10)^2,9x^2(27x^3-36x^2-9x-10)^2]\)
產生矩陣\(M=\left[\matrix{1279161&0&0&0&0&0&0&0&0\cr
0&3837483&0&0&0&0&0&0&0\cr
0&0&11512449&0&0&0&0&0&0\cr
-11310&-10179&-40716&30537&0&0&0&0&0\cr
0&-33930&-30537&-122148&91611&0&0&0&0\cr
0&0&-101790&-91611&-366444&274833&0&0&0\cr
100&180&801&108&810&-1944&729&0&0\cr
0&300&540&2403&324&2430&-5832&2187&0\cr
0&0&900&1620&7209&972&7290&-17496&6561}\right]\)
LLL化簡\(B=\left[\matrix{100&180&801&108&810&-1944&729&0&0\cr
100&480&1341&2511&1134&486&-5103&2187&0\cr
0&300&1440&4023&7533&3402&1458&-15309&6561\cr
-10710&-9099&-35910&31185&4860&-11664&4374&0&0\cr
-1020&-3108&-13203&-21114&-43335&-39609&-37908&-15309&39366\cr
-10410&-40689&-60804&-76221&100845&-2916&-28431&13122&0\cr
1542&18561&31473&86157&29808&100602&181521&269001&426465\cr
1222511&-52875&-208521&136539&-9963&-13608&26973&4374&-6561\cr
-225150&3376488&-1106784&-423009&379647&-50787&-80190&54675&59049}\right]\)
產生不需要同餘\(N^2\)的方程式
\(\displaystyle r(x)=100 + 180\left(\frac{x}{3}\right)+801\left(\frac{x}{3}\right)^2+108\left(\frac{x}{3}\right)^3+810\left(\frac{x}{3}\right)^4-1944\left(\frac{x}{3}\right)^5+729\left(\frac{x}{3}\right)^6+0\left(\frac{x}{3}\right)^7+0\left(\frac{x}{3}\right)^8\)
\(r(x)=x^6-8x^5+10x^4+4x^3+89x^2+60x+100=(x-5)^2(x^2+x+2)^2\)
整數解為\([x=5]\)
(solution)　\([x=5]\)

驗證答案
(%i12)　ev(mod(px,N),solution);
(%o12)　0

1-1.刻板訊息(Stereotyped Messages)

銀行要傳送底下的訊息給客戶
Your pin no is ****，其中****為四位數密碼
將明文按英文字母轉換成數字(空白\(=00,A=01,B=02,...,Z=26\)，不分大小寫)
設明文\(M=B+x\)，其中\(B=25152118001609140014150009190000\)，密碼\(0\le x <10000\)
採用RSA方案將明文加密，其中公鑰\(e=3\)，\(N=54957464841358314276864542898551\)
得到密文\(C\equiv M^e \equiv (B+x)^3\equiv 37393323096087665763922106857101 \pmod{N}\)要如何找出密碼\(x\)呢？

參考資料：
Cryptanalytic Attacks on RSA，https://books.google.com.tw/book ... e&q&f=false


請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.45.1\share\maxima\5.45.1\share目錄下
要先載入LLL.mac才能使用Coppersmith_Howgrave指令
(%i1)　load("LLL.mac");
(%o1)　C:/maxima-5.45.1/share/maxima/5.45.1/share/LLL.mac

明文訊息
(%i2)　m:"Your pin no is";
(m)　Your pin no is

這個範例不區分大小寫，統一轉成大寫字母
(%i3)　m:supcase(m);
(m)　YOUR PIN NO IS

明文訊息轉成list
(%i4)　mlist:charlist(m);
(mlist)　[Y,O,U,R, ,P,I,N, ,N,O, ,I,S]

明文轉成數字B
(%i5)　B:0;
(B)　0

將明文訊息按照字母順序轉換成數字(空白=00,A=01,B=02,...,Z=26)
(%i7)
for i:1 thru length(mlist) do
  (if mlist[ i ]=" " then
     (B:B*100+0)/*空白就補上00*/
   else/*其他就乘100倍再加上英文字母的順序*/
     (B:B*100+cint(mlist[ i ])-cint("A")+1)
  )$
B;
(%o7)　2515211800160914001415000919

最後四位數為密碼x
(%i8)　B:B*10000;
(B)　25152118001609140014150009190000

公鑰e
(%i9)　e:3;
(e)　3

公鑰N
(%i10)　N:54957464841358314276864542898551;
(N)　54957464841358314276864542898551

密文C
(%i11)　C:37393323096087665763922106857101;
(C)　37393323096087665763922106857101

明文M，其中x為四位數密碼
(%i12)　M:B+x;
(M)　\(x+25152118001609140014150009190000\)

產生方程式p(x)≡(B+x)^e-C(mod N)
(%i13)　px:M^e-C;
(px)　\((x+25152118001609140014150009190000)^3-37393323096087665763922106857101\)

方程式p(x)同餘N
(%i14)　px:polymod(px,N);
(px)　\(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263\)

參數h
(%i15)　h:3;
(h)　3

呼叫Coppersmith_Howgrave副程式，找符合p(x)≡0(mod N)的較小的解x
(%i16)　x:Coppersmith_Howgrave(px,N,h);
參數\(h=3\)
\(p(x)\)最高次方\(k=3\)
\(\displaystyle X=ceiling(\frac{1}{\sqrt{2}}(hk)^{-1/(hk-1)}N^{(h-1)/(hk-1)})\)
\(=ceiling(\frac{1}{\sqrt{2}}9^{-1/8}54957464841358314276864542898551^{1/4})=46260610\)
\(q_{uv}=N^{h-1-v}x^u p(x)^v=\)
\([3020322941789135243826751301254310584993059920451586964677899601,\)
\(3020322941789135243826751301254310584993059920451586964677899601x,\)
\(3020322941789135243826751301254310584993059920451586964677899601x^2,\)
\(54957464841358314276864542898551(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263),\)
\(54957464841358314276864542898551x(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263),\)
\(54957464841358314276864542898551x^2(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263),\)
\((x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263)^2,\)
\(x(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263)^2,\)
\(x^2(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263)^2]\)

用\(46260610x\)取代\(x\),得到\(q_{uv}=\)
\([3020322941789135243826751301254310584993059920451586964677899601,\)
\(139721981684159887751924249514318172791235797686641888454048089061016610x,\)
\(6463624103118063744935544456324562407407970654820642611436221569296955598732100x^2,\)
\(54957464841358314276864542898551(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263),\)
\(2542365847614788847019462641858137376110x(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263),\)
\(117611394953827177084317023684568968482648027100x^2(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263),\)
\((98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263)^2,\)
\(46260610x(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263)^2,\)
\(2140044037572100x^2(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263)^2]\)

產生矩陣\(M=\left[\matrix{
3020322941789135243826751301254310584993059920451586964677899601&0&0&0&0&0&0&0&0\cr
0&139721981684159887751924249514318172791235797686641888454048089061016610&0&0&0&0&0&0&0\cr
0&0&6463624103118063744935544456324562407407970654820642611436221569296955598732100&0&0&0&0&0&0\cr
1004840807312492934121310085993087816338401741664749320802716913&-58760286766514250464246726367461673333231803685743085020341021553863830&2410902949519492989179980080581154246553453535301351223201730247704151548267900&5440774873514967046498526949032608069078072148942531000&0&0&0&0&0\cr
0&46484548699168383753141618577192698167382430994473719077419374052696930&-2718286709593876800168836752261861160016036509902723416322838065104888632736300&111529841095570952570189278315533349949653158149697041409558194314245150155317497419000&251693564521475219700920220763687359166473755234092339003910000&0&0&0&0\cr
0&0&2150403578398235925134420691768266304768993361087260873490057469495932126927300&-125749601340705593040658491150052576997649458730371025900378445822971862132447207143000&5159438482284180564178023830336345244014424384431456450801421899475512335726582174276365590000&11643497827837801763248586973862843084330167466119804398647668985100000&0&0&0\cr
334303671329367207597382428251924280469672863044332310758017169&-39098291891529790146672600165213743993545305783624348258638047456145580&2747361389197032065525895040706053126300958522505044634704406065907531371974300&-93808080400887705413187047147355847439306195234682022660264660430139194466387149708000&1924447532275702298105139918003157179495823605879799776741463766795883123756267581643242950000&8685945472081614468358429342848175207711673102374196684328376029800000&9800949035846008678895673107522190930361000000&0&0\cr
0&15465091760936037937451545534215250888338153144877269738375436628413090&-1808710832860221925357063953928888577525241908186990361297033844530242779603800&127094613754702113540787875379036848315089384835782092878652994296582604861668022323000&-4339619022274109793914334845135441389609242568335483524297665952941101520923694041653401880000&89026116756068676488745616742176033049356292460399124349923926144875298793670429650041221245199500000&401817135965233455091086640042055722495618701836422786877008115447926178000000&453397880977148227551007964314572140974967380210000000&0\cr
0&0&715424578566875285969650341855573377397564850755440873231788107446732875384900&-83672066441721911002392246317762282218349981070294168177721176838614194432567346318000&5879474360006910140686106995638225815533507147028029443643143494486432216289728330155597030000&-200753423138003906273451417680221051302571222849166152478959848559286650429857849820251779543946800000&4118402467066958176262030365319276016243382196556464335893334277056879696127458214572993419947888441695000000&18588305818204638424921273531195923376638043474361038338830390395571488229248580000000&20974462546710273066928434544050339130507985738616528100000000}\right]\)

LLL化簡\(B=\left[\matrix{
1346829011992131838415424923205840084705445702496636688958&-45179677717016066583753308148255943279532835707102039947418400&-57317453167676354735698331555650210546427932428564618523281700&55022492206313287028619713807534065142711418176206799219594000&-9126018929197534844882170642391266050994818115932677074230000&-74312694674165829957248058752411116787238498594388701682800000&-19823407733951640707057856074266278764703362315244543316000000&138583699736138999822205248506077392755142831146437181570000000&20974462546710273066928434544050339130507985738616528100000000\cr
-5902801572552400483890393706301403464838435984190741057521&198017000397961977217885428384176729067567197716265205355728090&42767563064370999055058464552273491314630668309914422404759500&-118669599523559088891420124095064243299234055073696904508477000&5351963749137648019221242354483616465414282780748646299580000&-112004086186351949887374756082813158190757018854244406606700000&-81397469992098637889082971258651279103671999211513531483000000&-10896835906406582990864300928074561497704329125231160360000000&0\cr
3508846630479685748619833227116965930963020713923238512016&-117708907048737798457372393976462193778029056413142461742828970&-19527888444159534716576393306673687254846408168280511459649900&27139572631435639962886919071578980327487934016822772654740000&152842267767879348291763951826981942119544813261287552570070000&-27976405711844657161410593106590342431253966526607082103400000&113524558112017051054823008390937950572260639715265074131000000&-73696712976382536265834206929658681977733154502070358350000000&-20974462546710273066928434544050339130507985738616528100000000\cr
-698639478405741507601710852229901400525255812179741745660&23434582306738882194913520923528306099741489318995435888835520&77832343453161261306864164010036521096392268014746035430400000&-19810469901945597112216075834712042329629980808126434227417000&11981172299793958495319504252438495583021639688484388874570000&123052851048114992637170087912139575579626631163057082528500000&-77828623800639953659282136255768504523687584641815030167000000&45046935686004396852036235081258646064208160740318079740000000&83897850186841092267713738176201356522031942954466112400000000\cr
2608388682960311335109469583103966794580680761470012241110&-87504293274733197882640504831875268439796045643230655421800670&67355084330066865588347641681926665747584588920990302572315700&49518826646218754489406268633116221438926982129998391470769000&-76798282830980653021742983335907095096227676638334916897480000&8588117181290281381087324090049898257206127303677712526400000&128047976903282825900283462166286459364396690101948932088000000&88906907910860169021868087433507208597965866101930374390000000&-41948925093420546133856869088100678261015971477233056200000000\cr
-1995198218937024623232349557084188775094976064244671057536&66932114210862830110104110182574512142599015426308136347603390&-7269506494572805968382600910891268087690791621484198916104800&8746942221093256881071752182172494956975331200299995572349000&135289672986284673880862945002578814813571416764191759148860000&57336532483012033414667813522314757646899794385904686577900000&98003299188098351389493461699129078727854830331097773587000000&76794339087563318362316609668062911023749796992816963810000000&-20974462546710273066928434544050339130507985738616528100000000\cr
1080486934579740147709503727342917433192987867804798211748&-36248047630075260993070370343206373336745272044257160933612290&50432291648410244801921487663386649765799516063041448619617700&-110728984816423069966245765896893991877601482453715569174801000&47751944909992951034160485499982734778235628595949271138960000&92499399504781570519595347939458299088542884224606869328000000&-23368916165677269442994314666846991564283577282956230451000000&47762871511471852576044187070952438440777872791839177960000000&-83897850186841092267713738176201356522031942954466112400000000\cr
-1351209723281976538802605297703889071606362629555587092791&45325239305457343576462953756357480589591441740795953594944820&104141687489491357694257317408495876883875779940487417687370100&56013394445295195456052555118633049318801173303376655543288000&43928806144132011144005796648574152800734722604776425309230000&-52583333463842986422341946819648968524622281916459256843100000&-190189161265649279450477135329996455520381986431990693226000000&28230740167810844364671917022661043622253814284451493460000000&-41948925093420546133856869088100678261015971477233056200000000\cr
3020322941789135243826751301254310584993059920451586964677899601&0&0&0&0&0&0&0&0}\right]\)

產生不需要同餘\(N^2\)的方程式
\(r(x)= 1346829011992131838415424923205840084705445702496636688958\)
\(\displaystyle -45179677717016066583753308148255943279532835707102039947418400\left(\frac{x}{46260610}\right)\)
\(\displaystyle -57317453167676354735698331555650210546427932428564618523281700\left(\frac{x}{46260610}\right)^2\)
\(\displaystyle +55022492206313287028619713807534065142711418176206799219594000\left(\frac{x}{46260610}\right)^3\)
\(\displaystyle -9126018929197534844882170642391266050994818115932677074230000\left(\frac{x}{46260610}\right)^4\)
\(\displaystyle -74312694674165829957248058752411116787238498594388701682800000\left(\frac{x}{46260610}\right)^5\)
\(\displaystyle -19823407733951640707057856074266278764703362315244543316000000\left(\frac{x}{46260610}\right)^6\)
\(\displaystyle +138583699736138999822205248506077392755142831146437181570000000\left(\frac{x}{46260610}\right)^7\)
\(\displaystyle +20974462546710273066928434544050339130507985738616528100000000\left(\frac{x}{46260610}\right)^8 \)

\(r(x)= x^8+305655817x^7-2022600838087156x^6-350756908723576394560428x^5\)
\(-1992672579437965292192928201903x^4+555784194569846483233547842537557231074x^3\)
\(-26783305465388245970449493154965416028246066377x^2\)
\(-976633851499495285162761756670652273706136510242775440x\)
\(+1346829011992131838415424923205840084705445702496636688958\)

\(=(x-1379)(x^7+305657196x^6-2022179336813872x^5-350759697308881860889916x^4\)
\(-1993156277060554240279095396067x^3+555781446007340416729250497665006054681x^2\)
\(-26782539042774201848014823518529135984896661278x-976670784620835270787110169112284325384659682738677802)\)
整數解為\([x=1379]\)
(x)　\([x=1379]\)

驗算答案
(%i17)　mod((B+rhs(x[1]))^e-C,N);
(%o17)　0