﻿ Math Pro 數學補給站

 方法 範例 問題敘述 設同餘方程式為$$f(x)=a_d x^d+a_{d-1}x^{d-1}+\ldots+a_1 x+a_0\equiv 0 \pmod{N}$$ 利用LLL方法可以找出比邊界$$X$$還小的解$$x_0$$($$|\;x_0|\; 步驟4.計算邊界\(X$$的範圍

$$=\left|\ \matrix{a_0&a_1X&a_2X^2&\ldots&a_{d-1}X^{d-1}&a_dX^d&\frac{1}{d+1} \cr N&0&0&0&0&0&0\cr 0&NX&0&0&0&0&0\cr 0&0&NX^2&0&0&0&0\cr &&&\ddots&&&\cr 0&0&0&0&NX^{d-1}&0&0\cr 0&0&0&0&0&NX^d&0}\right|$$

$$\displaystyle =\frac{1}{d+1}\left|\matrix{N&0&0&0&0&0\cr 0&NX&0&0&0&0\cr 0&0&NX^2&0&0&0\cr &&&\ddots&&\cr 0&0&0&0&NX^{d-1}&0\cr 0&0&0&0&0&NX^d} \right|$$

$$\displaystyle =\frac{N^{d+1}X^{\frac{d(d+1)}{2}}}{d+1}$$

https://en.wikipedia.org/wiki/Le ... reduction_algorithm

$$\epsilon(d)X^{\frac{d(d+1)}{2}}<N$$，得到邊界$$\displaystyle X<N^{\frac{2}{d(d+1)}}$$

Håstad, J.: Solving Simultaneous Modular Equations of Low Degree. SIAM Journalon Computing 17(2), 336–341 (1988)
http://www.csc.kth.se/~johanh/rsalowexponent.pdf
http://citeseerx.ist.psu.edu/vie ... p=rep1&type=pdf

(%o1)　C:/maxima-5.43.2/share/maxima/5.43.2/LLL.mac

(%i2)　fx:1131*x^3+14531*x^2+116024*x+57592;
(fx)　$$1131x^3+14531x^2+116024x+57592$$

$$f(x)\equiv 0\pmod{N}$$
(%i3)　N:123107;
(N)　$$123107$$

$$f(x)$$的次數d
(%i4)　d:hipow(fx,x);
(d)　$$3$$

(%i5)　X:floor(N^(2/(d*(d+1))));
(X)　$$7$$

(%i7)
kill(genlattice)$genlattice[i,j]:= if i=1 and j=d+2 then 1/(d+1)/*第1列第d+2行為1/(d+1)*/ else if i=1 then coeff(fx,x,j-1)*X^(j-1)/*第一行為f(x)係數乘上X^(j-1)*/ else if i=j+1 then N*X^(j-1)/*子對角線為NX^(j-1)*/ else 0$/*剩下元素為0*/

(%i8)　latticeB:genmatrix(genlattice,d+2,d+2);
(latticeB)　$$\left[\matrix{\displaystyle 57592&812168&712019&387933&\frac{1}{4}\cr 123107&0&0&0&0\cr 0&861749&0&0&0\cr 0&0&6032243&0&0\cr 0&0&0&42225701&0}\right]$$

(%i9)　latticeB: LLL(latticeB);
(latticeB)　$$\left[\matrix{\displaystyle -9310&13671&-4704&343&5905\cr 9310&-13671&4704&-343&\frac{99487}{4}\cr 85867&54684&-18816&1372&-\frac{28627}{4}\cr -28932&-96173&-263424&19208&-\frac{31457}{4}\cr 44745&-4151&-100499&-432523&\frac{3537}{2}}\right]$$

lattice第一行是整個lattice中較短的向量$$\vec{b_1}$$
(%i10)　b1:latticeB[1];
(b1)　$$[-9310,13671,-4704,343,5905]$$

(%i11)　hx:sum(b1[i+1]/X^i*x^i,i,0,d);
(hx)　$$x^3-96x^2+1953x-9310$$

(%i12)　factor(hx);
(%o12)　$$(x-70)(x-19)(x-7)$$

(%i13)　roots:solve(hx,x);
(roots)　$$[x=7,x=19,x=70]$$

(%i14)
for root in roots do
(print(將,root,代入f(,rhs(root),)=,ev(fx,root),≡0 (mod ,N,))
)$將$$x=7$$代入$$f(7)=1969712\equiv 0 \pmod{123107}$$ 將$$x=19$$代入$$f(19)=15265268\equiv 0 \pmod{123107}$$ 將$$x=70$$代入$$f(70)=467314172\equiv 0 \pmod{123107}$$ 作者: bugmens 時間: 2021-5-10 16:40 使用低次方公鑰$$e$$的RSA傳送線性相關訊息是不安全的，傳送超過$$\displaystyle \frac{e(e+1)}{2}$$個加密訊息能讓破解者回復原本的訊息。 設使用低次方公鑰$$e=3$$，原本訊息$$m$$，在訊息後面串接加密時間$$TimeStamp_i$$當作補綴，計算3次方後同餘$$n_i$$得到密文$$Cipertext_i$$。 $$Cipertext_i=(10000m+TimeStamp_i)^3\pmod{n_i}$$ 當破解者收集超過$$\displaystyle \frac{3\cdot 4}{2}=6$$個密文$$Cipertext_i$$、加密時間$$TimeStamp_i$$和公鑰$$n_i$$，利用前一篇文章的方法可以在多項式時間內回復原本的訊息$$m$$。 此時$$\displaystyle n_1>2^{\frac{(e+1)(e+2)}{4}}(e+1)^{(e+1)}$$，$$n=min(n_i)$$，$$n_i\ge n$$ $$\displaystyle N=\prod_{i=1}^k n_i\ge n_1\prod_{i=2}^{\frac{d(d+1)}{2}+1}n_i>2^{\frac{(e+1)(e+2)}{2}}(e+1)^{(e+1)}n^{\frac{d(d+1)}{2}}$$ 破解者收集到7組密文、加密時間和公鑰 $$TimeStamp_1=$$13點40分產生密文$$Cipertext_1=10117$$，公鑰$$n_1=14857$$ $$TimeStamp_2=$$13點47分產生密文$$Cipertext_2=13166$$，公鑰$$n_2=15397$$ $$TimeStamp_3=$$13點56分產生密文$$Cipertext_3=11707$$，公鑰$$n_3=16199$$ $$TimeStamp_4=$$14點09分產生密文$$Cipertext_4=1590$$，公鑰$$n_4=16463$$ $$TimeStamp_5=$$14點18分產生密文$$Cipertext_5=15758$$，公鑰$$n_5=16171$$ $$TimeStamp_6=$$14點20分產生密文$$Cipertext_6=7371$$，公鑰$$n_6=16157$$ $$TimeStamp_7=$$14點24分產生密文$$Cipertext_7=6303$$，公鑰$$n_7=16241$$ 根據密文和加密時間產生多項式 $$f_i(x)=(10000x+TimeStamp_i)^3-Cipertext_i\pmod{n_i}$$ $$f_1(x)=(10000x+1340)^3-10117\equiv-7380x^3+7136x^2-5462x+2733\pmod{14857}$$ $$f_2(x)=(10000x+1347)^3-13166\equiv1351x^3+7316x^2-5044x-847\pmod{15397}$$ $$f_3(x)=(10000x+1356)^3-11707\equiv-4994x^3+4461x^2-2123x-3373\pmod{16199}$$ $$f_4(x)=(10000x+1409)^3-1590\equiv-7473x^3-3954x^2+4418x-1917\pmod{16463}$$ $$f_5(x)=(10000x+1418)^3-15758\equiv-5245x^3-2021x^2-7211x+1009\pmod{16171}$$ $$f_6(x)=(10000x+1420)^3-7371\equiv1554x^3-2117x^2-1884x+1717\pmod{16157}$$ $$f_7(x)=(10000x+1424)^3-6303\equiv4317x^3+441x^2-301x-5633\pmod{16241}$$ $$\displaystyle N=\prod_{i=1}^7 n_i=258865864180238903908838873371$$ $$X=\lfloor\;N^{2/(d(d+1))}\rfloor\;=79832$$ 利用中國餘數定理計算新的方程式係數 將$$f_i(x)$$的常數項係數以中國餘數定理計算新的常數項$$c_0$$ $$c_0\equiv\cases{2733\pmod{14857}\cr -847\pmod{15397}\cr -3373\pmod{16199}\cr -1917\pmod{16463}\cr 1009\pmod{16171}\cr 1717\pmod{16157}\cr -5633\pmod{16241}}$$，$$c_0\equiv 204373190208566474382317165684\pmod{N}$$ 將$$f_i(x)$$的1次方係數以中國餘數定理計算新的1次方係數$$c_1$$ $$c_1\equiv\cases{-5462\pmod{14857}\cr -5044\pmod{15397}\cr -2123\pmod{16199}\cr 4418\pmod{16463}\cr -7211\pmod{16171}\cr -1884\pmod{16157}\cr -301\pmod{16241}}$$，$$c_1\equiv 249751034306884980399002316934\pmod{N}$$ 將$$f_i(x)$$的2次方係數以中國餘數定理計算新的2次方係數$$c_2$$ $$c_2\equiv\cases{7136\pmod{14857}\cr 7316\pmod{15397}\cr 4461\pmod{16199}\cr -3954\pmod{16463}\cr -2021\pmod{16171}\cr -2117\pmod{16157}\cr 441\pmod{16241}}$$，$$c_2\equiv 189008702173331023044971363347\pmod{N}$$ 將$$f_i(x)$$的3次方係數以中國餘數定理計算新的3次方係數$$c_3$$ $$c_3\equiv\cases{-7380\pmod{14857}\cr 1351\pmod{15397}\cr -4994\pmod{16199}\cr -7473\pmod{16463}\cr -5245\pmod{16171}\cr 1554\pmod{16157}\cr 4317\pmod{16241}}$$，$$c_3\equiv 1000000000000\pmod{N}$$ 產生新的同餘方程式$$g(x)\pmod{N}$$，若$$x=x_0$$是$$g(x)\equiv 0\pmod{N}$$解，那$$x=x_0$$也會是$$f_i(x)\equiv 0\pmod{n_i}$$的解 $$g(x)=c_0+c_1x+c_2x^2+c_3x^3\pmod{N}$$ $$=204373190208566474382317165684+249751034306884980399002316934x+189008702173331023044971363347x^2+1000000000000x^3\pmod{N}$$ 產生lattice，希望能找到較小的解$$x=x_0$$$$(x_0<X=78932)$$ $$B=\left[\matrix{c_0&c_1X&c_2X^2&c_3X^3&\frac{1}{d+1}\cr N&0&0&0&0\cr 0&NX&0&0&0\cr 0&0&NX^2&0&0\cr 0&0&0&NX^3&0}\right]$$ $$\left[\matrix{ 204373190208566474382317165684&19938124570787241755213152965475088&1204580474576509549683162316445791745728&508781169018368000000000000&\frac{1}{4}\cr 258865864180238903908838873371&0&0&0&0\cr 0&20665779669236832176850424938953672&0&0&0\cr 0&0&1649790522554514786342323123726549543104&0&0\cr 0&0&0&131706076996572024423280339613337903125078528&0}\right]$$ 經LLL化簡lattice $$B=\left[\matrix{ 0&0&0&0&\frac{258865864180238903908838873371}{4}\cr 19032544658836594241198114925&-110020730529168337991621111320&-69821420216485869263622535616&-94549927515912701524841700864&-\frac{74058264293788734740876853939}{4}\cr 2056083148951895180465932260&8991794266570450022519459504&-157772457706749993512226999616&88218148052792936245521824256&-\frac{31442973836260991406843209159}{2}\cr 258865864180238903908838873371&0&0&0&0\cr -60101849692113834636025787760&433902895535857979265114013016&-240340197778189487664217294976&-337639116008434960645370124800&-\frac{44674685201276114130186287835}{4}}\right]$$ 第1列向量都是0，改取第2列向量 $$\vec{b_2}=[19032544658836594241198114925,-110020730529168337991621111320,-69821420216485869263622535616,-94549927515912701524841700864,-\frac{74058264293788734740876853939}{4}]$$ 化簡後方程式$$h(x)$$不需要同餘$$N$$ $$\displaystyle h(x)=\frac{19032544658836594241198114925}{X^0}-\frac{110020730529168337991621111320}{X^1}x-\frac{69821420216485869263622535616}{X^2}x^2-\frac{94549927515912701524841700864}{X^3}x^3$$ $$\displaystyle =\frac{19032544658836594241198114925}{79832^0}-\frac{110020730529168337991621111320}{79832^1}x-\frac{69821420216485869263622535616}{79832^2}x^2-\frac{94549927515912701524841700864}{79832^3}x^3$$ $$=19032544658836594241198114925-1378153253446842594343385x-10955561955008732159x^2-185836137957573x^3$$ $$=-(x-12345)(185836137957573x^2+13249709078094970844x+1541720912015925009412565)$$ 得$$x=12345$$ 參考資料 Håstad, J.: Solving Simultaneous Modular Equations of Low Degree. SIAM Journalon Computing 17(2), 336–341 (1988) http://www.csc.kth.se/~johanh/rsalowexponent.pdf http://citeseerx.ist.psu.edu/vie ... p=rep1&type=pdf 註： 原本論文以n代表邊界，但之後的資料改以X表示，本文章也以X表示能找到小於X的解x0。 請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下 要先載入LLL.mac才能使用LLL指令 (%i1) load("LLL.mac"); (%o1) C:/maxima-5.43.2/share/maxima/5.43.2/LLL.mac 有7個密文 (%i2) Cipertext:[10117,13166,11707,1590,15758,7371,6303]; (Cipertext) $$[10117,13166,11707,1590,15758,7371,6303]$$ 有7個公鑰$$n_i$$ (%i3) n:[14857,15397,16199,16463,16171,16157,16241]; (n) $$[14857,15397,16199,16463,16171,16157,16241]$$ 有7個時戳 (%i4) Timestamp:[1340,1347,1356,1409,1418,1420,1424]; (Timestamp) $$[1340,1347,1356,1409,1418,1420,1424]$$ 公鑰$$e$$ (%i5) e:3; (e) 3 同餘方程式最高次方$$d$$ (%i6) d:e; (d) 3 根據密文和時戳產生同餘方程式$$f_i(x)$$ (%i7) fx:create_list(polymod((10000*x+Timestamp[ i ])^3-Cipertext[ i ],n[ i ]),i,1,length(n)); (fx) $$\matrix{[-7380x^3+7136x^2-5462x+2733,\cr 1351x^3+7316x^2-5044x-847,\cr -4994x^3+4461x^2-2123x-3373,\cr -7473x^3-3954x^2+4418x-1917,\cr -5245x^3-2021x^2-7211x+1009,\cr 1554x^3-2117x^2-1884x+1717,\cr 4317x^3+441x^2-301x-5633]}$$ $$f_i(x)$$的常數項係數 (%i8) a0:create_list(coeff(fx[ i ],x,0),i,1,length(n)); (a0) $$[2733,-847,-3373,-1917,1009,1717,-5633]$$ $$f_i(x)$$的1次方係數 (%i9) a1:create_list(coeff(fx[ i ],x,1),i,1,length(n)); (a1) $$[-5462,-5044,-2123,4418,-7211,-1884,-301]$$ $$f_i(x)$$的2次方係數 (%i10) a2:create_list(coeff(fx[ i ],x,2),i,1,length(n)); (a2) $$[7136,7316,4461,-3954,-2021,-2117,441]$$ $$f_i(x)$$的3次方係數 (%i11) a3:create_list(coeff(fx[ i ],x,3),i,1,length(n)); (a3) $$[-7380,1351,-4994,-7473,-5245,1554,4317]$$ 利用中國餘數定理計算新的常數項$$c_0$$ (%i12) c0:chinese(a0,n); (c0) $$204373190208566474382317165684$$ 利用中國餘數定理計算新的1次方係數$$c_1$$ (%i13) c1:chinese(a1,n); (c1) $$249751034306884980399002316934$$ 利用中國餘數定理計算新的2次方係數$$c_2$$ (%i14) c2:chinese(a2,n); (c2) $$189008702173331023044971363347$$ 利用中國餘數定理計算新的3次方係數$$c_3$$ (%i15) c3:chinese(a3,n); (c3) $$1000000000000$$ 產生新的同餘方程式$$g(x)\pmod{N}$$，若$$x=x_0$$是$$g(x)\equiv 0\pmod{N}$$的解，那$$x=x_0$$也會是$$f_i(x)\equiv 0\pmod{n_i}$$的解 (%i16) gx:c0+c1*x+c2*x^2+c3*x^3; (gx) $$1000000000000x^3+189008702173331023044971363347x^2+249751034306884980399002316934x+204373190208566474382317165684$$ $$N=\prod_{i=1}^7 n_i$$ (%i17) N:product(n[ i ],i,1,length(n)); (N) $$258865864180238903908838873371$$ 希望能找到$$|\;x_0|\;<X=\lfloor\;N^{2/(d(d+1))} \rfloor\;，g(x_0)\equiv 0\pmod{N}$$ (%i18) X:floor(N^(2/(d*(d+1)))); (X) $$79832$$ 定義lattice產生方式 (%i20) kill(genlattice)$
genlattice[i,j]:=
if i=1 and j=d+2 then 1/(d+1)/*第1列第d+2行為1/(d+1)*/
else if i=1 then coeff(gx,x,j-1)*X^(j-1)/*第一行為f(x)係數乘上X^(j-1)*/
else if i=j+1 then N*X^(j-1)/*子對角線為NX^(j-1)*/
else 0$/*剩下元素為0*/ 根據$$g(x)$$係數，產生lattice (%i21) latticeB:genmatrix(genlattice,d+2,d+2); (latticeB) $$\left[\matrix{ 204373190208566474382317165684&19938124570787241755213152965475088&1204580474576509549683162316445791745728&508781169018368000000000000&\frac{1}{4}\cr 258865864180238903908838873371&0&0&0&0\cr 0&20665779669236832176850424938953672&0&0&0\cr 0&0&1649790522554514786342323123726549543104&0&0\cr 0&0&0&131706076996572024423280339613337903125078528&0}\right]$$ 經LLL化簡後的lattice B (%i22) latticeB: LLL(latticeB); (latticeB) $$\left[\matrix{ 0&0&0&0&\frac{258865864180238903908838873371}{4}\cr 19032544658836594241198114925&-110020730529168337991621111320&-69821420216485869263622535616&-94549927515912701524841700864&-\frac{74058264293788734740876853939}{4}\cr 2056083148951895180465932260&8991794266570450022519459504&-157772457706749993512226999616&88218148052792936245521824256&-\frac{31442973836260991406843209159}{2}\cr 258865864180238903908838873371&0&0&0&0\cr -60101849692113834636025787760&433902895535857979265114013016&-240340197778189487664217294976&-337639116008434960645370124800&-\frac{44674685201276114130186287835}{4}}\right]$$ 第1列向量都是0，改取第2列向量 (%i23) b2:latticeB[2]; (b2) $$[19032544658836594241198114925,-110020730529168337991621111320,-69821420216485869263622535616,-94549927515912701524841700864,-\frac{74058264293788734740876853939}{4}]$$ 化簡後方程式$$h(x)$$不需要同餘$$N$$ (%i24) hx:sum(b2[i+1]/X^i*x^i,i,0,d); (hx) $$-185836137957573x^3-10955561955008732159x^2-1378153253446842594343385x+19032544658836594241198114925$$ 將h(x)因式分解 (%i25) factor(hx); (%o25) $$-(x-12345)(185836137957573x^2+13249709078094970844x+1541720912015925009412565)$$ 得到較小的解$$x$$ (%i26) x:12345; (x) $$12345$$ 驗證答案$$f_i(12345)\equiv 0 \pmod{n_i}$$ (%i27) create_list(mod(ev(fx[ i ],x=x),n[ i ]),i,1,length(n)); (%o27) $$[0,0,0,0,0,0,0]$$ 作者: bugmens 時間: 2021-5-22 00:05 Rabin加密法請參閱wiki。https://en.wikipedia.org/wiki/Rabin_cryptosystem  公式 範例 產生金鑰 1.選擇兩個不相同的大質數$$p$$和$$q$$，其中$$p\equiv 3\pmod{4}$$和$$q\equiv 3\pmod{4}$$ 2.計算$$n=pq$$ $$n$$是公鑰和$$(p,q)$$是私鑰 私鑰$$p=7$$和$$q=11$$ 公鑰$$n=77$$ 加密 訊息$$M$$轉換成數字$$m$$($$m 使用Rabin加密函數傳送線性相關訊息是不安全的，傳送3個加密訊息能讓破解者在多項式時間內回復原本的訊息。 設原本訊息\(m$$，在訊息後面串接加密時間$$TimeStamp_i$$當作補綴，計算2次方後同餘$$n_i$$得到密文$$Cipertext_i$$。 $$Cipertext_i=(10000m+TimeStamp_i)^2\pmod{n_i}$$ 破解者收集到3組密文、加密時間和公鑰 $$TimeStamp_1=$$13點40分產生密文$$Cipertext_1=5926$$，公鑰$$n_1=14857$$ $$TimeStamp_2=$$13點47分產生密文$$Cipertext_2=3031$$，公鑰$$n_2=15397$$ $$TimeStamp_3=$$13點56分產生密文$$Cipertext_3=5421$$，公鑰$$n_3=16199$$ 根據密文和加密時間產生多項式 $$f_i(x)=(10000x+TimeStamp_i)^2-Cipertext_i\pmod{n_i}$$ $$f_1(x)=-2467x^2-2028x+6834\pmod{14857}$$ $$f_2(x)=-3515x^2-4750x-5468\pmod{15397}$$ $$f_3(x)=3573x^2+2874x+2828\pmod{16199}$$ $$\displaystyle N=\prod_{i=1}^3 n_i=3705573556571$$ $$X=\lfloor\;N^{2/(d(d+1))}\rfloor\;=15474$$ 利用中國餘數定理計算新的方程式係數 將$$f_i(x)$$的常數項係數以中國餘數定理計算新的常數項$$c_0$$ $$c_0\equiv\cases{6834\pmod{14857}\cr -5468\pmod{15397}\cr 2828\pmod{16199}}$$，$$c_0\equiv 489114568907 \pmod{N}$$ 將$$f_i(x)$$的1次方係數以中國餘數定理計算新的1次方係數$$c_1$$ $$c_1\equiv\cases{-2028 \pmod{14857}\cr -4750\pmod{15397}\cr 2874\pmod{16199}}$$，$$c_1\equiv 3243065948060 \pmod{N}$$ 將$$f_i(x)$$的2次方係數以中國餘數定理計算新的2次方係數$$c_1$$ $$c_2\equiv\cases{-2467 \pmod{14857}\cr -3515\pmod{15397}\cr 3573\pmod{16199}}$$，$$c_2\equiv 100000000 \pmod{N}$$ 產生新的同餘方程式$$g(x)\pmod{N}$$，若$$x=x_0$$是$$g(x)\equiv 0\pmod{N}$$解，那$$x=x_0$$也會是$$f_i(x)\equiv 0\pmod{n_i}$$的解 $$g(x)=c_0+c_1x+c_2x^2\pmod{N}$$ $$=489114568907+3243065948060x+100000000x^2\pmod{N}$$ 產生lattice，希望能找到較小的解$$x=x_0$$$$(x_0<X=15474)$$ $$B=\left[\matrix{c_0&c_1X&c_2X^2&\frac{1}{d+1}\cr N&0&0&0\cr 0&NX&0&0\cr 0&0&NX^2&0}\right]$$ $$\left[\matrix{489114568907&50183202480280440&23944467600000000&\frac{1}{3}\cr 3705573556571&0&0&0\cr 0&57340045214379654&0&0\cr 0&0&887279859647310765996&0}\right]$$ 經LLL化簡lattice $$B=\left[\matrix{0&0&0&\frac{3705573556571}{3}\cr 3705573556571&0&0&0\cr -705084292305&-1585793949534&3095540771328&\frac{167522755129}{3}\cr 233266894054&-3534864776520&-1757763366516&240304851747}\right]$$ 第1,2列向量都有0，改取第3列向量 $$\displaystyle \vec{b_3}=[-705084292305,-1585793949534,3095540771328,\frac{167522755129}{3}]$$ 化簡後方程式$$h(x)$$不需要同餘$$N$$ $$\displaystyle h(x)=-\frac{705084292305}{X^0}-\frac{1585793949534}{X^1}x+\frac{3095540771328}{X^2}x^2$$ $$\displaystyle =-\frac{705084292305}{15474^0}-\frac{1585793949534}{15474^1}x+\frac{3095540771328}{15474^2}x^2$$ $$=-705084292305-102481191x+12928x^2$$ $$=(x-12345)(12928x+57114969)$$ 得$$x=12345$$ 參考資料 Håstad, J.: Solving Simultaneous Modular Equations of Low Degree. SIAM Journalon Computing 17(2), 336–341 (1988) http://www.csc.kth.se/~johanh/rsalowexponent.pdf http://citeseerx.ist.psu.edu/vie ... p=rep1&type=pdf 註： 原本論文以n代表邊界，但之後的資料改以X表示，本文章也以X表示能找到小於X的解x0。 請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下 要先載入LLL.mac才能使用LLL指令 (%i1) load("LLL.mac"); (%o1) C:/maxima-5.43.2/share/maxima/5.43.2/LLL.mac 有3個密文 (%i2) Cipertext:[5926,3031,5421]; (Cipertext) $$[5926,3031,5421]$$ 有3個公鑰$$n_i$$ (%i3) n:[14857,15397,16199]; (n) $$[14857,15397,16199]$$ 有3個時戳 (%i4) Timestamp:[1340,1347,1356]; (Timestamp) $$[1340,1347,1356]$$ 同餘方程式最高次方$$d$$ (%i5) d:2; (d) 2 根據密文和時戳產生同餘方程式$$f_i(x)$$ (%i6) fx:create_list(polymod((10000*x+Timestamp[ i ])^3-Cipertext[ i ],n[ i ]),i,1,length(n)); (fx) $$\matrix{[-2467x^2-2028x+6834,\cr -3515x^2-4750x-5468,\cr 3573x^2+2874x+2828]}$$ $$f_i(x)$$的常數項係數 (%i7) a0:create_list(coeff(fx[ i ],x,0),i,1,length(n)); (a0) $$[6834,-5468,2828]$$ $$f_i(x)$$的1次方係數 (%i8) a1:create_list(coeff(fx[ i ],x,1),i,1,length(n)); (a1) $$[-2028,-4750,2874]$$ $$f_i(x)$$的2次方係數 (%i9) a2:create_list(coeff(fx[ i ],x,2),i,1,length(n)); (a2) $$[-2467,-3515,3573]$$ 利用中國餘數定理計算新的常數項$$c_0$$ (%i10) c0:chinese(a0,n); (c0) $$489114568907$$ 利用中國餘數定理計算新的1次方係數$$c_1$$ (%i11) c1:chinese(a1,n); (c1) $$3243065948060$$ 利用中國餘數定理計算新的2次方係數$$c_2$$ (%i12) c2:chinese(a2,n); (c2) $$100000000$$ 產生新的同餘方程式$$g(x)\pmod{N}$$，若$$x=x_0$$是$$g(x)\equiv 0\pmod{N}$$的解，那$$x=x_0$$也會是$$f_i(x)\equiv 0\pmod{n_i}$$的解 (%i13) gx:c0+c1*x+c2*x^2+c3*x^3; (gx) $$100000000x^2+3243065948060x+489114568907$$ $$\displaystyle N=\prod_{i=1}^3 n_i$$ (%i14) N:product(n[ i ],i,1,length(n)); (N) $$3705573556571$$ 希望能找到$$|\;x_0|\;<X=\lfloor\;N^{2/(d(d+1))} \rfloor\;，g(x_0)\equiv 0\pmod{N}$$ (%i15) X:floor(N^(2/(d*(d+1)))); (X) $$15474$$ 定義lattice產生方式 (%i17) kill(genlattice)$
genlattice[i,j]:=
if i=1 and j=d+2 then 1/(d+1)/*第1列第d+2行為1/(d+1)*/
else if i=1 then coeff(gx,x,j-1)*X^(j-1)/*第一行為f(x)係數乘上X^(j-1)*/
else if i=j+1 then N*X^(j-1)/*子對角線為NX^(j-1)*/
else 0$/*剩下元素為0*/ 根據$$g(x)$$係數，產生lattice (%i18) latticeB:genmatrix(genlattice,d+2,d+2); (latticeB) $$\left[\matrix{ 489114568907&50183202480280440&23944467600000000&\frac{1}{3}\cr 3705573556571&0&0&0\cr 0&57340045214379654&0&0\cr 0&0&887279859647310765996&0}\right]$$ 經LLL化簡後的lattice B (%i19) latticeB: LLL(latticeB); (latticeB) $$\left[\matrix{\displaystyle 0&0&0&\frac{3705573556571}{3}\cr 3705573556571&0&0&0\cr -705084292305&-1585793949534&3095540771328&\frac{167522755129}{3}\cr 233266894054&-3534864776520&-1757763366516&240304851747}\right]$$ 第1,2列向量都有0，改取第3列向量 (%i20) b3:latticeB[3]; (b3) $$\displaystyle [-705084292305,-1585793949534,3095540771328,\frac{167522755129}{3}]$$ 化簡後方程式$$h(x)$$不需要同餘$$N$$ (%i21) hx:sum(b2[i+1]/X^i*x^i,i,0,d); (hx) $$12928x^2-102481191x-705084292305$$ 將$$h(x)$$因式分解 (%i22) factor(hx); (%o22) $$(x-12345)(12928x+57114969)$$ 得到較小的解$$x$$ (%i23) x:12345; (x) $$12345$$ 驗證答案$$f_i(12345)\equiv 0 \pmod{n_i}$$ (%i24) create_list(mod(ev(fx[ i ],x=x),n[ i ]),i,1,length(n)); (%o24) $$[0,0,0]$$ 作者: bugmens 時間: 2021-6-6 21:25  Håstad方法 Coppersmith方法 可以找出比邊界$$X$$還小的解$$x_0$$($$\displaystyle |\;x_0|\; 上面是Håstad和Coppersmith所用的lattice比較表，Håstad僅針對一個方程式\(h(x_0)=sf(x_0)\pmod{N}$$來產生lattice，而Coppersmith增加方程式個數，產生更大的lattice雖然增加LLL執行時間，但能提高解的上界。 $$f(x_0)-y_0N=0$$ $$x_0f(x_0)-x_0y_0N=0$$ $$(f(x_0))^2-y_0^2N^2=0$$ $$x_0(f(x_0))^2-x_0y_0^2N^2=0$$ Coppersmith方法如下：  方法 範例 問題敘述 設同餘方程式為$$p(x)=x^k+a_{k-1}x^{k-1}+\ldots+a_1 x+a_0\equiv 0 \pmod{N}$$ 且$$p(x)$$為monic(最高次方項係數為1)且不可分解。 利用LLL方法可以找出比邊界$$X$$還小的解$$x_0$$($$\displaystyle |\;x_0|\;2^{-\frac{(hk-1)}{2}}$$ $$\displaystyle det(\widehat{M})>(N^{h-1}X^{-(hk-1)}2^{-\frac{(hk-1)}{2}})^{\frac{hk}{2}}$$ 設$$\displaystyle X=\frac{1}{2}N^{\frac{1}{k}-\epsilon}$$，可推得$$\displaystyle X^{-1}=2N^{-(\frac{1}{k}-\epsilon)}$$，$$\displaystyle X^{-(hk-1)}=2^{hk-1}N^{-(hk-1)(\frac{1}{k}-\epsilon)}$$ $$\displaystyle det(\widehat{M})>(N^{n-1-(hk-1)(\frac{1}{k}-\epsilon)}\cdot 2^{+\frac{(hk-1)}{2}})^{\frac{hk}{2}}$$ 設$$\displaystyle n-1\ge (hk-1)(\frac{1}{k}-\epsilon)$$ $$\displaystyle det(\widehat{M})>(N^0\cdot 2^{+\frac{(hk-1)}{2}})2^{\frac{hk}{2}}=2^{\frac{(hk)(hk-1)}{4}}$$ 設$$n=hk=dim(\widehat{M})$$ $$\displaystyle det(\widehat{M})>2^{\frac{n(n-1)}{4}}$$ $$\displaystyle det(\widehat{M})^{\frac{1}{n}}>2^{\frac{n-1}{4}}$$ $$\displaystyle det(\widehat{M})^{\frac{1}{n}}\cdot 2^{-\frac{n-1}{4}}>1$$ 由步驟2結論可知向量$$s$$長度小於1($$1>\Vert\;s\Vert\;$$) 得到$$\displaystyle det(\widehat(M))^{\frac{1}{n}}\cdot 2^{-\frac{n-1}{4}}>\Vert\;s\Vert\;$$ 將右上角化簡為零 $$\widetilde{M}=\left[\matrix{\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr &\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr &&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}\cr &&&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}\cr &&&&\frac{1}{16}&-\frac{7}{8}\cr &&&&&\frac{1}{32}}&\matrix{│\cr│\cr│\cr│\cr│\cr│}&\matrix{\displaystyle 0&0&0&0\cr 0&0&0&0\cr 1&0&0&0\cr &1&0&0\cr &&1&0\cr &&&1}\cr ――――――――――――――&┼&―――――――――\cr \matrix{0}&\matrix{│\cr│\cr│\cr│}&\matrix{35&&&\cr&35&&\cr&&1225&\cr&&&1225}}\right]$$ 將右下角化簡為零 $$\widetilde{M}=\left[\matrix{\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr &\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr &&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}\cr &&&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}\cr &&&&\frac{1}{16}&-\frac{7}{8}\cr &&&&&\frac{1}{32}}&\matrix{│\cr│\cr│\cr│\cr│\cr│}&\matrix{\displaystyle 0&0&0&0\cr 0&0&0&0\cr 1&0&0&0\cr &1&0&0\cr &&1&0\cr &&&1}\cr ――――――――――――――&┼&―――\cr \matrix{\displaystyle &&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&-\frac{3675}{2}\cr &&&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr &&&&-\frac{1225}{16}&-\frac{8575}{8}\cr &&&&&-\frac{1225}{32}}&\matrix{│\cr│\cr│\cr│}&\matrix{0&&&\cr&0&&\cr&&0&\cr&&&0}}\right]$$ 將對角線元素為1的一整列移到整個矩陣下方 $$\widetilde{M}=\left[\matrix{\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr &\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr &&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&-\frac{3675}{2}\cr &&&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr &&&&-\frac{1225}{16}&-\frac{8575}{8}\cr &&&&&-\frac{1225}{32}}&\matrix{│\cr│\cr│\cr│\cr│\cr│}&\matrix{\displaystyle 0&0&0&0\cr 0&0&0&0\cr 0&0&0&0\cr &0&0&0\cr &&0&0\cr &&&0}\cr ――――――――――――――&┼&―――\cr \matrix{\displaystyle & &\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}\cr &&&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}\cr &&&&\frac{1}{16}&-\frac{7}{8}\cr &&&&&\frac{1}{32}\cr}&\matrix{│\cr│\cr│\cr│}&\matrix{1&&&\cr&1&&\cr&&1&\cr&&&1}}\right]$$ 得到左上角矩陣$$\widehat{M}$$ $$\widehat{M}=\left[\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr &\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr &&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&-\frac{3675}{2}\cr &&&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr &&&&-\frac{1225}{16}&-\frac{8575}{8}\cr &&&&&-\frac{1225}{32}}\right]$$ $$\displaystyle det(\widehat{M})=1\cdot \frac{1}{2}\cdot \frac{-35}{4}\cdot \frac{-35}{8}\cdot \frac{-1225}{16}\cdot \frac{-1225}{35}$$ $$\displaystyle =2^{-15}35^6$$ $$\widehat{M}$$乘32倍變成整數 $$\widehat{M}=\left[\matrix{ 32&0&-152&1064&-6726&42028\cr &16&-112&708&-4424&27605\cr &&-280&1960&-11060&58800\cr &&&-140&1960&-19250\cr &0&&&-2450&34300\cr &&&&&-1225}\right]$$ 步驟4：經LLL化簡和Gram-Schmidt正交化後得到不需要同餘$$N$$的方程式 矩陣$$\widehat{M}$$經LLL化簡為$$B$$ $$B=LLL(\widehat{M})$$ 矩陣$$B$$經Gram-Schmidt正交化得到$$B^{*}$$ $$B^{*}=$$Gram-Schmidt$$(B)$$ －－－－－－－－－－－－－－－－－－－ 引理1： 假設lattice $$L$$經LLL化簡後向量為$$b_1,b_2,\ldots,b_n$$，經Gram-Schmidt化簡後向量為$$b_1^{*},b_2^{*},\ldots,b_n^{*}$$，則$$\displaystyle \Vert\;b_n^{*}\Vert\;\ge det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}$$。 [證明] $$\displaystyle det(L)^2=\prod_{i=1}^n \Vert\;b_i^{*}\Vert\;^2=\Vert\;b_1^{*}\Vert\;^2 \Vert\;b_2^{*}\Vert\;^2\cdot \Vert\;b_n^{*}\Vert\;^2$$ 經LLL化簡後向量長度滿足$$\Vert\;b_i^{*}\Vert\;^2\le 2\Vert\;b_{i+1}^{*}\Vert\;^2$$ $$(i=1,2,\ldots,n-1)$$ $$\displaystyle det(L)^2 \le \left(2^{n-1}\Vert\;b_n^{*}\Vert\;^2\right)\left(2^{n-2}\Vert\;b_n^{*}\Vert\;^2\right)\ldots \left(\Vert\;b_n^{*}\Vert\;^2\right)\left(\Vert\;b_n^{*}\Vert\;^2\right)$$ $$\displaystyle det(L)^2 \le 2^{\frac{n(n-1)}{2}}\Vert\;b_n^{*}\Vert\;^{2n}$$ $$\displaystyle \Vert\;b_n^{*}\Vert\;^{2n}\ge det(L)^2 2^{-\frac{n(n-1)}{2}}$$ 兩邊各加上$$\displaystyle \frac{1}{2n}$$次方$$\Vert\;b_n^{*}\Vert\;\ge det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}$$ 引理2： 假設lattice $$L$$其中一個元素$$s$$滿足$$\displaystyle det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}>\Vert\;s\Vert\;$$，則$$s$$會落在由$$b_1,b_2,\ldots,b_{n-1}$$所展開的超平面上。 [證明] 將lattice 元素$$s$$表示成$$b_1,b_2,\ldots,b_n$$的線性組合$$\displaystyle s=\sum_{i=1}^n a_ib_i$$，其中$$a_i$$是整數 向量長度$$\Vert\;s\Vert\;=\Vert\;a_1b_1+a_2b_2+\ldots+a_nb_n\Vert\;\ge \Vert\;a_nb_n\Vert\;=|\;a_n|\;\Vert\;b_n\Vert\;\ge |\;a_n|\;\Vert\;b_n^{*}\Vert\;$$ 由引理1可知$$\Vert\;b_n^{*}\Vert\;\ge det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}$$、$$\displaystyle det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}>\Vert\;s\Vert\;$$和 $$\Vert\;s\Vert\;\ge |\;a_n|\;\Vert\;b_n^{*}\Vert\;$$，得到$$\Vert\;b_n^{*}\Vert\;>|\;a_n|\;\Vert\;b_n^{*}\Vert\;$$，$$a_n=0$$ $$s$$可表示成$$b_1,b_2,\ldots,b_{n-1}$$的線性組合，$$s$$落在由$$b_1,b_2,\ldots,b_{n-1}$$所展開的超平面上。 －－－－－－－－－－－－－－－－－－－ $$\displaystyle s=\left[1,\delta \frac{x_0}{X},\ldots,\delta\left(\frac{x_0}{X}\right)^{hk-1}\right]$$是lattice$$\widehat{M}$$的向量元素， 由步驟3結論可知$$\displaystyle det(\widehat{M})^{\frac{1}{n}}2^{-\frac{n-1}{4}}>\Vert\;s\Vert\;$$ 由上面引理2可知$$s$$落在由$$b_1,b_2,\ldots,b_{n-1}$$所展開的超平面上。 而這個超平面會和Gram-Schmidt的向量$$b_n^{*}$$正交，得到$$s\cdot b_n^{*}=0$$，可得到一個不需要同餘$$N$$的方程式。 LLL化簡 $$B=\left[\matrix{0&160&0&-60&0&-100\cr -64&-64&-88&80&-72&-51\cr 64&-48&32&4&-180&16\cr 128&-80&-48&16&116&-13\cr -32&-96&-16&-132&90&-108\cr -64&-32&248&96&-30&-141}\right]$$ Gram-Schmidt正交化 $$B^{*}=\left[\matrix{\displaystyle 0&160&0&-60&0&-100\cr -64&-\frac{164}{7}&-88&\frac{907}{14}&-72&-\frac{1069}{14}\cr \frac{4327744}{55201}&-\frac{213712}{55201}&\frac{2859392}{55201}&-\frac{1388192}{55201}&-\frac{9041940}{55201}&\frac{490976}{55201}\cr \frac{2396089600}{17933807}&-\frac{673016640}{17933807}&-\frac{1044380280}{17933807}&\frac{154688960}{17933807}&\frac{745216000}{17933807}&-\frac{1169640000}{17933807}\cr -\frac{2184694400}{45963969}&-\frac{1521655800}{15321323}&\frac{344724800}{15321323}&-\frac{6338718400}{45963969}&\frac{172362400}{45963969}&-\frac{1166905600}{15321323}\cr -\frac{117600}{17929}&-\frac{627200}{17929}&\frac{3763200}{17929}&\frac{2508800}{17929}&\frac{627200}{17929}&-\frac{2508800}{17929}}\right]$$ 取最後一列向量乘上$$\displaystyle \frac{17929}{39200}$$變成整數 $$[−3, −16, 96, 64, 16, −64]$$ 形成不需要再同餘$$N$$的方程式 $$\displaystyle h(x)=-3-16\left(\frac{x}{2}\right)+96\left(\frac{x}{2}\right)^2+64\left(\frac{x}{2}\right)^3+16\left(\frac{x}{2}\right)^4-64\left(\frac{x}{2}\right)^5$$ $$=-3-8x+24x^2+8x^3+x^4-2x^5$$ $$=-(x-3)(2x-1)(x^3+3x^2+5x+1)$$ 解方程式得到答案 $$x=3$$ 參考資料： D. Coppersmith. Finding a small root of a univariate modular equation. In Proceedings of Eurocrypt 1996, volume 1070 of Lecture Notes in Computer Science, pages 155–165. Springer, 1996. https://link.springer.com/chapter/10.1007/3-540-68339-9_14 N. Howgrave-Graham. Finding small roots of univariate modular equations revisited. In Cryptography and Coding– Proc. IMA ’97, volume 1355 of Lecture Notes in Computer Science, pages 131–142. Springer, 1997. https://link.springer.com/chapter/10.1007/BFb0024458 有二次同餘方程式範例 Finding Small Roots of Polynomial Equations Using Lattice Basis Reduction https://ntnuopen.ntnu.no/ntnu-xm ... e=1&isAllowed=y 有三次同餘方程式範例 Lattice Basis Reduction：An Introduction to the LLL Algorithm and Its Applications https://www.routledge.com/Lattic ... /book/9781439807026 有一整章關於Coppersmith方法的介紹 請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下 要先載入LLL.mac才能使用LLL指令 (%i1) load("LLL.mac"); (%o1) C:/maxima-5.43.2/share/maxima/5.43.2/share/LLL.mac 要先載入eigen.mac才能使用gramschmidt指令 (%i2) load("eigen.mac"); (%o2) C:/maxima-5.43.2/share/maxima/5.43.2/share/matrix/eigen.mac 要先載入diag.mac才能使用diag指令 (%i3) load("diag.mac"); (%o3) C:/maxima-5.43.2/share/maxima/5.43.2/share/contrib/diag.mac 同餘方程式$$p(x)$$ (%i4) px:x^2+14*x+19; (px) $$x^2+14x+19$$ $$p(x)\equiv 0\pmod{N}$$ (%i5) N:35; (N) $$35$$ $$p(x)$$的次數$$k$$ (%i6) k:hipow(px,x); (k) $$2$$ 設誤差值$$\epsilon=0.1$$ (%i7) epsilon:0.1; (epsilon) $$0.1$$ 參數$$h$$，按照公式應該是$$h=4$$，但$$h=3$$也能算出來 (%i9) h:ceiling(max(7/k,(k+epsilon*k-1)/(epsilon*k^2))); h:3; (h) 4 (h) 3 $$\widehat{M}$$的維度$$n=hk$$ (%i10) n:h*k; (n) 6 參數$$\delta$$，按照公式應該是$$\displaystyle \delta=\frac{1}{\sqrt{6}}$$，改成$$\delta=1$$方便計算 (%i12) delta:1/sqrt(h*k); delta:1; (delta) $$\displaystyle \frac{1}{\sqrt{6}}$$ (delta) 1 希望能找到$$|\;x|\;<X=\frac{1}{2}N^{1/k}$$，$$p(x)\equiv 0\pmod{N}$$ (%i13) X:floor(1/2*N^(1/k)); (X) 2 左上角矩陣對角線元素$$\delta X^{-i}$$ (%i14) Xpower:create_list(delta*X^-(i-1),i,1,h*k); (Xpower) $$\displaystyle \left[1,\frac{1}{2},\frac{1}{4},\frac{1}{8},\frac{1}{16},\frac{1}{32}\right]$$ 左上角矩陣 (%i15) D1:diag(Xpower); (D1) $$\left[\matrix{\displaystyle 1&0&0&0&0&0\cr 0&\frac{1}{2}&0&0&0&0\cr 0&0&\frac{1}{4}&0&0&0\cr 0&0&0&\frac{1}{8}&0&0\cr 0&0&0&0&\frac{1}{16}&0\cr 0&0&0&0&0&\frac{1}{32}}\right]$$ 多項式$$x^u\cdot p(x)^v$$ (%i16) xpxpower:create_list(x^u*px^v,v,1,h-1,u,0,k-1); (xpxpower) $$[x^2+14x+19,x(x^2+14x+19),(x^2+14x+19)^2,x(x^2+14x+19)^2]$$ $$x^1,x^2,\ldots,x^{n-1}$$ (%i17) xpower:create_list(x^i,i,1,n-1); (xpower) $$[x,x^2,x^3,x^4,x^5]$$ 取多項式$$x^u\cdot p(x)^v$$係數，形成右上角矩陣(常數項在最後一行) (%i18) A:augcoefmatrix(xpxpower,xpower); (A) $$\left[\matrix{14&1&0&0&0&19\cr 19&14&1&0&0&0\cr 532&234&28&1&0&361\cr 361&532&234&28&1&0}\right]$$ 將常數項移到第一行 (%i19) A:addcol(col(A,h*k),submatrix(A,h*k)); (A) $$\left[ \matrix{ 19&14&1&0&0&0\cr 0&19&14&1&0&0\cr 361&532&234&28&1&0\cr 0&361&532&234&28&1}\right]$$ 矩陣$$A$$轉置 (%i20) A:transpose(A); (A) $$\left[ \matrix{ 19&0&361&0\cr 14&19&532&361\cr 1&14&234&532\cr 0&1&28&234\cr 0&0&1&28\cr 0&0&0&1}\right]$$ 左下角0矩陣 (%i21) Zero:zeromatrix((h-1)*k,h*k); (Zero) $$\left[ \matrix{ 0&0&0&0&0&0\cr 0&0&0&0&0&0\cr 0&0&0&0&0&0\cr 0&0&0&0&0&0}\right]$$ 右下角矩陣元素$$N^v$$ (%i22) Npower:create_list(N^v,v,1,h-1,u,0,k-1); (Npower) $$[35,35,1225,1225]$$ 右下角矩陣 (%i23) D2:diag(Npower); (D2) $$\left[ \matrix{ 35&0&0&0\cr 0&35&0&0\cr 0&0&1225&0\cr 0&0&0&1225}\right]$$ 4個子矩陣合併成矩陣$$M$$ (%i24) M:addrow(addcol(D1,A),addcol(Zero,D2)); (M) $$\left[ \matrix{\displaystyle 1&0&0&0&0&0&19&0&361&0\cr 0&\frac{1}{2}&0&0&0&0&14&19&532&361\cr 0&0&\frac{1}{4}&0&0&0&1&14&234&532\cr 0&0&0&\frac{1}{8}&0&0&0&1&28&234\cr 0&0&0&0&\frac{1}{16}&0&0&0&1&28\cr 0&0&0&0&0&\frac{1}{32}&0&0&0&1\cr 0&0&0&0&0&0&35&0&0&0\cr 0&0&0&0&0&0&0&35&0&0\cr 0&0&0&0&0&0&0&0&1225&0\cr 0&0&0&0&0&0&0&0&0&1225}\right]$$ 將矩陣$$M$$複製成另一個矩陣$$\widetilde{M}$$，進行矩陣列運算 (%i25) M_tilde:copymatrix(M)$

(%i27)
for i:k+1 thru n do
(for j:1 thru i-1 do
(print("第",j,"列=第",j,"列-",M_tilde[j,i+n-k],"*第",i,"列=",
M_tilde[j]:M_tilde[j]-M_tilde[j,i+n-k]*M_tilde[ i ])
)
)$M_tilde; 第1列=第1列-19*第3列$$\displaystyle =[1,0,-\frac{19}{4},0,0,0,0,-266,-4085,-10108]$$ 第2列=第2列-14*第3列$$\displaystyle =[0,\frac{1}{2},-\frac{7}{2},0,0,0,0,-177,-2744,-7087]$$ 第1列=第1列--266*第4列$$\displaystyle =[1,0,-\frac{19}{4},\frac{133}{4},0,0,0,0,3363,52136]$$ 第2列=第2列--177*第4列$$\displaystyle =[0,\frac{1}{2},-\frac{7}{2},\frac{177}{8},0,0,0,0,2212,34331]$$ 第3列=第3列-14*第4列$$\displaystyle =[0,0,\frac{1}{4},-\frac{7}{4},0,0,1,0,-158,-2744]$$ 第1列=第1列-3363*第5列$$\displaystyle =[1,0,-\frac{19}{4},\frac{133}{4},-\frac{3363}{16},0,0,0,0,-42028]$$ 第2列=第2列-2212*第5列$$\displaystyle =[0,\frac{1}{2},-\frac{7}{2},\frac{177}{8},-\frac{553}{4},0,0,0,0,-27605]$$ 第3列=第3列--158*第5列$$\displaystyle =[0,0,\frac{1}{4},-\frac{7}{4},\frac{79}{8},0,1,0,0,1680]$$ 第4列=第4列-28*第5列$$\displaystyle =[0,0,0,\frac{1}{8},-\frac{7}{4},0,0,1,0,-550]$$ 第1列=第1列--42028*第6列$$\displaystyle =[1,0,-\frac{19}{4},\frac{133}{4},-\frac{3363}{16},\frac{10507}{8},0,0,0,0]$$ 第2列=第2列--27605*第6列$$\displaystyle =[0,\frac{1}{2},-\frac{7}{2},\frac{177}{8},-\frac{553}{4},\frac{27605}{32},0,0,0,0]$$ 第3列=第3列-1680*第6列$$\displaystyle =[0,0,\frac{1}{4},-\frac{7}{4},\frac{79}{8},-\frac{105}{2},1,0,0,0]$$ 第4列=第4列--550*第6列$$\displaystyle =[0,0,0,\frac{1}{8},-\frac{7}{4},\frac{275}{16},0,1,0,0]$$ 第5列=第5列-28*第6列$$\displaystyle =[0,0,0,0,\frac{1}{16},-\frac{7}{8},0,0,1,0]$$ (%o27) $$\left[ \matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}&0&0&0&0\cr 0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}&0&0&0&0\cr 0&0&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}&1&0&0&0\cr 0&0&0&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}&0&1&0&0\cr 0&0&0&0&\frac{1}{16}&-\frac{7}{8}&0&0&1&0\cr 0&0&0&0&0&\frac{1}{32}&0&0&0&1\cr 0&0&0&0&0&0&35&0&0&0\cr 0&0&0&0&0&0&0&35&0&0\cr 0&0&0&0&0&0&0&0&1225&0\cr 0&0&0&0&0&0&0&0&0&1225}\right]$$ 將右下角化簡為零 (%i29) for i:k+1 thru n do (j:i+n-k, print("第",j,"列=第",j,"列-",M_tilde[j,j],"*第",i,"列=", M_tilde[j]:M_tilde[j]-M_tilde[j,j]*M_tilde[ i ]) )$
M_tilde;

(%o29)　$$\left[ \matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}&0&0&0&0\cr 0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}&0&0&0&0\cr 0&0&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}&1&0&0&0\cr 0&0&0&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}&0&1&0&0\cr 0&0&0&0&\frac{1}{16}&-\frac{7}{8}&0&0&1&0\cr 0&0&0&0&0&\frac{1}{32}&0&0&0&1\cr 0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}&0&0&0&0\cr 0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}&0&0&0&0\cr 0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}&0&0&0&0\cr 0&0&0&0&0&-\frac{1225}{32}&0&0&0&0}\right]$$

(%i31)
for i:k+1 thru n do
(j:i+n-k,
print("第",i,"列和第",j,"列交換"),
[M_tilde[j],M_tilde[ i ]]:[M_tilde[ i ],M_tilde[j]]
)$M_tilde; 第3列和第7列交換 第4列和第8列交換 第5列和第9列交換 第6列和第10列交換 (%o31) $$\left[ \matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}&0&0&0&0\cr 0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}&0&0&0&0\cr 0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}&0&0&0&0\cr 0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}&0&0&0&0\cr 0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}&0&0&0&0\cr 0&0&0&0&0&-\frac{1225}{32}&0&0&0&0\cr 0&0&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}&1&0&0&0\cr 0&0&0&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}&0&1&0&0\cr 0&0&0&0&\frac{1}{16}&-\frac{7}{8}&0&0&1&0\cr 0&0&0&0&0&\frac{1}{32}&0&0&0&1}\right]$$ 得到左上角矩陣$$\widehat{M}$$ (%i32) M_hat:genmatrix(lambda([i,j],M_tilde[i,j]),n,n); (M_hat) $$\left[ \matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr 0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr 0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}\cr 0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr 0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}\cr 0&0&0&0&0&-\frac{1225}{32}}\right]$$ $$\widehat{M}$$乘32倍變成整數 (%i33) M_hat:M_hat*1/delta*X^(n-1); (M_hat) $$\left[ \matrix{ 32&0&-152&1064&-6726&42028\cr 0&16&-112&708&-4424&27605\cr 0&0&-280&1960&-11060&58800\cr 0&0&0&-140&1960&-19250\cr 0&0&0&0&-2450&34300\cr 0&0&0&0&0&-1225}\right]$$ LLL化簡 (%i34) B: LLL(M_hat); (B) $$\left[ \matrix{ 0&160&0&-60&0&-100\cr -64&-64&-88&80&-72&-51\cr 64&-48&32&4&-180&16\cr 128&-80&-48&16&116&-13\cr -32&-96&-16&-132&90&-108\cr -64&-32&248&96&-30&-141}\right]$$ Gram-Schmidt正交化 (%i35) Bstar:apply(matrix,expand(gramschmidt(B))); (Bstar) $$\left[ \matrix{\displaystyle 0&160&0&-60&0&-100\cr -64&-\frac{164}{7}&-88&\frac{907}{14}&-72&-\frac{1069}{14}\cr \frac{4327744}{55201}&-\frac{213712}{55201}&\frac{2859392}{55201}&-\frac{1388192}{55201}&-\frac{9041940}{55201}&\frac{490976}{55201}\cr \frac{2396089600}{17933807}&-\frac{673016640}{17933807}&-\frac{1044380280}{17933807}&\frac{154688960}{17933807}&\frac{745216000}{17933807}&-\frac{1169640000}{17933807}\cr -\frac{2184694400}{45963969}&-\frac{1521655800}{15321323}&\frac{344724800}{15321323}&-\frac{6338718400}{45963969}&\frac{172362400}{45963969}&-\frac{1166905600}{15321323}\cr -\frac{117600}{17929}&-\frac{627200}{17929}&\frac{3763200}{17929}&\frac{2508800}{17929}&\frac{627200}{17929}&-\frac{2508800}{17929}}\right]$$ 取最後一個正交向量 (%i36) Bstar_n:Bstar[n]; (Bstar_n) $$\displaystyle \left[-\frac{117600}{17929},-\frac{627200}{17929},\frac{3763200}{17929},\frac{2508800}{17929},\frac{627200}{17929},-\frac{2508800}{17929}\right]$$ 取各分數的分母 (%i37) Denom:map('denom,Bstar_n); (Denom) $$[17929,17929,17929,17929,17929,17929]$$ 求最大的分母 (%i38) MaxDenom:lmax(%); (MaxDenom) 17929 正交向量化為整數 (%i39) Bstar_n:Bstar_n*MaxDenom; (Bstar_n) $$[-117600,-627200,3763200,2508800,627200,-2508800]$$ 計算最大公因數 (%i40) GCD:lreduce('gcd,Bstar_n); (GCD) 39200 同除最大公因數，得到化簡的正交向量 (%i41) Bstar_n:Bstar_n/GCD; (Bstar_n) $$[-3,-16,96,64,16,-64]$$ 正交向量和$$\displaystyle \left(\frac{x}{X}\right)^i$$相乘 (%i42) hx:sum(Bstar_n[i+1]*(x/X)^i,i,0,n-1); (hx) $$-2x^5+x^4+8x^3+24x^2-8x-3$$ 將$$h(x)$$因式分解 (%i43) factor(hx); (%o43) $$-(x-3)(2x-1)(x^3+3x^2+5x+1)$$ 得到$$h(x)$$的解 (%i44) x:3; (x) 3 驗證答案 (%i45) ev(mod(px,N),x=3); (%o45) 0 作者: bugmens 時間: 2021-6-7 19:44 解三次同餘方程式$$p(x)=x^3-4x^2-3x-10\pmod{1131}$$。 參考資料 Finding Small Roots of Polynomial Equations Using Lattice Basis Reduction https://ntnuopen.ntnu.no/ntnu-xm ... e=1&isAllowed=y 請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下 要先載入LLL.mac才能使用LLL指令 (%i1) load("LLL.mac"); (%o1) C:/maxima-5.43.2/share/maxima/5.43.2/share/LLL.mac 要先載入eigen.mac才能使用gramschmidt指令 (%i2) load("eigen.mac"); (%o2) C:/maxima-5.43.2/share/maxima/5.43.2/share/matrix/eigen.mac 要先載入diag.mac才能使用diag指令 (%i3) load("diag.mac"); (%o3) C:/maxima-5.43.2/share/maxima/5.43.2/share/contrib/diag.mac 同餘方程式$$p(x)$$ (%i4) px:x^3-4*x^2-3*x-10; (px) $$x^3-4x^2-3x-10$$ $$p(x)\equiv 0\pmod{N}$$ (%i5) N:1131; (N) 1131 $$p(x)$$的次數$$k$$ (%i6) k:hipow(px,x); (k) 3 設誤差值$$epsilon=0.1$$ (%i7) epsilon:0.1; (epsilon) 0.1 參數h (%i8) h:ceiling(max(7/k,(k+epsilon*k-1)/(epsilon*k^2))); (h) 3 $$\widehat{M}$$的維度$$n=hk$$ (%i9) n:h*k; (n) 9 參數$$\delta$$，按照公式應該是$$\displaystyle \delta=\frac{1}{3}$$，本範例$$\displaystyle \delta=\frac{1}{9}$$ (%i11) delta:1/sqrt(h*k); delta:1/9; (delta) $$\displaystyle \frac{1}{3}$$ (delta) $$\displaystyle \frac{1}{9}$$ 希望能找到$$|\;x|\;<X=\frac{1}{2}N^{1/k}$$，$$p(x)\equiv 0\pmod{N}$$ 按照公式應該是5，本範例$$X=6$$ (%i13) X:floor(1/2*N^(1/k)); X:6; (X) 5 (X) 6 (%i14) Xpower:create_list(delta*X^-(i-1),i,1,h*k); (Xpower) $$\displaystyle \left[\frac{1}{9},\frac{1}{54},\frac{1}{324},\frac{1}{1944},\frac{1}{11664},\frac{1}{69984},\frac{1}{419904},\frac{1}{2519424},\frac{1}{15116544}\right]$$ 左上角矩陣 (%i15) D1:diag(Xpower); (D1) $$\left[\matrix{\displaystyle \frac{1}{9}&0&0&0&0&0&0&0&0\cr 0&\frac{1}{54}&0&0&0&0&0&0&0\cr 0&0&\frac{1}{324}&0&0&0&0&0&0\cr 0&0&0&\frac{1}{1944}&0&0&0&0&0\cr 0&0&0&0&\frac{1}{11664}&0&0&0&0\cr 0&0&0&0&0&\frac{1}{69984}&0&0&0\cr 0&0&0&0&0&0&\frac{1}{419904}&0&0\cr 0&0&0&0&0&0&0&\frac{1}{2519424}&0\cr 0&0&0&0&0&0&0&0&\frac{1}{15116544}}\right]$$ 多項式$$x^u\cdot p(x)^v$$ (%i16) xpxpower:create_list(x^u*px^v,v,1,h-1,u,0,k-1); (xpxpower) $$[x^3-4x^2-3x-10,x(x^3-4x^2-3x-10),x^2(x^3-4x^2-3x-10),(x^3-4x^2-3x-10)^2,x(x^3-4x^2-3x-10)^2,x^2(x^3-4x^2-3x-10)^2]$$ $$x^1,x^2,\ldots,x^{n-1}$$ (%i17) xpower:create_list(x^i,i,1,n-1); (xpower) $$[x,x^2,x^3,x^4,x^5,x^6,x^7,x^8]$$ 取多項式$$x^u\cdot(x)^v$$係數，形成右上角矩陣(常數項在最後一行) (%i8) A:augcoefmatrix(xpxpower,xpower); (A) $$\left[\matrix{\displaystyle -3&-4&1&0&0&0&0&0&-10\cr -10&-3&-4&1&0&0&0&0&0\cr 0&-10&-3&-4&1&0&0&0&0\cr 60&89&4&10&-8&1&0&0&100\cr 100&60&89&4&10&-8&1&0&0\cr 0&100&60&89&4&10&-8&1&0}\right]$$ 將常數項移到第一行 (%i19) A:addcol(col(A,h*k),submatrix(A,h*k)); (A) $$\left[\matrix{\displaystyle -10&-3&-4&1&0&0&0&0&0\cr 0&-10&-3&-4&1&0&0&0&0\cr 0&0&-10&-3&-4&1&0&0&0\cr 100&60&89&4&10&-8&1&0&0\cr 0&100&60&89&4&10&-8&1&0\cr 0&0&100&60&89&4&10&-8&1}\right]$$ 矩陣$$A$$轉置 (%i20) A:transpose(A); (A) $$\left[\matrix{\displaystyle -10&0&0&100&0&0\cr -3&-10&0&60&100&0\cr -4&-3&-10&89&60&100\cr 1&-4&-3&4&89&60\cr 0&1&-4&10&4&89\cr 0&0&1&-8&10&4\cr 0&0&0&1&-8&10\cr 0&0&0&0&1&-8\cr 0&0&0&0&0&1}\right]$$ 左下角0矩陣 (%i21) Zero:zeromatrix((h-1)*k,h*k); (Zero) $$\left[\matrix{\displaystyle 0&0&0&0&0&0&0&0&0\cr 0&0&0&0&0&0&0&0&0\cr 0&0&0&0&0&0&0&0&0\cr 0&0&0&0&0&0&0&0&0\cr 0&0&0&0&0&0&0&0&0\cr 0&0&0&0&0&0&0&0&0}\right]$$ 右下角矩陣元素$$N^v$$ (%i22) Npower:create_list(N^v,v,1,h-1,u,0,k-1); (Npower) $$[1131,1131,1131,1279161,1279161,1279161]$$ 右下角矩陣 (%i23) D2:diag(Npower); (D2) $$\left[\matrix{\displaystyle 1131&0&0&0&0&0\cr 0&1131&0&0&0&0\cr 0&0&1131&0&0&0\cr 0&0&0&1279161&0&0\cr 0&0&0&0&1279161&0\cr 0&0&0&0&0&1279161}\right]$$ 4個子矩陣合併成矩陣$$M$$ (%i24) M:addrow(addcol(D1,A),addcol(Zero,D2)); (M) $$\left[\matrix{\displaystyle \frac{1}{9}&0&0&0&0&0&0&0&0&-10&0&0&100&0&0\cr 0&\frac{1}{54}&0&0&0&0&0&0&0&-3&-10&0&60&100&0\cr 0&0&\frac{1}{324}&0&0&0&0&0&0&-4&-3&-10&89&60&100\cr 0&0&0&\frac{1}{1944}&0&0&0&0&0&1&-4&-3&4&89&60\cr 0&0&0&0&\frac{1}{11664}&0&0&0&0&0&1&-4&10&4&89\cr 0&0&0&0&0&\frac{1}{69984}&0&0&0&0&0&1&-8&10&4\cr 0&0&0&0&0&0&\frac{1}{419904}&0&0&0&0&0&1&-8&10\cr 0&0&0&0&0&0&0&\frac{1}{2519424}&0&0&0&0&0&1&-8\cr 0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1\cr 0&0&0&0&0&0&0&0&0&1131&0&0&0&0&0\cr 0&0&0&0&0&0&0&0&0&0&1131&0&0&0&0\cr 0&0&0&0&0&0&0&0&0&0&0&1131&0&0&0\cr 0&0&0&0&0&0&0&0&0&0&0&0&1279161&0&0\cr 0&0&0&0&0&0&0&0&0&0&0&0&0&1279161&0\cr 0&0&0&0&0&0&0&0&0&0&0&0&0&0&1279161}\right]$$ 將矩陣$$M$$複製成另一個矩陣$$\widetilde{M}$$，進行矩陣列運算 (%i25) M_tilde:copymatrix(M)$

(%i27)
for i:k+1 thru n do
(for j:1 thru i-1 do
(print("第",j,"列=第",j,"列-",M_tilde[j,i+n-k],"*第",i,"列=",
M_tilde[j]:M_tilde[j]-M_tilde[j,i+n-k]*M_tilde[ i ])
)
)$M_tilde; (%o27) 第1列=第1列--10*第4列$$\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},0,0,0,0,0,0,-40,-30,140,890,600\right]$$ 第2列=第2列--3*第4列$$\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},0,0,0,0,0,0,-22,-9,72,367,180\right]$$ 第3列=第3列--4*第4列$$\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},0,0,0,0,0,0,-19,-22,105,416,340\right]$$ 第1列=第1列--40*第5列$$\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},0,0,0,0,0,0,-190,540,1050,4160\right]$$ 第2列=第2列--22*第5列$$\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},0,0,0,0,0,0,-97,292,455,2138\right]$$ 第3列=第3列--19*第5列$$\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},0,0,0,0,0,0,-98,295,492,2031\right]$$ 第4列=第4列--4*第5列$$\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},0,0,0,0,1,0,-19,44,105,416\right]$$ 第1列=第1列--190*第6列$$\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},\frac{95}{34992},0,0,0,0,0,0,-980,2950,4920\right]$$ 第2列=第2列--97*第6列$$\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},\frac{97}{69984},0,0,0,0,0,0,-484,1425,2526\right]$$ 第3列=第3列--98*第6列$$\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},\frac{49}{34992},0,0,0,0,0,0,-489,1472,2423\right]$$ 第4列=第4列--19*第6列$$\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},\frac{19}{69984},0,0,0,1,0,0,-108,295,492\right]$$ 第5列=第5列--4*第6列$$\displaystyle =\left[0,0,0,0,\frac{1}{11664},\frac{1}{17496},0,0,0,0,1,0,-22,44,105\right]$$ 第1列=第1列--980*第7列$$\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},\frac{95}{34992},\frac{245}{104976},0,0,0,0,0,0,-4890,14720\right]$$ 第2列=第2列--484*第7列$$\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},\frac{97}{69984},\frac{121}{104976},0,0,0,0,0,0,-2447,7366\right]$$ 第3列=第3列--489*第7列$$\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},\frac{49}{34992},\frac{163}{139968},0,0,0,0,0,0,-2440,7313\right]$$ 第4列=第4列--108*第7列$$\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},\frac{19}{69984},\frac{1}{3888},0,0,1,0,0,0,-569,1572\right]$$ 第5列=第5列--22*第7列$$\displaystyle =\left[0,0,0,0,\frac{1}{11664},\frac{1}{17496},\frac{11}{209952},0,0,0,1,0,0,-132,325\right]$$ 第6列=第6列--8*第7列$$\displaystyle =\left[0,0,0,0,0,\frac{1}{69984},\frac{1}{52488},0,0,0,0,1,0,-54,84\right]$$ 第1列=第1列--4890*第8列$$\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},\frac{95}{34992},\frac{245}{104976},\frac{815}{419904},0,0,0,0,0,0,-24400\right]$$ 第2列=第2列--2447*第8列$$\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},\frac{97}{69984},\frac{121}{104976},\frac{2447}{2519424},0,0,0,0,0,0,-12210\right]$$ 第3列=第3列--2440*第8列$$\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},\frac{49}{34992},\frac{163}{139968},\frac{305}{314928},0,0,0,0,0,0,-12207\right]$$ 第4列=第4列--569*第8列$$\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},\frac{19}{69984},\frac{1}{3888},\frac{569}{2519424},0,1,0,0,0,0,-2980\right]$$ 第5列=第5列--132*第8列$$\displaystyle =\left[0,0,0,0,\frac{1}{11664},\frac{1}{17496},\frac{11}{209952},\frac{11}{209952},0,0,1,0,0,0,-731\right]$$ 第6列=第6列--54*第8列$$\displaystyle =\left[0,0,0,0,0,\frac{1}{69984},\frac{1}{52488},\frac{1}{46656},0,0,0,1,0,0,-348\right]$$ 第7列=第7列--8*第8列$$\displaystyle =\left[0,0,0,0,0,0,\frac{1}{419904},\frac{1}{314928},0,0,0,0,1,0,-54\right]$$ 第1列=第1列--24400*第9列$$\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},\frac{95}{34992},\frac{245}{104976},\frac{815}{419904},\frac{1525}{944784},0,0,0,0,0,0\right]$$ 第2列=第2列--12210*第9列$$\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},\frac{97}{69984},\frac{121}{104976},\frac{2447}{2519424},\frac{2035}{2519424},0,0,0,0,0,0\right]$$ 第3列=第3列--12207*第9列$$\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},\frac{49}{34992},\frac{163}{139968},\frac{305}{314928},\frac{4069}{5038848},0,0,0,0,0,0\right]$$ 第4列=第4列--2980*第9列$$\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},\frac{19}{69984},\frac{1}{3888},\frac{569}{2519424},\frac{745}{3779136},1,0,0,0,0,0\right]$$ 第5列=第5列--731*第9列$$\displaystyle =\left[0,0,0,0,\frac{1}{11664},\frac{1}{17496},\frac{11}{209952},\frac{11}{209952},\frac{731}{15116544},0,1,0,0,0,0\right]$$ 第6列=第6列--348*第9列$$\displaystyle =\left[0,0,0,0,0,\frac{1}{69984},\frac{1}{52488},\frac{1}{46656},\frac{29}{1259712},0,0,1,0,0,0\right]$$ 第7列=第7列--54*第9列$$\displaystyle =\left[0,0,0,0,0,0,\frac{1}{419904},\frac{1}{314928},\frac{1}{279936},0,0,0,1,0,0\right]$$ 第8列=第8列--8*第9列$$\displaystyle =\left[0,0,0,0,0,0,0,\frac{1}{2519424},\frac{1}{1889568},0,0,0,0,1,0\right]$$ $$\left[\matrix{\displaystyle \frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}&0&0&0&0&0&0\cr 0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}&0&0&0&0&0&0\cr 0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}&0&0&0&0&0&0\cr 0&0&0&\frac{1}{1944}&\frac{1}{2916}&\frac{19}{69984}&\frac{1}{3888}&\frac{569}{2519424}&\frac{745}{3779136}&1&0&0&0&0&0\cr 0&0&0&0&\frac{1}{11664}&\frac{1}{17496}&\frac{11}{209952}&\frac{11}{209952}&\frac{731}{15116544}&0&1&0&0&0&0\cr 0&0&0&0&0&\frac{1}{69984}&\frac{1}{52488}&\frac{1}{46656}&\frac{29}{1259712}&0&0&1&0&0&0\cr 0&0&0&0&0&0&\frac{1}{419904}&\frac{1}{314928}&\frac{1}{279936}&0&0&0&1&0&0\cr 0&0&0&0&0&0&0&\frac{1}{2519424}&\frac{1}{1889568}&0&0&0&0&1&0\cr 0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1\cr 0&0&0&0&0&0&0&0&0&1131&0&0&0&0&0\cr 0&0&0&0&0&0&0&0&0&0&1131&0&0&0&0\cr 0&0&0&0&0&0&0&0&0&0&0&1131&0&0&0\cr 0&0&0&0&0&0&0&0&0&0&0&0&1279161&0&0\cr 0&0&0&0&0&0&0&0&0&0&0&0&0&1279161&0\cr 0&0&0&0&0&0&0&0&0&0&0&0&0&0&1279161}\right]$$ 將右下角化簡為零 (%i29) for i:k+1 thru n do (j:i+n-k, print("第",j,"列=第",j,"列-",M_tilde[j,j],"*第",i,"列=", M_tilde[j]:M_tilde[j]-M_tilde[j,j]*M_tilde[ i ]) )$
M_tilde;

(%o29)

$$\left[\matrix{\displaystyle \frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}&0&0&0&0&0&0\cr 0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}&0&0&0&0&0&0\cr 0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}&0&0&0&0&0&0\cr 0&0&0&\frac{1}{1944}&\frac{1}{2916}&\frac{19}{69984}&\frac{1}{3888}&\frac{569}{2519424}&\frac{745}{3779136}&1&0&0&0&0&0\cr 0&0&0&0&\frac{1}{11664}&\frac{1}{17496}&\frac{11}{209952}&\frac{11}{209952}&\frac{731}{15116544}&0&1&0&0&0&0\cr 0&0&0&0&0&\frac{1}{69984}&\frac{1}{52488}&\frac{1}{46656}&\frac{29}{1259712}&0&0&1&0&0&0\cr 0&0&0&0&0&0&\frac{1}{419904}&\frac{1}{314928}&\frac{1}{279936}&0&0&0&1&0&0\cr 0&0&0&0&0&0&0&\frac{1}{2519424}&\frac{1}{1889568}&0&0&0&0&1&0\cr 0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1\cr 0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}&0&0&0&0&0&0\cr 0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}&0&0&0&0&0&0\cr 0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}&0&0&0&0&0&0\cr 0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}&0&0&0&0&0&0\cr 0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}&0&0&0&0&0&0\cr 0&0&0&0&0&0&0&0&-\frac{142129}{1679616}&0&0&0&0&0&0}\right]$$

(%i31)
for i:k+1 thru n do
(j:i+n-k,
print("第",i,"列和第",j,"列交換"),
[M_tilde[j],M_tilde[ i ]]:[M_tilde[ i ],M_tilde[j]]
)$M_tilde; (%o31) 第4列和第10列交換 第5列和第11列交換 第6列和第12列交換 第7列和第13列交換 第8列和第14列交換 第9列和第15列交換 $$\left[\matrix{\displaystyle \frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}&0&0&0&0&0&0\cr 0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}&0&0&0&0&0&0\cr 0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}&0&0&0&0&0&0\cr 0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}&0&0&0&0&0&0\cr 0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}&0&0&0&0&0&0\cr 0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}&0&0&0&0&0&0\cr 0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}&0&0&0&0&0&0\cr 0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}&0&0&0&0&0&0\cr 0&0&0&0&0&0&0&0&-\frac{142129}{1679616}&0&0&0&0&0&0\cr 0&0&0&\frac{1}{1944}&\frac{1}{2916}&\frac{19}{69984}&\frac{1}{3888}&\frac{569}{2519424}&\frac{745}{3779136}&1&0&0&0&0&0\cr 0&0&0&0&\frac{1}{11664}&\frac{1}{17496}&\frac{11}{209952}&\frac{11}{209952}&\frac{731}{15116544}&0&1&0&0&0&0\cr 0&0&0&0&0&\frac{1}{69984}&\frac{1}{52488}&\frac{1}{46656}&\frac{29}{1259712}&0&0&1&0&0&0\cr 0&0&0&0&0&0&\frac{1}{419904}&\frac{1}{314928}&\frac{1}{279936}&0&0&0&1&0&0\cr 0&0&0&0&0&0&0&\frac{1}{2519424}&\frac{1}{1889568}&0&0&0&0&1&0\cr 0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1}\right]$$ 得到左上角矩陣$$\widehat{M}$$ (%i32) M_hat:genmatrix(lambda([i,j],M_tilde[i,j]),n,n); (M_hat) $$\left[\matrix{\displaystyle \frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}\cr 0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}\cr 0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}\cr 0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}\cr 0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}\cr 0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}\cr 0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}\cr 0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}\cr 0&0&0&0&0&0&0&0&-\frac{142129}{1679616}}\right]$$ $$\widehat{M}$$變成整數 (%i33) M_hat:M_hat*1/delta*X^(n-1); (M_hat) $$\left[\matrix{\displaystyle 1679616&0&0&77760&51840&41040&35280&29340&24400\cr 0&279936&0&23328&28512&20952&17424&14682&12210\cr 0&0&46656&31104&24624&21168&17604&14640&12207\cr 0&0&0&-8794656&-5863104&-4641624&-4397328&-3861234&-3370380\cr 0&0&0&0&-1465776&-977184&-895752&-895752&-826761\cr 0&0&0&0&0&-244296&-325728&-366444&-393588\cr 0&0&0&0&0&0&-46049796&-61399728&-69074694\cr 0&0&0&0&0&0&0&-7674966&-10233288\cr 0&0&0&0&0&0&0&0&-1279161}\right]$$ LLL化簡 (%i34) B: LLL(M_hat); (B) $$\left[\matrix{\displaystyle 0&0&46656&31104&24624&21168&17604&14640&12207\cr 0&279936&-46656&-7776&3888&-216&-180&42&3\cr 0&0&186624&124416&98496&-159624&-255312&-307884&-344760\cr 0&0&-46656&-31104&-24624&223128&308124&351804&-897780\cr 0&0&513216&342144&-1194912&-255744&-50652&-1824&94692\cr 1679616&0&-46656&46656&27216&19872&17676&14700&12193\cr 0&0&-513216&-342144&-270864&2210112&3063636&-4171566&-35880\cr 0&559872&3825792&-6197472&610416&67608&-231696&55866&135297\cr 0&0&-559872&-373248&-4692816&20511144&-17352684&1982268&-265239}\right]$$ Gram-Schmidt正交化 (%i35) Bstar:apply(matrix,expand(gramschmidt(B))); (Bstar) 矩陣太大不列出來 取最後一個正交向量 (%i36) Bstar_n:Bstar[n]; (Bstar_n) $$\displaystyle \left[-\frac{6714060256800}{194554091},-\frac{24170616924480}{194554091},-\frac{215118490627872}{194554091},-\frac{58009480618752}{194554091},-\frac{870142209281280}{194554091},\frac{4176682604550144}{194554091},-\frac{3132511953412608}{194554091},0,0\right]$$ 取各分數的分母 (%i37) Denom:map('denom,Bstar_n); (Denom) $$\left[194554091,194554091,194554091,194554091,194554091,194554091,194554091,1,1\right]$$ 求最大的分母 (%i38) MaxDenom:lmax(%); (MaxDenom) 194554091 正交向量化為整數 (%i39) Bstar_n:Bstar_n*MaxDenom; (Bstar_n) $$\left[-6714060256800,-24170616924480,-215118490627872,-58009480618752,-870142209281280,4176682604550144,-3132511953412608,0,0\right]$$ 計算最大公因數 (%i40) GCD:lreduce('gcd,Bstar_n); (GCD) 268562410272 同除最大公因數，得到化簡的正交向量 (%i41) Bstar_n:Bstar_n/GCD; (Bstar_n) $$\left[-25,-90,-801,-216,-3240,15552,-11664,0,0\right]$$ 正交向量和$$\displaystyle \left(\frac{x}{X}\right)^{i}$$相乘 (%i42) hx:sum(Bstar_n[i+1]*(x/X)^i,i,0,n-1); (hx) $$\displaystyle -\frac{1}{4}x^6+2x^5-\frac{5}{2}x^4-x^3-\frac{89}{4}x^2-15x-25$$ 取$$h(x)$$各項係數 (%i43) coef:augcoefmatrix([hx],xpower); (coef) $$\left[\matrix{\displaystyle -15&-\frac{89}{4}&-1&-\frac{5}{2}&2&-\frac{1}{4}&0&0&-25}\right]$$ 取$$h(x)$$係數的分母 (%i44) Denom:map('denom,args(coef)[1]); (Denom) $$[1,4,1,2,1,4,1,1,1]$$ 求最大的分母 (%i45) MaxDenom:lmax(Denom); (MaxDenom) 4 將$$h(x)$$化成整數 (%i46) hx:expand(hx*MaxDenom); (hx) $$-x^6+8x^5-10x^4-4x^3-89x^2-60x-100$$ 將$$h(x)$$因式分解 (%i47) factor(hx); (%o47) $$-(x-5)^2(x^2+x+2)^2$$ 得到$$h(x)$$的解 (%i48) x:5; (x) 5 驗證答案 (%i49) ev(mod(px,N),x=5); (%o49) 0 作者: bugmens 時間: 2021-6-19 17:56 Howgrave-Graham論文中回顧Coppersmith方法，但步驟3,4又和Coppersmith有些許不同，本文章就之前範例說明。  方法 範例 步驟1：計算參數$$h$$和$$X$$(和Coppersmith相同) 步驟2：產生矩陣$$M$$(和Coppersmith相同) 步驟3：矩陣$$M$$基本列運算得到$$\widehat{M}$$，計算$$[r(x)H_1^{-1}]_{sh}$$ 因為$$p(x)$$為monic(最高次方項係數為1)，在矩陣$$A$$的對角線元素為1，進行基本列運算將右上角化簡為零，右下角化簡為零，再將對角線元素為1的一整列移到整個矩陣下方。 $$\widetilde{M}=H_1M=\left[\matrix{\widehat{M}&│&0_{(hk\times (h-1)k)}\cr ―&┼&――――――\cr A'&│&I_{(h-1)k}}\right]$$ 得到左上角矩陣$$\widehat{M}$$ 計算矩陣$$H_1^{-1}=M\widetilde{M}^{-1}$$ $$r(x)=[1,x_0,x_0^2,x_0^3,x_0^4,x_0^5,-y_0,-x_0y_0,-y_0^2,-x_0y_0^2]$$ 又$$p(x_0)\equiv 0\pmod{N}$$，$$p(x_0)=y_0N$$，$$\displaystyle y_0=\frac{p(x_0)}{N}$$ $$\displaystyle r(x)=[1,x_0,x_0^2,x_0^3,x_0^4,x_0^5,-\frac{p(x_0)}{N},-\frac{x_0p(x_0)}{N},-\frac{p^2(x_0)}{N},-\frac{x_0p^2(x_0)}{N}]$$ 計算$$\displaystyle p(x_0)H_1^{-1}$$ 將後面的0刪除$$\displaystyle [p(x_0)H_1^{-1}]_{sh}$$ $$H_1^{-1}=M\widetilde{M}^{-1}=\left[\matrix{ 1&&&&&&19&0&361&0\cr &1&&&&&14&19&532&361\cr &&&&&&1&14&234&532\cr &&&&&&&1&28&234\cr &&&&&&&&1&28\cr &&&&&&&&&1\cr &&1&&&&35&&&\cr &&&1&&&&35&&\cr &&&&1&&&&1225&\cr &&&&&1&&&&1225} \right]$$ $$\displaystyle r(x)=(1,x,x^2,x^3,x^4,x^5,-\frac{p(x)}{35},-\frac{xp(x)}{35},-\frac{p^2(x)}{35^2},-\frac{xp^2(x)}{35^2})$$ $$r(x)H_1^{-1}=(1,x,-\frac{p(x)}{35},-\frac{xp(x)}{35},-\frac{p^2(x)}{35^2},-\frac{xp^2(x)}{35^2},$$ $$19+14x+x^2-p(x),$$ $$19x+14x^2+x^3-xp(x),$$ $$361+532x+234x^2+28x^3+x^4-p^2(x),$$ $$361x+532x^2+234x^3+28x^4+x^5-xp^2(x))$$ $$r(x)H_1^{-1}=(1,x,-\frac{p(x)}{35},-\frac{xp(x)}{35},-\frac{p^2(x)}{35^2},-\frac{xp^2(x)}{35^2},0,0,0,0)$$ $$\left[r(x)H_1^{-1}\right]_{sh}=(1,x,-\frac{p(x)}{35},-\frac{xp(x)}{35},-\frac{p^2(x)}{35^2},-\frac{xp^2(x)}{35^2})$$ 步驟4：經LLL化簡和計算矩陣$$H_2^{-1}$$得到不需要同餘$$N$$的方程式 $$B_2=LLL(\widehat{M})$$ 計算$$B_2=H_2\widehat{M}$$，$$H_2^{-1}=\widehat{M}B_2^{-1}$$ $$r'_{hk}(x)=[r(x)H_1^{-1}]_{sh}\cdot ((H_2^{-1})_{hk})^T$$ 解出$$x$$ $$\widehat{M}=\left[\matrix{ 32&0&-152&1064&-6726&42028\cr &16&-112&708&-4424&27605\cr &&-280&1960&-11060&58800\cr &&&-140&1960&-19250\cr &0&&&-2450&34300\cr &&&&&-1225}\right]$$ $$B=LLL(\widehat{M})=\left[\matrix{0&160&0&-60&0&-100\cr -64&-64&-88&80&-72&-51\cr 64&-48&32&4&-180&16\cr 128&-80&-48&16&116&-13\cr -32&-96&-16&-132&90&-108\cr -64&-32&248&96&-30&-141}\right]$$ $$H_2^{-1}=\widehat{M}B_2^{-1}=\left[\matrix{-166&-125&-9&-111&-73&-70\cr -109&-82&-6&-73&-48&-46\cr -231&-171&-7&-157&-104&-98\cr 77&60&8&50&32&32\cr -138&-109&-18&-88&-56&-57\cr 5&4&1&3&2&2}\right]$$ $$((H_2^{-1})_{6})^T=\left[-70,-46,-98,32,-57,2\right]$$ $$\displaystyle [r(x)H_1^{-1}]_{sh}\cdot ((H_2^{-1})_6)^T=-70\cdot 1-46x+98\frac{p(x)}{35}-32\frac{xp(x)}{35}+57\frac{p^2(x)}{35^2}-2\frac{xp^2(x)}{35^2}$$ $$\displaystyle h(x)=\frac{-1}{1225}(2x^5-x^4-8x^3-24x^2+8x+3)$$ $$\displaystyle =\frac{-1}{1225}(x-3)(2x-1)(x^3+3x^2+5x+1)$$ 解方程式得到答案 $$x=3$$ 註： 1.原論文用$$c(x)$$，本文章和Coppersmith一致用$$r(x)$$。 2.原論文的$$\widehat{M}$$有行列互換，但本文章沒有行列互換，但不影響計算過程。 原論文 $$\widetilde{M}=\left[\matrix{ -1225&&&&&\cr 34300&-2450&&&&\cr -19250&1960&-140&&&\cr 58800&-11060&1960&-280&&\cr 27605&-4424&708&-112&16&\cr 42028&-6726&1064&-152&0&32}\right]$$，$$H_2^{-1}=\left[\matrix{ -5&4&-2&1&-1&-2\cr 138&-109&56&-18&31&57\cr -77&60&-32&8&-18&-32\cr 231&-171&104&-7&59&98\cr 109&-82&48&-6&27&46\cr 166&-125&73&-9&41&70}\right]$$ 本文章 $$\widetilde{M}=\left[\matrix{ 32&0&-152&1064&-6726&42028\cr &16&-112&708&-4424&27605\cr &&-280&1960&-11060&58800\cr &&&-140&1960&-19250\cr &&&&-2450&34300\cr &&&&&-1225}\right]$$，$$H_2^{-1}=\left[\matrix{ -166&-125&-9&-111&-73&-70\cr -109&-82&-6&-73&-48&-46\cr -231&-171&-7&-157&-104&-98\cr 77&60&8&50&32&32\cr -138&-109&-18&-88&-56&-57\cr 5&4&1&3&2&2}\right]$$ 參考資料： N. Howgrave-Graham. Finding small roots of univariate modular equations revisited. In Cryptography and Coding– Proc. IMA ’97, volume 1355 of Lecture Notes in Computer Science, pages 131–142. Springer, 1997. https://link.springer.com/chapter/10.1007/BFb0024458 請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.45.0\share\maxima\5.45.0\share目錄下 要先載入LLL.mac才能使用LLL指令 (%i1) load("LLL.mac"); (%o1) C:/maxima-5.45.0/share/maxima/5.45.0/share/LLL.mac 同餘方程式 (%i2) px:x^2+14*x+19; (px) $$x^2+14x+19$$ $$p(x)\equiv 0\pmod{N}$$ (%i3) N:35; (N) 35 $$p(x)$$的次數$$k$$ (%i4) k:hipow(px,x); (k) 2 設誤差值$$epsilon=0.1$$ (%i5) epsilon:0.1; (epsilon) 0.1 參數$$h$$ (%i7) h:ceiling(max(7/k,(k+epsilon*k-1)/(epsilon*k^2))); h:3; (h) 4 (h) 3 $$\widehat{M}$$的維度$$n=hk$$ (%i8) n:h*k; (n) 6 參數$$\delta$$，按照公式應該是$$\displaystyle \delta=\frac{1}{\sqrt{6}}$$，本範例$$\delta=1$$ (%i10) delta:1/sqrt(h*k); delta:1; (delta) $$\displaystyle \frac{1}{\sqrt{6}}$$ (delta) 1 希望能找到$$|\;x|\;<X=\frac{1}{2}N^{1/k}$$，$$p(x)\equiv 0\pmod{N}$$ (%i11) X:floor(1/2*N^(1/k)); (X) 2 產生矩陣$$M$$ (%i14) kill(genlattice)$
genlattice[i,j]:=(
v:floor((k+j-h*k-1)/k),
u: (j-h*k-1)-k*(v-1),
if i<=h*k and j<=h*k then if i=j then delta*X^(1-i) else 0/*左上角矩陣*/
else if i<=h*k and j>h*k then (coeff(expand(x^u*px^v),x,i-1))/*右上角矩陣*/
else if i>h*k and j<=h*k then 0/*左下角矩陣*/
else if i>h*k and j>h*k then if i=j then N^v else 0)$/*右下角矩陣*/ M:genmatrix(genlattice,2*h*k-k,2*h*k-k); (M) $$\left[\matrix{\displaystyle 1&0&0&0&0&0&19&0&361&0\cr 0&\frac{1}{2}&0&0&0&0&14&19&532&361\cr 0&0&\frac{1}{4}&0&0&0&1&14&234&532\cr 0&0&0&\frac{1}{8}&0&0&0&1&28&234\cr 0&0&0&0&\frac{1}{16}&0&0&0&1&28\cr 0&0&0&0&0&\frac{1}{32}&0&0&0&1\cr 0&0&0&0&0&0&35&0&0&0\cr 0&0&0&0&0&0&0&35&0&0\cr 0&0&0&0&0&0&0&0&1225&0\cr 0&0&0&0&0&0&0&0&0&1225}\right]$$ 將矩陣$$M$$複製成另一個矩陣$$\widetilde{M}$$ (%i15) M_tilde:copymatrix(M)$

(%i17)
for i:n thru k+1 step -1 do
(for j:1 thru i-1 do
(M_tilde:rowop(M_tilde,j,i,M_tilde[j,i+n-k])),/*消掉右上角*/
j:i+n-k,
M_tilde:rowop(M_tilde,j,i,M_tilde[j,j]),/*消掉右下角N^v*/
M_tilde:rowswap(M_tilde,i,j)/*列交換*/
)$M_tilde; (%o17) $$\left[\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}&0&0&0&0\cr 0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}&0&0&0&0\cr 0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}&0&0&0&0\cr 0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}&0&0&0&0\cr 0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}&0&0&0&0\cr 0&0&0&0&0&-\frac{1225}{32}&0&0&0&0\cr 0&0&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}&1&0&0&0\cr 0&0&0&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}&0&1&0&0\cr 0&0&0&0&\frac{1}{16}&-\frac{7}{8}&0&0&1&0\cr 0&0&0&0&0&\frac{1}{32}&0&0&0&1}\right]$$ 計算矩陣$$H_1^{-1}=M\widetilde{M}^{-1}$$ (%i18) H1_inv:M.invert(M_tilde); (H1_inv) $$\left[\matrix{\displaystyle 1&0&0&0&0&0&19&0&361&0\cr 0&1&0&0&0&0&14&19&532&361\cr 0&0&0&0&0&0&1&14&234&532\cr 0&0&0&0&0&0&0&1&28&234\cr 0&0&0&0&0&0&0&0&1&28\cr 0&0&0&0&0&0&0&0&0&1\cr 0&0&1&0&0&0&35&0&0&0\cr 0&0&0&1&0&0&0&35&0&0\cr 0&0&0&0&1&0&0&0&1225&0\cr 0&0&0&0&0&1&0&0&0&1225}\right]$$ 產生$$r(x)$$ (%i19) rx:create_list(x^i,i,0,h*k-1); (rx) $$\left[1,x,x^2,x^3,x^4,x^5\right]$$ 產生$$r(x)$$ (%i21) for j:1 thru h*k-k do (print("j=",j, ",v=floor(","k+j-1"/"k",")=floor(",(k+j-1)/k,")=",v:floor((k+j-1)/k), ",u=(j-1)-k(v-1)=(",j,"-1)-",k,"(",v,"-1)","=",u: (j-1)-k*(v-1), ",-","x"^"u"*"p(x)"^"v"/"N"^"v","=","-","x"^u*"p(x)"^v/"N"^v), rx:append(rx,[-x^u*px^v/N^v]) )$
rx;

$$\displaystyle j=1,v=floor(\frac{k+j-1}{k})=floor(1)=1,u=(j-1)-k(v-1)=(1-1)-2(1-1)=0,-\frac{p(x)^v x^u}{N^v}=-\frac{p(x)}{N}$$
$$\displaystyle j=2,v=floor(\frac{k+j-1}{k})=floor(\frac{3}{2})=1,u=(j-1)-k(v-1)=(2-1)-2(1-1)=1,-\frac{p(x)^v x^u}{N^v}=-\frac{p(x)x}{N}$$
$$\displaystyle j=3,v=floor(\frac{k+j-1}{k})=floor(2)=2,u=(j-1)-k(v-1)=(3-1)-2(2-1)=0,-\frac{p(x)^v x^u}{N^v}=-\frac{p(x)^2}{N^2}$$
$$\displaystyle j=4,v=floor(\frac{k+j-1}{k})=floor(\frac{5}{2})=2,u=(j-1)-k(v-1)=(4-1)-2(2-1)=1,-\frac{p(x)^v x^u}{N^v}=-\frac{p(x)^2x}{N^2}$$
(%o21)　$$\displaystyle \left[1,x,x^2,x^3,x^4,x^5,\frac{-x^2-14x-19}{35},-\frac{x(x^2+14x+19)}{35},-\frac{(x^2+14x+19)^2}{1225},-\frac{x(x^2+14x+19)^2}{1225}\right]$$

(%i22)　rxH1_inv:args(rx.H1_inv)[1];
(rxH1_inv)　$$\displaystyle [1,x,\frac{-x^2-14x-19}{35},-\frac{x(x^2+14*x+19)}{35},-\frac{(x^2+14x+19)^2}{1225},-\frac{x(x^2+14x+19)^2}{1225},0,$$
$$x^3-x(x^2+14x+19)+14x^2+19x,$$
$$-(x^2+14x+19)^2+x^4+28x^3+234x^2+532x+361,$$
$$-x(x^2+14x+19)^2+x^5+28x^4+234x^3+532x^2+361x]$$

(%i23)　rxH1_inv:ratsimp(rxH1_inv);
(rxH1_inv)　$$\displaystyle \left[1,x,-\frac{x^2+14x+19}{35},-\frac{x^3+14x^2+19x}{35},-\frac{x^4+28x^3+234x^2+532x+361}{1225},-\frac{x^5+28x^4+234x^3+532x^2+361x}{1225},0,0,0,0\right]$$

(%i24)　rxH1_inv_short:rest(rxH1_inv,-(h*k-k));
(rxH1_inv_short)　$$\displaystyle \left[1,x,-\frac{x^2+14x+19}{35},-\frac{x^3+14x^2+19x}{35},-\frac{x^4+28x^3+234x^2+532x+361}{1225},-\frac{x^5+28x^4+234x^3+532x^2+361x}{1225}\right]$$

(%i25)　M_hat:genmatrix(lambda([i,j],M_tilde[i,j]),n,n);
(M_hat)　$$\left[\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr 0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr 0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}\cr 0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr 0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}\cr 0&0&0&0&0&-\frac{1225}{32}}\right]$$

$$\widehat{M}$$乘32倍變成整數
(%i26)　M_hat:M_hat*1/delta*X^(n-1);
(M_hat)　$$\left[\matrix{\displaystyle 32&0&-152&1064&-6726&42028\cr 0&16&-112&708&-4424&27605\cr 0&0&-280&1960&-11060&58800\cr 0&0&0&-140&1960&-19250\cr 0&0&0&0&-2450&34300\cr 0&0&0&0&0&-1225}\right]$$

LLL化簡
(%i27)　B2: LLL(M_hat);
(B2)　$$\left[\matrix{\displaystyle 0&160&0&-60&0&-100\cr -64&-64&-88&80&-72&-51\cr 64&-48&32&4&-180&16\cr 128&-80&-48&16&116&-13\cr -32&-96&-16&-132&90&-108\cr -64&-32&248&96&-30&-141}\right]$$

(%i28)　H2_inv:M_hat.invert(B2);
(H2_inv)　$$\left[\matrix{\displaystyle -166&-125&-9&-111&-73&-70\cr -109&-82&-6&-73&-48&-46\cr -231&-171&-7&-157&-104&-98\cr 77&60&8&50&32&32\cr -138&-109&-18&-88&-56&-57\cr 5&4&1&3&2&2}\right]$$

(%i29)　H2_inv_lastcolumn:transpose(col(H2_inv,n));
(H2_inv_lastcolumn)　$$[\matrix{-70&-46&-98&32&-57&2}]$$

(%i30)　hx:rxH1_inv_short.H2_inv_lastcolumn;
(hx)　$$\displaystyle -\frac{2(x^5+28x^4+234x^3+532x^2+361x)}{1225}+\frac{57(x^4+28x^3+234x^2+532x+361)}{1225}-\frac{32(x^3+14x^2+19x)}{35}+\frac{14(x^2+14x+19)}{5}-46x-70$$

(%i31)　factor(hx);
(%o31)　$$\displaystyle -\frac{(x-3)(2x-1)(x^3+3x^2+5x+1)}{1225}$$

(%i32)　x:3;
(x)　3

(%i33)　ev(mod(px,N),x=3);
(%o33)　0

Finding Small Roots of Polynomial Equations Using Lattice Basis Reduction
https://ntnuopen.ntnu.no/ntnu-xm ... e=1&isAllowed=y

(%o1)　C:/maxima-5.45.0/share/maxima/5.45.0/share/LLL.mac

(%i2)　px:x^3-4*x^2-3*x-10;
(px)　$$x^3-4x^2-3x-10$$

$$p(x)\equiv 0\pmod{N}$$
(%i3)　N:1131;
(N)　1131

$$p(x)$$的次數$$k$$
(%i4)　k:hipow(px,x);
(k)　3

(%i5)　epsilon:0.1;
(epsilon)　0.1

(%i6)　h:ceiling(max(7/k,(k+epsilon*k-1)/(epsilon*k^2)));
(h)　3

$$\widehat{M}$$的維度$$n=hk$$
(%i7)　n:h*k;
(n)　9

(%i9)
delta:1/sqrt(h*k);
delta:1/9;

(delta)　$$\displaystyle \frac{1}{3}$$
(delta)　$$\displaystyle \frac{1}{9}$$

(%i11)
X:floor(1/2*N^(1/k));
X:6;

(X)　5
(X)　6

(%i14)
kill(genlattice)$genlattice[i,j]:=( v:floor((k+j-h*k-1)/k), u: (j-h*k-1)-k*(v-1), if i<=h*k and j<=h*k then if i=j then delta*X^(1-i) else 0/*左上角矩陣*/ else if i<=h*k and j>h*k then (coeff(expand(x^u*px^v),x,i-1))/*右上角矩陣*/ else if i>h*k and j<=h*k then 0/*左下角矩陣*/ else if i>h*k and j>h*k then if i=j then N^v else 0)$/*右下角矩陣*/
M:genmatrix(genlattice,2*h*k-k,2*h*k-k);

(M)　$$\left[\matrix{\displaystyle \frac{1}{9}&0&0&0&0&0&0&0&0&-10&0&0&100&0&0\cr 0&\frac{1}{54}&0&0&0&0&0&0&0&-3&-10&0&60&100&0\cr 0&0&\frac{1}{324}&0&0&0&0&0&0&-4&-3&-10&89&60&100\cr 0&0&0&\frac{1}{1944}&0&0&0&0&0&1&-4&-3&4&89&60\cr 0&0&0&0&\frac{1}{11664}&0&0&0&0&0&1&-4&10&4&89\cr 0&0&0&0&0&\frac{1}{69984}&0&0&0&0&0&1&-8&10&4\cr 0&0&0&0&0&0&\frac{1}{419904}&0&0&0&0&0&1&-8&10\cr 0&0&0&0&0&0&0&\frac{1}{2519424}&0&0&0&0&0&1&-8\cr 0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1\cr 0&0&0&0&0&0&0&0&0&1131&0&0&0&0&0\cr 0&0&0&0&0&0&0&0&0&0&1131&0&0&0&0\cr 0&0&0&0&0&0&0&0&0&0&0&1131&0&0&0\cr 0&0&0&0&0&0&0&0&0&0&0&0&1279161&0&0\cr 0&0&0&0&0&0&0&0&0&0&0&0&0&1279161&0\cr 0&0&0&0&0&0&0&0&0&0&0&0&0&0&1279161}\right]$$

(%i15)　M_tilde:copymatrix(M)$矩陣$$\widetilde{M}$$進行矩陣列運算 (%i17) for i:n thru k+1 step -1 do (for j:1 thru i-1 do (M_tilde:rowop(M_tilde,j,i,M_tilde[j,i+n-k])),/*消掉右上角*/ j:i+n-k, M_tilde:rowop(M_tilde,j,i,M_tilde[j,j]),/*消掉右下角N^v*/ M_tilde:rowswap(M_tilde,i,j)/*列交換*/ )$
M_tilde;

(%o17)　$$\left[\matrix{\displaystyle \frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}&0&0&0&0&0&0\cr 0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}&0&0&0&0&0&0\cr 0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}&0&0&0&0&0&0\cr 0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}&0&0&0&0&0&0\cr 0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}&0&0&0&0&0&0\cr 0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}&0&0&0&0&0&0\cr 0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}&0&0&0&0&0&0\cr 0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}&0&0&0&0&0&0\cr 0&0&0&0&0&0&0&0&-\frac{142129}{1679616}&0&0&0&0&0&0\cr 0&0&0&\frac{1}{1944}&\frac{1}{2916}&\frac{19}{69984}&\frac{1}{3888}&\frac{569}{2519424}&\frac{745}{3779136}&1&0&0&0&0&0\cr 0&0&0&0&\frac{1}{11664}&\frac{1}{17496}&\frac{11}{209952}&\frac{11}{209952}&\frac{731}{15116544}&0&1&0&0&0&0\cr 0&0&0&0&0&\frac{1}{69984}&\frac{1}{52488}&\frac{1}{46656}&\frac{29}{1259712}&0&0&1&0&0&0\cr 0&0&0&0&0&0&\frac{1}{419904}&\frac{1}{314928}&\frac{1}{279936}&0&0&0&1&0&0\cr 0&0&0&0&0&0&0&\frac{1}{2519424}&\frac{1}{1889568}&0&0&0&0&1&0\cr 0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1}\right]$$

(%i18)　H1_inv:M.invert(M_tilde);
(H1_inv)　$$\left[\matrix{\displaystyle 1&0&0&0&0&0&0&0&0&-10&0&0&100&0&0\cr 0&1&0&0&0&0&0&0&0&-3&-10&0&60&100&0\cr 0&0&1&0&0&0&0&0&0&-4&-3&-10&89&60&100\cr 0&0&0&0&0&0&0&0&0&1&-4&-3&4&89&60\cr 0&0&0&0&0&0&0&0&0&0&1&-4&10&4&89\cr 0&0&0&0&0&0&0&0&0&0&0&1&-8&10&4\cr 0&0&0&0&0&0&0&0&0&0&0&0&1&-8&10\cr 0&0&0&0&0&0&0&0&0&0&0&0&0&1&-8\cr 0&0&0&0&0&0&0&0&0&0&0&0&0&0&1\cr 0&0&0&1&0&0&0&0&0&1131&0&0&0&0&0\cr 0&0&0&0&1&0&0&0&0&0&1131&0&0&0&0\cr 0&0&0&0&0&1&0&0&0&0&0&1131&0&0&0\cr 0&0&0&0&0&0&1&0&0&0&0&0&1279161&0&0\cr 0&0&0&0&0&0&0&1&0&0&0&0&0&1279161&0\cr 0&0&0&0&0&0&0&0&1&0&0&0&0&0&1279161}\right]$$

(%i19)　rx:create_list(x^i,i,0,h*k-1);
(rx)　$$[1,x,x^2,x^3,x^4,x^5,x^6,x^7,x^8]$$

(%i21)
for j:1 thru h*k-k do
(print("j=",j,
",v=floor(","k+j-1"/"k",")=floor(",(k+j-1)/k,")=",v:floor((k+j-1)/k),
",u=(j-1)-k(v-1)=(",j,"-1)-",k,"(",v,"-1)","=",u: (j-1)-k*(v-1),
",-","x"^"u"*"p(x)"^"v"/"N"^"v","=","-","x"^u*"p(x)"^v/"N"^v),
rx:append(rx,[-x^u*px^v/N^v])
)$rx; $$\displaystyle j=1,v=floor(\frac{k+j-1}{k})=floor(1)=1,u=(j-1)-k(v-1)=(1-1)-3(1-1)=0,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)}{N}$$ $$\displaystyle j=2,v=floor(\frac{k+j-1}{k})=floor(4/3)=1,u=(j-1)-k(v-1)=(2-1)-3(1-1)=1,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)x}{N}$$ $$\displaystyle j=3,v=floor(\frac{k+j-1}{k})=floor(5/3)=1,u=(j-1)-k(v-1)=(3-1)-3(1-1)=2,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)x^2}{N}$$ $$\displaystyle j=4,v=floor(\frac{k+j-1}{k})=floor(2)=2,u=(j-1)-k(v-1)=(4-1)-3(2-1)=0,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)^2}{N^2}$$ $$\displaystyle j=5,v=floor(\frac{k+j-1}{k})=floor(7/3)=2,u=(j-1)-k(v-1)=(5-1)-3(2-1)=1,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)^2x}{N^2}$$ $$\displaystyle j=6,v=floor(\frac{k+j-1}{k})=floor(8/3)=2,u=(j-1)-k(v-1)=(6-1)-3(2-1)=2,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)^2*x^2}{N^2}$$ (%o21) $$\displaystyle [1,x,x^2,x^3,x^4,x^5,x^6,x^7,x^8,\frac{-x^3+4x^2+3x+10}{1131},-\frac{x(x^3-4x^2-3x-10)}{1131},-\frac{x^2(x^3-4x^2-3x-10)}{1131},$$ $$\displaystyle -\frac{(x^3-4x^2-3x-10)^2}{1279161},-\frac{x(x^3-4x^2-3x-10)^2}{1279161},-\frac{x^2(x^3-4x^2-3x-10)^2}{1279161}]$$ 計算$$r(x)H_1^{-1}$$ (%i22) rxH1_inv:args(rx.H1_inv)[1]; (rxH1_inv) $$\displaystyle [1,x,x^2,\frac{-x^3+4x^2+3x+10}{1131},-\frac{x(x^3-4x^2-3x-10)}{1131},-\frac{x^2(x^3-4x^2-3x-10)}{1131},-\frac{(x^3-4x^2-3x-10)^2}{1279161},-\frac{x(x^3-4x^2-3x-10)^2}{1279161},-\frac{x^2(x^3-4x^2-3x-10)^2}{1279161},0,$$ $$x^4-x(x^3-4x^2-3x-10)-4x^3-3x^2-10x,$$ $$x^5-4x^4-x^2(x^3-4x^2-3x-10)-3x^3-10x^2,$$ $$-(x^3-4x^2-3x-10)^2+x^6-8x^5+10x^4+4x^3+89x^2+60x+100,$$ $$-x(x^3-4x^2-3x-10)^2+x^7-8x^6+10x^5+4x^4+89x^3+60x^2+100x,$$ $$-x^2(x^3-4x^2-3x-10)^2+x^8-8x^7+10x^6+4x^5+89x^4+60x^3+100x^2]$$ 其中$$r(x)H_1^{-1}$$後面化簡為0 (%i23) rxH1_inv:ratsimp(rxH1_inv); (rxH1_inv) $$\displaystyle \left[1,x,x^2,\frac{-x^3+4x^2+3x+10}{1131},-\frac{x(x^3-4x^2-3x-10)}{1131},-\frac{x^2(x^3-4x^2-3x-10)}{1131},-\frac{(x^3-4x^2-3x-10)^2}{1279161},-\frac{x(x^3-4x^2-3x-10)^2}{1279161},-\frac{x^2(x^3-4x^2-3x-10)^2}{1279161},0,0,0,0,0,0\right]$$ 縮短$$r(x)H)_1^{-1}$$長度 (%i24) rxH1_inv_short:rest(rxH1_inv,-(h*k-k)); (rxH1_inv_short) $$\displaystyle \left[1,x,x^2,\frac{-x^3+4x^2+3x+10}{1131},-\frac{x(x^3-4x^2-3x-10)}{1131},-\frac{x^2(x^3-4x^2-3x-10)}{1131},-\frac{(x^3-4x^2-3x-10)^2}{1279161},-\frac{x(x^3-4x^2-3x-10)^2}{1279161},-\frac{x^2(x^3-4x^2-3x-10)^2}{1279161}\right]$$ 得到左上角矩陣$$\widehat{M}$$ (%i25) M_hat:genmatrix(lambda([i,j],M_tilde[i,j]),n,n); (M_hat) $$\left[\matrix{\displaystyle \frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}\cr 0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}\cr 0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}\cr 0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}\cr 0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}\cr 0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}\cr 0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}\cr 0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}\cr 0&0&0&0&0&0&0&0&-\frac{142129}{1679616}}\right]$$ $$\widehat{M}$$乘1679616變成整數 (%i26) M_hat:M_hat*1/delta*X^(n-1); (M_hat) $$\left[\matrix{\displaystyle 1679616&0&0&77760&51840&41040&35280&29340&24400\cr 0&279936&0&23328&28512&20952&17424&14682&12210\cr 0&0&46656&31104&24624&21168&17604&14640&12207\cr 0&0&0&-8794656&-5863104&-4641624&-4397328&-3861234&-3370380\cr 0&0&0&0&-1465776&-977184&-895752&-895752&-826761\cr 0&0&0&0&0&-244296&-325728&-366444&-393588\cr 0&0&0&0&0&0&-46049796&-61399728&-69074694\cr 0&0&0&0&0&0&0&-7674966&-10233288\cr 0&0&0&0&0&0&0&0&-1279161}\right]$$ LLL化簡 (%i27) B2: LLL(M_hat); (B2) $$\left[\matrix{\displaystyle 0&0&46656&31104&24624&21168&17604&14640&12207\cr 0&279936&-46656&-7776&3888&-216&-180&42&3\cr 0&0&186624&124416&98496&-159624&-255312&-307884&-344760\cr 0&0&-46656&-31104&-24624&223128&308124&351804&-897780\cr 0&0&513216&342144&-1194912&-255744&-50652&-1824&94692\cr 1679616&0&-46656&46656&27216&19872&17676&14700&12193\cr 0&0&-513216&-342144&-270864&2210112&3063636&-4171566&-35880\cr 0&559872&3825792&-6197472&610416&67608&-231696&55866&135297\cr 0&0&-559872&-373248&-4692816&20511144&-17352684&1982268&-265239}\right]$$ 計算矩陣$$H_2^{-1}=\widehat{M}B_2^{-1}$$ (%i28) H2_inv:M_hat.invert(B2); (H2_inv) $$\left[\matrix{\displaystyle 1&0&0&0&0&1&0&0&0\cr 1&1&0&0&0&0&0&0&0\cr 1&0&0&0&0&0&0&0&0\cr -141&-2&6&0&3&0&0&1&0\cr -19&0&2&0&1&0&0&0&0\cr -4&0&1&0&0&0&0&0&0\cr -477&0&145&14&-3&0&4&0&1\cr -44&0&15&5&0&0&1&0&0\cr -3&0&1&1&0&0&0&0&0}\right]$$ 取矩陣$$H_2^{-1}$$最後一行 (%i29) H2_inv_lastcolumn:transpose(col(H2_inv,n)); (H2_inv_lastcolumn) $$[\matrix{0&0&0&0&0&0&1&0&0}]$$ 將$$[r(x)H_1^{-1}]_{sh}\cdot ((H_2^{-1})_{hk})^T$$相乘 (%i30) hx:rxH1_inv_short.H2_inv_lastcolumn; (hx) $$\displaystyle -\frac{x^6-8x^5+10x^4+4x^3+89x^2+60x+100}{1279161}$$ 將$$h(x)$$因式分解 (%i31) factor(hx); (%o31) $$\displaystyle -\frac{(x-5)^2(x^2+x+2)^2}{1279161}$$ 得到$$h(x)$$的解 (%i32) x:5; (x) 5 驗證答案 (%i33) ev(mod(px,N),x=5); (%o33) 0 作者: bugmens 時間: 2021-6-29 10:42 當初Coppersmith的方法比較麻煩，Howgrave-Graham提供改良的方法，方法如下。  方法 範例 問題敘述 設同餘方程式為$$p(x)=x^k+a_{k-1}x^{k-1}+\ldots+a_1 x+a_0\equiv 0 \pmod{N}$$ 且$$p(x)$$為monic(最高次方項係數為1)且不可分解。 利用LLL方法可以找出比邊界$$X$$還小的解$$x_0$$($$\displaystyle |\;x_0|\; 引理1： 假設lattice \(L$$經LLL化簡後向量$$b_1,b_2,\ldots,b_n$$，則$$\Vert\;b_1 \Vert\;\le 2^{(n-1)/4}\cdot(det(L))^{1/n}$$。 [證明] 設$$b_i$$是LLL化簡後的向量，符合以下兩個條件 (1)(size-reduced)對$$1\le j<i\le n$$，$$\displaystyle |\;\mu_{i,j}|\;\le \frac{1}{2}$$ (2)(Lovász condition)對$$i=2,3,\ldots,n$$，$$\displaystyle \frac{3}{4}\Vert\;b_{i-1}^2\Vert\;\le \Vert\;b_i^*\Vert\;^2+\mu_{i,i-1}^2 \Vert\;b_{i-1}^*\Vert\;^2$$ https://en.wikipedia.org/wiki/Le ... reduction_algorithm 將(2)式移項$$\displaystyle (\frac{3}{4}-\mu_{i,i-1}^2) \Vert\;b_{i-1}^2\Vert\;^2\le \Vert\;b_i^*\Vert\;^2$$ 將(1)式平方$$\mu_{i,i-1}^2\le \frac{1}{4}$$代入上式，得到對$$1<i\le n$$，$$\displaystyle \frac{1}{2}\Vert\;b_{i-1}^*\Vert\;^2\le \Vert\;b_i^*\Vert\;^2$$，$$\displaystyle \Vert\;b_{i-1}^*\Vert\;^2\le 2^{i-(i-1)} \Vert\;b_i^*\Vert\;^2$$ 由數學歸納法得知，對$$1\le j\le i\le n$$，$$\Vert\;b_j^*\Vert\;^2\le 2^{i-j}\cdot \Vert\;b_i^*\Vert\;^2$$ 由Gram-Schmidt正交化可知$$\displaystyle b_i^*=b_i-\sum_{j=1}^{i-1}\mu_{ij}b_j^*$$，$$\displaystyle b_i=b_i^*+\sum_{j=1}^{i-1}\mu_{ij}b_j^*$$ $$\displaystyle \Vert\;b_i\Vert\;^2=\Vert\;b_i^*\Vert\;^2+2\sum_{j=1}^{i-1}\mu_{ij}b_i^*\cdot b_j^*+\sum_{j=1}^{i-1}\mu_{ij}^2\Vert\;b_j^*\Vert\;^2$$ 因為Gram-Schmidt正交化，$$b_i^*\cdot b_j^*=0$$代入上式 $$\displaystyle \Vert\;b_i\Vert\;^2=\Vert\;b_i^*\Vert\;^2+\sum_{j=1}^{i-1}\mu_{ij}^2\Vert\;b_j^*\Vert\;^2$$ $$\displaystyle \le \Vert\;b_i^*\Vert\;^2+\sum_{j=1}^{i-1}\frac{1}{4}2^{i-j}\Vert\;b_i^*\Vert\;^2$$ $$\displaystyle =(1+\frac{1}{4}(2^i-2))\cdot \Vert\;b_i^*\Vert\;^2$$ $$\le 2^{i-1}\cdot \Vert\;b_i^*\Vert\;^2$$ 對$$1\le j\le i\le n$$，$$\Vert\;b_j\Vert\;^2\le 2^{j-1}\cdot \Vert\;b_j^*\Vert\;^2\le 2^{i-1}\cdot \Vert\;b_i^*\Vert\;^2$$ $$\Vert\;b_1\Vert\;^2\le 2^{n-1}\Vert\;b_n^*\Vert\;^2$$ $$\Vert\;b_1\Vert\;^2\le 2^{n-2}\Vert\;b_{n-1}^*\Vert\;^2$$ $$\Vert\;b_1\Vert\;^2\le 2^{0}\Vert\;b_1^*\Vert\;^2$$ 將上面各式相乘$$\displaystyle \Vert\;b_1\Vert\;^{2n}\le 2^{0+1+\ldots+(n-2)+(n-1)}\prod_{i=1}^n \Vert\;b_i^*\Vert\;^2$$ $$\displaystyle \Vert\;b_1\Vert\;^{2n}\le 2^{\frac{n(n-1)}{2}}\cdot det(L)^2$$ $$\displaystyle \Vert\;b_1\Vert\;\le 2^{\frac{n-1}{4}}\cdot det(L)^{\frac{1}{n}}$$ 參考資料： N. Howgrave-Graham. Finding small roots of univariate modular equations revisited. In Cryptography and Coding– Proc. IMA ’97, volume 1355 of Lecture Notes in Computer Science, pages 131–142. Springer, 1997. https://link.springer.com/chapter/10.1007/BFb0024458 請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.45.0\share\maxima\5.45.0\share目錄下 要先載入LLL.mac才能使用LLL指令 (%i1) load("LLL.mac"); (%o1) C:/maxima-5.45.0/share/maxima/5.45.0/share/LLL.mac 同餘方程式 (%i2) px:x^2+14*x+19; (px) $$x^2+14x+19$$ $$p(x)\equiv 0\pmod{N}$$ (%i3) N:35; (N) 35 $$p(x)$$的次數$$k$$ (%i4) k:hipow(px,x); (k) 2 參數$$h\ge 2$$ (%i5) h:3; (h) 3 希望能找到$$|\;x|\;<X$$，$$p(x)\equiv 0\pmod{N}$$ (%i6) X:ceiling(2^(-1/2)*(h*k)^(-1/(h*k-1))*N^((h-1)/(h*k-1)))-1; (X) 2 產生$$q_{u,v}(x)$$方程組 (%i7) q_uv:create_list((v:floor((i-1)/k), u: (i-1)-k*v, N^(h-1-v)*x^u*px^v),i,1,h*k); (q_uv) $$[1225,1225x,35(x^2+14x+19),35x(x^2+14x+19),(x^2+14x+19)^2,x(x^2+14x+19)^2]$$ 用$$Xx$$取代原本的$$x$$ (%i8) q_uv:ev(q_uv,x=x*X); (q_uv) $$[1225,2450x,35(4x^2+28x+19),70x(4x^2+28x+19),(4x^2+28x+19)^2,2x(4x^2+28x+19)^2]$$ $$x^1,x^2,\ldots,x^{hk-1}$$ (%i9) xpower:create_list(x^i,i,1,h*k-1); (xpower) $$[x,x^2,x^3,x^4,x^5]$$ 取多項式$$q_{u,v}(x)$$係數(常數項在最後一行) (%i10) M:augcoefmatrix(q_uv,xpower); (M) $$\left[\matrix{0&0&0&0&0&1225\cr 2450&0&0&0&0&0\cr 980&140&0&0&0&665\cr 1330&1960&280&0&0&0\cr 1064&936&224&16&0&361\cr 722&2128&1872&448&32&0}\right]$$ 將常數項移到第一行 (%i11) M:addcol(col(M,h*k),submatrix(M,h*k)); (M) $$\left[\matrix{1225&0&0&0&0&0\cr 0&2450&0&0&0&0\cr 665&980&140&0&0&0\cr 0&1330&1960&280&0&0\cr 361&1064&936&224&16&0\cr 0&722&2128&1872&448&32}\right]$$ LLL化簡 (%i12) B: LLL(M); (B) $$\left[\matrix{3&16&-96&-64&-16&64\cr 49&100&0&160&0&64\cr 115&-166&16&104&96&64\cr 61&32&148&-128&48&128\cr 21&-74&-56&16&224&-128\cr -201&8&132&-32&-48&32}\right]$$ 第一列短向量$$b_1$$ (%i13) B[1]; (%o13) $$[3,16,-96,-64,-16,64]$$ 產生的方程式不需要再同餘$$N^{h-1}$$ (%i14) rx:sum(B[1][i+1]*(x/X)^i,i,0,h*k-1); (rx) $$2x^5-x^4-8x^3-24x^2+8x+3$$ 將$$r(x)$$因式分解 (%i15) factor(rx); (%o15) $$(x-3)(2x-1)(x^3+3x^2+5x+1)$$ 得到$$r(x)$$的解 (%i16) x:3; (x) 3 驗證答案 (%i17) ev(mod(px,N),x=3); (%o17) 0 －－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－ 解三次同餘方程式$$p(x)=x^3-4x^2-3x-10\pmod{1131}$$。 參考資料 Finding Small Roots of Polynomial Equations Using Lattice Basis Reduction https://ntnuopen.ntnu.no/ntnu-xm ... e=1&isAllowed=y 請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.45.0\share\maxima\5.45.0\share目錄下 要先載入LLL.mac才能使用LLL指令 (%i1) load("LLL.mac"); (%o1) C:/maxima-5.45.0/share/maxima/5.45.0/share/LLL.mac 同餘方程式 (%i2) px:x^3-4*x^2-3*x-10; (px) $$x^3-4x^2-3x-10$$ $$p(x)\equiv 0\pmod{N}$$ (%i3) N:1131; (N) 1131 $$p(x)$$的次數$$k$$ (%i4) k:hipow(px,x); (k) 3 參數$$h\ge 2$$ (%i5) h:3; (h) 3 希望能找到$$|\;x|\;<X$$，$$p(x)\equiv 0\pmod{N}$$ 按照公式應該是3，本範例$$X=6$$ (%i7) X:ceiling(2^(-1/2)*(h*k)^(-1/(h*k-1))*N^((h-1)/(h*k-1)))-1; X:6; (X) 3 (X) 6 產生$$q_{u,v}(x)$$方程組 (%i8) q_uv:create_list((v:floor((i-1)/k), u: (i-1)-k*v, N^(h-1-v)*x^u*px^v),i,1,h*k); (q_uv) $$[1279161,1279161x,1279161x^2,1131(x^3-4x^2-3x-10),1131x(x^3-4x^2-3x-10),1131x^2(x^3-4x^2-3x-10),$$ $$(x^3-4x^2-3x-10)^2,x(x^3-4x^2-3x-10)^2,x^2(x^3-4x^2-3x-10)^2]$$ 用$$Xx$$取代原本的$$x$$ (%i8) q_uv:ev(q_uv,x=x*X); (q_uv) $$[1279161,7674966x,46049796x^2,1131(216x^3-144x^2-18x-10),6786x(216x^3-144x^2-18x-10),$$ $$40716x^2(216x^3-144x^2-18x-10),(216x^3-144x^2-18x-10)^2,6x(216x^3-144x^2-18x-10)^2,36x^2(216x^3-144x^2-18x-10)^2]$$ $$x^1,x^2,\ldots,x^{hk-1}$$ (%i9) xpower:create_list(x^i,i,1,h*k-1); (xpower) $$[x,x^2,x^3,x^4,x^5,x^6,x^7,x^8]$$ 取多項式$$q_{u,v}(x)$$係數(常數項在最後一行) (%i11) M:augcoefmatrix(q_uv,xpower); (M) $$\left[\matrix{0&0&0&0&0&0&0&0&1279161\cr 7674966&0&0&0&0&0&0&0&0\cr 0&46049796&0&0&0&0&0&0&0\cr -20358&-162864&244296&0&0&0&0&0&-11310\cr -67860&-122148&-977184&1465776&0&0&0&0&0\cr 0&-407160&-732888&-5863104&8794656&0&0&0&0\cr 360&3204&864&12960&-62208&46656&0&0&100\cr 600&2160&19224&5184&77760&-373248&279936&0&0\cr 0&3600&12960&115344&31104&466560&-2239488&1679616&0}\right]$$ 將常數項移到第一行 (%i12) M:addcol(col(M,h*k),submatrix(M,h*k)); (M) $$\left[\matrix{1279161&0&0&0&0&0&0&0&0\cr 0&7674966&0&0&0&0&0&0&0\cr 0&0&46049796&0&0&0&0&0&0\cr -11310&-20358&-162864&244296&0&0&0&0&0\cr 0&-67860&-122148&-977184&1465776&0&0&0&0\cr 0&0&-407160&-732888&-5863104&8794656&0&0&0\cr 100&360&3204&864&12960&-62208&46656&0&0\cr 0&600&2160&19224&5184&77760&-373248&279936&0\cr 0&0&3600&12960&115344&31104&466560&-2239488&1679616}\right]$$ LLL化簡 (%i12) B: LLL(M); (M) $$\left[\matrix{ 100&360&3204&864&12960&-62208&46656&0&0\cr -11310&-20358&-162864&244296&0&0&0&0&0\cr 400&2040&14976&22680&57024&-171072&-186624&279936&0\cr 1279161&0&0&0&0&0&0&0&0\cr -22920&-109656&-457488&-491184&1426896&186624&-139968&0&0\cr 1400&8040&59256&121176&322704&-451008&-746496&-839808&1679616\cr -53360&-196668&-1128060&-794880&-859248&972000&1632960&1959552&1679616\cr -22620&7634250&-325728&488592&0&0&0&0&0\cr -267849&3713268&20770668&14244552&11153376&9020160&7231680&5598720&5038848}\right]$$ 第一列短向量$$b_1$$ (%i14) B[1]; (%o14) $$[100,360,3204,864,12960,-62208,46656,0,0]$$ 產生的方程式不需要再同餘$$N^{h-1}$$ (%i15) rx:sum(B[1][i+1]*(x/X)^i,i,0,h*k-1); (rx) $$x^6-8x^5+10x^4+4x^3+89x^2+60x+100$$ 將$$r(x)$$因式分解 (%i16) factor(rx); (%o16) $$(x-5)^2(x^2+x+2)^2$$ 得到$$r(x)$$的解 (%i17) x:5; (x) 5 驗證答案 (%i18) ev(mod(px,N),x=5); (%o18) 0 作者: bugmens 時間: 2021-7-11 21:42 將Coppersmith和Howgrave-Graham方法寫成副程式，放入LLL.zip，提供將來範例直接使用。 111.3.6補充 發現ceiling指令在處理超大浮點數會出現錯誤，改用bigfloat numbers。  修正前 修正後 h:3$ k:3$N:10^150$ X:ceiling(2^(-1/2)*(h*k)^(-1/(h*k-1))*N^((h-1)/(h*k-1)))-1; 16990442448471225139289591175253590015錯誤 h:3$k:3$ N:10^150$fpprec:100$/*設定小數點以下100為有效位數*/ X:ceiling(bfloat(2^(-1/2)*(h*k)^(-1/(h*k-1))*N^((h-1)/(h*k-1))))-1; 16990442448471225207917914988908164235正確

(%o1)　C:/maxima-5.45.0/share/maxima/5.45.0/share/LLL.mac

Coppersmith_Howgrave方法副程式
(%i2)
Coppersmith_Howgrave(px,N,h):=block
([ak,inv_ak,k,X,q_uv,M,B,i,rx,x],
px:expand(px),/*先expand()確保coeff()取得到係數,例子3(x^2+x+1),x^2係數為0*/
if (ak:coeff(px,x,hipow(px,x)))#1 then
(print("p(x)不是monic多項式，同乘",ak^"-1","≡",inv_ak:inv_mod(ak,N),"mod(",N,")"),
print("p(x)變成monic多項式，",inv_ak,"(",px,")=",px:polymod(inv_ak*px,N),"(mod",N,")")
),
if h<2 then (print("參數h要≥2"),return([])),
fpprec:100,/*設定小數點以下100為有效位數*/
print("參數h=",h),
print("p(x)最高次方k=",k:hipow(px,x)),
print("X=ceiling(",2^(-1/2),"(hk)"^"-1/(hk-1)","N"^"(h-1)/(hk-1)",")=ceiling(",
2^(-1/2),h*k,""^("-1"/(h*k-1)),N^((h-1)/(h*k-1)),")=",X:ceiling(bfloat(2^(-1/2)*(h*k)^(-1/(h*k-1))*N^((h-1)/(h*k-1))))-1),
print("q_uv=N"^"h-1-v","x"^"u","p(x)"^"v","=",q_uv:create_list((v:floor((i-1)/k),u: (i-1)-k*v,N^(h-1-v)*x^u*px^v),i,1,h*k)),
print("用",X,"x取代x,得到q_uv=",q_uv:ev(q_uv,x=x*X)),
M:augcoefmatrix(q_uv,create_list(x^i,i,1,h*k-1)),
print("LLL化簡B=",B: LLL(M)),
print("產生不需要同餘N"^(h-1),"的方程式"),
printList:["r(x)=",B[1][1]],
for i:2 thru h*k do
(if B[1][ i ]>=0 then printList:append(printList,["+"]),
printList:append(printList,[B[1][ i ],"(",x/X,")"^(i-1)])
),
apply(print,printList),/*再用apply(print,)將全部內容印在同一行*/
print("r(x)=",rx:sum(B[1][i+1]*(x/X)^i,i,0,h*k-1),"=",factor(rx)),
print("整數解為",x:sublist(solve(rx,x),lambda([x],integerp(rhs(x))))),
return(x)
)$二次同餘方程式 (%i5) px:x^2+14*x+19; N:35; h:3; (px) $$x^2+14x+19$$ (N) 35 (h) 3 (%i6) solution:Coppersmith_Howgrave(px,N,h); 參數$$h=3$$ $$p(x)$$最高次方$$k=2$$ $$\displaystyle X=ceiling(\frac{1}{\sqrt{2}}(hk)^{-1/(hk-1)}N^{(h-1)/(hk-1)})=ceiling(\frac{1}{\sqrt{2}}6^{-1/5}35^{2/5})=2$$ $$q_{uv}=N^{h-1-v}x^{u}p(x)^{v}=[1225,1225x,35(x^2+14x+19),35x(x^2+14x+19),(x^2+14x+19)^2,x(x^2+14x+19)^2]$$ 用$$2x$$取代$$x$$,得到$$q_{uv}=[1225,2450x,35(4x^2+28x+19),70x(4x^2+28x+19),(4x^2+28x+19)^2,2x(4x^2+28x+19)^2]$$ 產生矩陣$$M=\left[\matrix{1225&0&0&0&0&0\cr 0&2450&0&0&0&0\cr 665&980&140&0&0&0\cr 0&1330&1960&280&0&0\cr 361&1064&936&224&16&0\cr 0&722&2128&1872&448&32}\right]$$ LLL化簡$$B=\left[\matrix{3&16&-96&-64&-16&64\cr 49&100&0&160&0&64\cr 115&-166&16&104&96&64\cr 61&32&148&-128&48&128\cr 21&-74&-56&16&224&-128\cr -201&8&132&-32&-48&32}\right]$$ 產生不需要同餘$$N^2$$的方程式 $$\displaystyle r(x)= 3 + 16\left(\frac{x}{2}\right)-96\left(\frac{x}{2}\right)^2 -64\left(\frac{x}{2}\right)^3-16\left(\frac{x}{2}\right)^4 + 64\left(\frac{x}{2}\right)^5$$ $$r(x)=2x^5-x^4-8x^3-24x^2+8x+3=(x-3)(2x-1)(x^3+3x^2+5x+1)$$ 整數解為$$[x=3]$$ (solution) $$[x=3]$$ 驗證答案 (%i7) ev(mod(px,N),solution); (%o7) 0 三次同餘方程式 (%i10) px:x^3-4*x^2-3*x-10; N:1131; h:3; (px) $$x^3-4x^2-3x-10$$ (N) 1131 (h) 3 (%i11) solution:Coppersmith_Howgrave(px,N,h); 參數$$h=3$$ $$p(x)$$最高次方$$k=3$$ $$\displaystyle X=ceiling(\frac{1}{\sqrt{2}}(hk)^{-1/(hk-1)} N^{(h-1)/(hk-1)})=ceiling(\frac{1}{\sqrt{2}} 9 ^{-1/8} 1131^{1/4})=3$$ $$q_{uv}=N^{h-1-v} x^u p(x)^v =[1279161,1279161x,1279161x^2,1131(x^3-4x^2-3x-10),$$ $$1131x(x^3-4x^2-3x-10),1131x^2(x^3-4x^2-3x-10),(x^3-4x^2-3x-10)^2,x(x^3-4x^2-3x-10)^2,x^2(x^3-4x^2-3x-10)^2]$$ 用$$3x$$取代$$x$$得到$$q_{uv}=1279161,3837483x,11512449x^2,1131(27x^3-36x^2-9x-10),$$ $$3393x(27x^3-36x^2-9x-10),10179x^2(27x^3-36x^2-9x-10),(27x^3-36x^2-9x-10)^2,3x(27x^3-36x^2-9x-10)^2,9x^2(27x^3-36x^2-9x-10)^2]$$ 產生矩陣$$M=\left[\matrix{1279161&0&0&0&0&0&0&0&0\cr 0&3837483&0&0&0&0&0&0&0\cr 0&0&11512449&0&0&0&0&0&0\cr -11310&-10179&-40716&30537&0&0&0&0&0\cr 0&-33930&-30537&-122148&91611&0&0&0&0\cr 0&0&-101790&-91611&-366444&274833&0&0&0\cr 100&180&801&108&810&-1944&729&0&0\cr 0&300&540&2403&324&2430&-5832&2187&0\cr 0&0&900&1620&7209&972&7290&-17496&6561}\right]$$ LLL化簡$$B=\left[\matrix{100&180&801&108&810&-1944&729&0&0\cr 100&480&1341&2511&1134&486&-5103&2187&0\cr 0&300&1440&4023&7533&3402&1458&-15309&6561\cr -10710&-9099&-35910&31185&4860&-11664&4374&0&0\cr -1020&-3108&-13203&-21114&-43335&-39609&-37908&-15309&39366\cr -10410&-40689&-60804&-76221&100845&-2916&-28431&13122&0\cr 1542&18561&31473&86157&29808&100602&181521&269001&426465\cr 1222511&-52875&-208521&136539&-9963&-13608&26973&4374&-6561\cr -225150&3376488&-1106784&-423009&379647&-50787&-80190&54675&59049}\right]$$ 產生不需要同餘$$N^2$$的方程式 $$\displaystyle r(x)=100 + 180\left(\frac{x}{3}\right)+801\left(\frac{x}{3}\right)^2+108\left(\frac{x}{3}\right)^3+810\left(\frac{x}{3}\right)^4-1944\left(\frac{x}{3}\right)^5+729\left(\frac{x}{3}\right)^6+0\left(\frac{x}{3}\right)^7+0\left(\frac{x}{3}\right)^8$$ $$r(x)=x^6-8x^5+10x^4+4x^3+89x^2+60x+100=(x-5)^2(x^2+x+2)^2$$ 整數解為$$[x=5]$$ (solution) $$[x=5]$$ 驗證答案 (%i12) ev(mod(px,N),solution); (%o12) 0 作者: bugmens 時間: 2022-2-22 23:51 1-1.刻板訊息(Stereotyped Messages) 銀行要傳送底下的訊息給客戶 Your pin no is ****，其中****為四位數密碼 將明文按英文字母轉換成數字(空白$$=00,A=01,B=02,...,Z=26$$，不分大小寫) 設明文$$M=B+x$$，其中$$B=25152118001609140014150009190000$$，密碼$$0\le x <10000$$ 採用RSA方案將明文加密，其中公鑰$$e=3$$，$$N=54957464841358314276864542898551$$ 得到密文$$C\equiv M^e \equiv (B+x)^3\equiv 37393323096087665763922106857101 \pmod{N}$$要如何找出密碼$$x$$呢？ 參考資料： Cryptanalytic Attacks on RSA，https://books.google.com.tw/book ... e&q&f=false 請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.45.1\share\maxima\5.45.1\share目錄下 要先載入LLL.mac才能使用Coppersmith_Howgrave指令 (%i1) load("LLL.mac"); (%o1) C:/maxima-5.45.1/share/maxima/5.45.1/share/LLL.mac 明文訊息 (%i2) m:"Your pin no is"; (m) Your pin no is 這個範例不區分大小寫，統一轉成大寫字母 (%i3) m:supcase(m); (m) YOUR PIN NO IS 明文訊息轉成list (%i4) mlist:charlist(m); (mlist) [Y,O,U,R, ,P,I,N, ,N,O, ,I,S] 明文轉成數字B (%i5) B:0; (B) 0 將明文訊息按照字母順序轉換成數字(空白=00,A=01,B=02,...,Z=26) (%i7) for i:1 thru length(mlist) do (if mlist[ i ]=" " then (B:B*100+0)/*空白就補上00*/ else/*其他就乘100倍再加上英文字母的順序*/ (B:B*100+cint(mlist[ i ])-cint("A")+1) )$
B;

(%o7)　2515211800160914001415000919

(%i8)　B:B*10000;
(B)　25152118001609140014150009190000

(%i9)　e:3;
(e)　3

(%i10)　N:54957464841358314276864542898551;
(N)　54957464841358314276864542898551

(%i11)　C:37393323096087665763922106857101;
(C)　37393323096087665763922106857101

(%i12)　M:B+x;
(M)　$$x+25152118001609140014150009190000$$

(%i13)　px:M^e-C;
(px)　$$(x+25152118001609140014150009190000)^3-37393323096087665763922106857101$$

(%i14)　px:polymod(px,N);
(px)　$$x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263$$

(%i15)　h:3;
(h)　3

(%i16)　x:Coppersmith_Howgrave(px,N,h);

$$p(x)$$最高次方$$k=3$$
$$\displaystyle X=ceiling(\frac{1}{\sqrt{2}}(hk)^{-1/(hk-1)}N^{(h-1)/(hk-1)})$$
$$=ceiling(\frac{1}{\sqrt{2}}9^{-1/8}54957464841358314276864542898551^{1/4})=46260610$$
$$q_{uv}=N^{h-1-v}x^u p(x)^v=$$
$$[3020322941789135243826751301254310584993059920451586964677899601,$$
$$3020322941789135243826751301254310584993059920451586964677899601x,$$
$$3020322941789135243826751301254310584993059920451586964677899601x^2,$$
$$54957464841358314276864542898551(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263),$$
$$54957464841358314276864542898551x(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263),$$
$$54957464841358314276864542898551x^2(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263),$$
$$(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263)^2,$$
$$x(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263)^2,$$
$$x^2(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263)^2]$$

$$[3020322941789135243826751301254310584993059920451586964677899601,$$
$$139721981684159887751924249514318172791235797686641888454048089061016610x,$$
$$6463624103118063744935544456324562407407970654820642611436221569296955598732100x^2,$$
$$54957464841358314276864542898551(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263),$$
$$2542365847614788847019462641858137376110x(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263),$$
$$117611394953827177084317023684568968482648027100x^2(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263),$$
$$(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263)^2,$$
$$46260610x(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263)^2,$$
$$2140044037572100x^2(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263)^2]$$

LLL化簡$$B=\left[\matrix{ 1346829011992131838415424923205840084705445702496636688958&-45179677717016066583753308148255943279532835707102039947418400&-57317453167676354735698331555650210546427932428564618523281700&55022492206313287028619713807534065142711418176206799219594000&-9126018929197534844882170642391266050994818115932677074230000&-74312694674165829957248058752411116787238498594388701682800000&-19823407733951640707057856074266278764703362315244543316000000&138583699736138999822205248506077392755142831146437181570000000&20974462546710273066928434544050339130507985738616528100000000\cr -5902801572552400483890393706301403464838435984190741057521&198017000397961977217885428384176729067567197716265205355728090&42767563064370999055058464552273491314630668309914422404759500&-118669599523559088891420124095064243299234055073696904508477000&5351963749137648019221242354483616465414282780748646299580000&-112004086186351949887374756082813158190757018854244406606700000&-81397469992098637889082971258651279103671999211513531483000000&-10896835906406582990864300928074561497704329125231160360000000&0\cr 3508846630479685748619833227116965930963020713923238512016&-117708907048737798457372393976462193778029056413142461742828970&-19527888444159534716576393306673687254846408168280511459649900&27139572631435639962886919071578980327487934016822772654740000&152842267767879348291763951826981942119544813261287552570070000&-27976405711844657161410593106590342431253966526607082103400000&113524558112017051054823008390937950572260639715265074131000000&-73696712976382536265834206929658681977733154502070358350000000&-20974462546710273066928434544050339130507985738616528100000000\cr -698639478405741507601710852229901400525255812179741745660&23434582306738882194913520923528306099741489318995435888835520&77832343453161261306864164010036521096392268014746035430400000&-19810469901945597112216075834712042329629980808126434227417000&11981172299793958495319504252438495583021639688484388874570000&123052851048114992637170087912139575579626631163057082528500000&-77828623800639953659282136255768504523687584641815030167000000&45046935686004396852036235081258646064208160740318079740000000&83897850186841092267713738176201356522031942954466112400000000\cr 2608388682960311335109469583103966794580680761470012241110&-87504293274733197882640504831875268439796045643230655421800670&67355084330066865588347641681926665747584588920990302572315700&49518826646218754489406268633116221438926982129998391470769000&-76798282830980653021742983335907095096227676638334916897480000&8588117181290281381087324090049898257206127303677712526400000&128047976903282825900283462166286459364396690101948932088000000&88906907910860169021868087433507208597965866101930374390000000&-41948925093420546133856869088100678261015971477233056200000000\cr -1995198218937024623232349557084188775094976064244671057536&66932114210862830110104110182574512142599015426308136347603390&-7269506494572805968382600910891268087690791621484198916104800&8746942221093256881071752182172494956975331200299995572349000&135289672986284673880862945002578814813571416764191759148860000&57336532483012033414667813522314757646899794385904686577900000&98003299188098351389493461699129078727854830331097773587000000&76794339087563318362316609668062911023749796992816963810000000&-20974462546710273066928434544050339130507985738616528100000000\cr 1080486934579740147709503727342917433192987867804798211748&-36248047630075260993070370343206373336745272044257160933612290&50432291648410244801921487663386649765799516063041448619617700&-110728984816423069966245765896893991877601482453715569174801000&47751944909992951034160485499982734778235628595949271138960000&92499399504781570519595347939458299088542884224606869328000000&-23368916165677269442994314666846991564283577282956230451000000&47762871511471852576044187070952438440777872791839177960000000&-83897850186841092267713738176201356522031942954466112400000000\cr -1351209723281976538802605297703889071606362629555587092791&45325239305457343576462953756357480589591441740795953594944820&104141687489491357694257317408495876883875779940487417687370100&56013394445295195456052555118633049318801173303376655543288000&43928806144132011144005796648574152800734722604776425309230000&-52583333463842986422341946819648968524622281916459256843100000&-190189161265649279450477135329996455520381986431990693226000000&28230740167810844364671917022661043622253814284451493460000000&-41948925093420546133856869088100678261015971477233056200000000\cr 3020322941789135243826751301254310584993059920451586964677899601&0&0&0&0&0&0&0&0}\right]$$

$$r(x)= 1346829011992131838415424923205840084705445702496636688958$$
$$\displaystyle -45179677717016066583753308148255943279532835707102039947418400\left(\frac{x}{46260610}\right)$$
$$\displaystyle -57317453167676354735698331555650210546427932428564618523281700\left(\frac{x}{46260610}\right)^2$$
$$\displaystyle +55022492206313287028619713807534065142711418176206799219594000\left(\frac{x}{46260610}\right)^3$$
$$\displaystyle -9126018929197534844882170642391266050994818115932677074230000\left(\frac{x}{46260610}\right)^4$$
$$\displaystyle -74312694674165829957248058752411116787238498594388701682800000\left(\frac{x}{46260610}\right)^5$$
$$\displaystyle -19823407733951640707057856074266278764703362315244543316000000\left(\frac{x}{46260610}\right)^6$$
$$\displaystyle +138583699736138999822205248506077392755142831146437181570000000\left(\frac{x}{46260610}\right)^7$$
$$\displaystyle +20974462546710273066928434544050339130507985738616528100000000\left(\frac{x}{46260610}\right)^8$$

$$r(x)= x^8+305655817x^7-2022600838087156x^6-350756908723576394560428x^5$$
$$-1992672579437965292192928201903x^4+555784194569846483233547842537557231074x^3$$
$$-26783305465388245970449493154965416028246066377x^2$$
$$-976633851499495285162761756670652273706136510242775440x$$
$$+1346829011992131838415424923205840084705445702496636688958$$

$$=(x-1379)(x^7+305657196x^6-2022179336813872x^5-350759697308881860889916x^4$$
$$-1993156277060554240279095396067x^3+555781446007340416729250497665006054681x^2$$
$$-26782539042774201848014823518529135984896661278x-976670784620835270787110169112284325384659682738677802)$$

(x)　$$[x=1379]$$

(%i17)　mod((B+rhs(x[1]))^e-C,N);
(%o17)　0

1-2.刻板訊息(Stereotyped Messages)

(1)已知部分$$B=2^kb$$，例如"October 19, 1995.The secret key for the day is"的ASCII值。
(2)未知部分$$x$$，例如"Squeamish Ossifrage"，$$x$$小於$$\displaystyle N^{\frac{1}{3}}$$。

Coppersmith, D. Small Solutions to Polynomial Equations, and Low Exponent RSA Vulnerabilities. J. Cryptology 10, 233–260 (1997).
https://www.di.ens.fr/~fouque/ens-rennes/coppersmith.pdf

(%o1)　C:/maxima-5.45.1/share/maxima/5.45.1/share/LLL.mac

(%i2)　m:"October 19,1995.The secret key for the day is";
(m)　$$October 19,1995.The secret key for the day is$$

(%i3)　mlist:charlist(m);
(mlist)　$$[O,c,t,o,b,e,r, ,1,9,,,1,9,9,5,.,T,h,e, ,s,e,c,r,e,t, ,k,e,y, ,f,o,r, ,t,h,e, ,d,a,y, ,i,s]$$

(%i4)　B:0;
(B)　$$0$$

(%i6)
for i:1 thru length(mlist) do
(B:B*1000+cint(mlist[ i ])
)$B; (%o6) $$79099116111098101114[94 digits]32100097121032105115$$ 密碼x長度19(通常要猜測很多次，為了簡化過程設為已知) (%i7) length:19; (length) $$19$$ 最後19位000為密碼x (%i8) B:B*1000^length; (B) $$79099116111098101114[151 digits]00000000000000000000$$ 公鑰e (%i9) e:3; (e) $$3$$ 使用RSA-230作為此次的公鑰N，因為密碼x小於上界X https://en.wikipedia.org/wiki/RSA_numbers#RSA-230 (%i10) N:17969491597941066732916128449573246156367561808012600070888918835531726460341490933493372247868650755230855864199929221814436684722874052065257937495694348389263171152522525654410980819170611742509702440718010364831638288518852689; (N) $$17969491597941066732[190 digits]64831638288518852689$$ 密文C (%i11) C:3601065602437181695470302568875441014033597674933932563017313054187328842620219291572818766268178751411814560562534443426266396400495371407624162345901468773333852250822392143444872355448117811583996009775475129299419544905929790; (C) $$36010656024371816954[189 digits]29299419544905929790$$ 明文M，其中x為19位密碼 (%i12) M:B+x; (M) $$x+79099116111098101114[151 digits]00000000000000000000$$ 產生方程式p(x)≡(B+x)^e-C(mod N) (%i13) px:M^e-C; (px) $$(x+79099116111098101114[151 digits]00000000000000000000)^3$$ $$-36010656024371816954[189 digits]29299419544905929790$$ 方程式p(x)同餘N (%i14) px:polymod(px,N); (px) $$x^3$$ $$+23729734833329430334[152 digits]00000000000000000000x^2$$ $$+57518597415676200644[189 digits]30736530413029557356x$$ $$-78610106704918417037[189 digits]64951518554580927445$$ 參數h (%i15) h:3; (h) $$3$$ 呼叫Coppersmith_Howgrave副程式，找符合p(x)≡0(mod N)的較小的解x 執行時間需1965秒(32分鐘) (%i18) showtime:true$
x:Coppersmith_Howgrave(px,N,h);
showtime:false$Evaluation took 0.0000 seconds (0.0000 elapsed) using 0 bytes. 參數$$h=3$$ $$p(x)$$最高次方$$k=3$$ $$\displaystyle X=ceiling(\frac{1}{\sqrt{2}} {{(hk)}^{-1/(hk-1)}} {{N}^{(h-1)/(hk-1)}} )$$ $$\displaystyle =ceiling(\frac{1}{\sqrt{2}} 9^{\frac{-1}{8}} 17969491597941066732[190 digits]64831638288518852689^{\frac{1}{4}})$$ $$=1106212689453879191977235208036134814768946283886104135857$$ $$q_{uv}=N^{h−1−v}x^u p(x)^v=$$ $$[32290262828847459190[419digits]60277520976882530721,$$ $$32290262828847459190[419digits]60277520976882530721x,$$ $$32290262828847459190[419digits]60277520976882530721x^2,$$ $$17969491597941066732[190digits]64831638288518852689(x^3+23729734833329430334[152digits]00000000000000000000x^2+57518597415676200644[189digits]30736530413029557356x−78610106704918417037[189digits]64951518554580927445),$$ $$17969491597941066732[190digits]64831638288518852689x(x^3+23729734833329430334[152digits]00000000000000000000x^2+57518597415676200644[189digits]30736530413029557356x−78610106704918417037[189digits]64951518554580927445),$$ $$17969491597941066732[190digits]64831638288518852689x^2(x^3+23729734833329430334[152digits]00000000000000000000x^2+57518597415676200644[189digits]30736530413029557356x−78610106704918417037[189digits]64951518554580927445),$$ $$(x^3+23729734833329430334[152digits]00000000000000000000x^2+57518597415676200644[189digits]30736530413029557356x−78610106704918417037[189digits]64951518554580927445)^2,$$ $$x(x^3+23729734833329430334[152digits]00000000000000000000x^2+57518597415676200644[189digits]30736530413029557356x−78610106704918417037[189digits]64951518554580927445)^2,$$ $$x^2(x^3+23729734833329430334[152digits]00000000000000000000x^2+57518597415676200644[189digits]30736530413029557356x−78610106704918417037[189digits]64951518554580927445)^2]$$ 用$$1106212689453879191977235208036134814768946283886104135857x$$取代$$x$$,得到$$q_{uv}=$$ $$[32290262828847459190[419digits]60277520976882530721,$$ $$35719898487071973003[476digits]68945401330960162897x,$$ $$39513804972403437655[533digits]07174654938138697729x^2,$$ $$17969491597941066732[190digits]64831638288518852689(13536796742957524728[132digits]22453052799644267793x^3+29038231098365304034[266digits]00000000000000000000x^2+63627802340810115187[246digits]11462962337597714092x−78610106704918417037[189digits]64951518554580927445),$$ $$19878079628677272620[247digits]72697393439425769473x(13536796742957524728[132digits]22453052799644267793x^3+29038231098365304034[266digits]00000000000000000000x^2+63627802340810115187[246digits]11462962337597714092x−78610106704918417037[189digits]64951518554580927445),$$ $$21989383927217453979[304digits]76931392169955293361x^2(13536796742957524728[132digits]22453052799644267793x^3+29038231098365304034[266digits]00000000000000000000x^2+63627802340810115187[246digits]11462962337597714092x−78610106704918417037[189digits]64951518554580927445),$$ $$(13536796742957524728[132digits]22453052799644267793x^3+29038231098365304034[266digits]00000000000000000000x2+63627802340810115187[246digits]11462962337597714092x−78610106704918417037[189digits]64951518554580927445)^2,$$ $$1106212689453879191977235208036134814768946283886104135857x(13536796742957524728[132digits]22453052799644267793x^3+29038231098365304034[266digits]00000000000000000000x^2+63627802340810115187[246digits]11462962337597714092x−78610106704918417037[189digits]64951518554580927445)^2,$$ $$12237065143087845640[75digits]14878644880713124449x^2(13536796742957524728[132digits]22453052799644267793x^3+29038231098365304034[266digits]00000000000000000000x^2+63627802340810115187[246digits]11462962337597714092x−78610106704918417037[189digits]64951518554580927445)^2]$$ 產生矩陣 $$M=\left[\matrix{32290262828847459190[419 digits]60277520976882530721 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0\cr 0 & 35719898487071973003[476 digits]68945401330960162897 & 0 & 0 & 0 & 0 & 0 & 0 & 0\cr 0 & 0 & 39513804972403437655[533 digits]07174654938138697729 & 0 & 0 & 0 & 0 & 0 & 0\cr -14125836519472822098[419 digits]94489721632952149605 & 11433592595586423031[476 digits]00952654252887393388 & 52180224974114632454[495 digits]00000000000000000000 & 24324935533561123862[361 digits]49738464971834145377 & 0 & 0 & 0 & 0 & 0\cr 0 & -15626179606991854661[476 digits]60211676569108886485 & 12647985215283616321[533 digits]86656469202955513516 & 57722427004923821310[552 digits]00000000000000000000 & 26908552357372882659[418 digits]46542924612696483089 & 0 & 0 & 0 & 0\cr 0 & 0 & -17285878168939820519[533 digits]81089654330431192645 & 13991361741171790418[590 digits]88089882508863743212 & 63853281218922005140[609 digits]00000000000000000000 & 29766582072559977503[475 digits]49821745201359022273 & 0 & 0 & 0\cr 61795488761586594662[418 digits]61228105756354228025 & -10003576662821081972[476 digits]14874260906612109880 & 40484972307212011736[532 digits]19137568143775384464 & 36952776573071059484[552 digits]95736854560233442230 & 84321886532206985153[571 digits]51737087375795677912 & 78616926430719870707[437 digits]00000000000000000000 & 18324486606014544982[303 digits]47263486203097090849 & 0 & 0\cr 0 & 68358953819071673294[475 digits]53451685880956792425 & -11066083444337370707[533 digits]78657042708931967160 & 44784990098426820113[589 digits]33285895980663125648 & 40877630355685238072[609 digits]16675173406681041110 & 93277940880617523876[628 digits]85134090008262090584 & 86967041623524387424[494 digits]00000000000000000000 & 20270779611300936552[360 digits]36453950823767472593 & 0\cr 0 & 0 & 75619542152448801923[532 digits]51332599109148483225 & -12241441928681489685[590 digits]25369415714902456120 & 49541724343946082466[646 digits]63054918145653160336 & 45219353414264099481[666 digits]97424893201642081270 & 10318524184826785550[686 digits]19237039307576470488 & 96204045008206368850[551 digits]00000000000000000000 & 22423793631144068882[417 digits]59771418125196067201}\right]$$ $$LLL$$化簡 $$B=\left[\matrix{-35743980059088545200[416 digits]80722642160047905681 & 46922824634222774487[417 digits]96446709945328871477 & 16364540563595223391[417 digits]91327750786549963386 & -97207301925654907852[417 digits]53799084107614558498 & -68006717288291680917[417 digits]14045799605521273218 & -22083850301737135483[417 digits]51281936303530818568 & 80777391656482090011[417 digits]81364384503413938164 & -18875467394270883798[417 digits]16922840533503730786 & 0\cr -53855497698579115104[416 digits]22440422365250280904 & 74325972788911786534[417 digits]02667487696764782596 & -42360213040583351016[417 digits]52953633850159392540 & 93207789824932536615[417 digits]17899116640251965907 & 26743295137275436286[417 digits]30025365712179588699 & -19280506252185172185[417 digits]53869638507983632983 & -49522216738980310653[416 digits]09740058127199728661 & -54329652874359117291[417 digits]64740529713402819815 & 22423793631144068882[417 digits]59771418125196067201\cr 59886248145072283776[415 digits]00597316332236055074 & -13315128391293646051[417 digits]79917797014472050911 & 62558879042844919377[417 digits]09791573964335271861 & 11609344509786149688[418 digits]01042210268547527184 & -27368204832572340597[417 digits]17047835340290094121 & 17836124237718092338[417 digits]01896389102994872252 & -41032209045239051117[417 digits]16172892730225165900 & -59903924262576322974[417 digits]02209538630728871520 & -67271380893432206647[417 digits]79314254375588201603\cr 18422321777782777023[416 digits]59447344137439501243 & -21083022289790045344[417 digits]50420523383747574118 & -36876219378162584256[417 digits]55085598948970130728 & -12380026876101576575[418 digits]54404726405388353366 & 88756932911925724699[417 digits]97537235101170684352 & -14639498730317377843[418 digits]26252864402197471613 & -24797076405414559994[417 digits]60370312150796367236 & -16040594956631378629[418 digits]88876469069441734095 & 22423793631144068882[417 digits]59771418125196067201\cr -59740829062319787233[416 digits]40688909484194485472 & 69491369706263632269[417 digits]58027265444373884189 & 12960931735222433006[418 digits]05407821747361781036 & 39543384198825880926[417 digits]32633257986499319708 & 14710427912295166891[418 digits]99414848522999747063 & -49840365686044385742[417 digits]35018273347131338824 & 20876577478866948183[417 digits]89058142685532409209 & 74627815624516244194[417 digits]75977705134307053965 & -44847587262288137765[417 digits]19542836250392134402\cr -68384734181486838572[416 digits]00732056093284927437 & 91066074648706805896[417 digits]03099971016027027675 & -56710682936040096478[416 digits]32559138585047288553 & 72297457020480686195[417 digits]84446444836328742693 & -60533976691011414274[417 digits]31378847662774021892 & -12596396540470275328[418 digits]52090571729875618447 & -10880938062066902538[418 digits]67272557702486748080 & 21211756224520192677[418 digits]36650827112909148313 & 0\cr -81250564085878561445[416 digits]34678304314010262958 & 10619954225570864725[418 digits]68561477549839159629 & 29714549780697273433[417 digits]69298528953401160635 & -43469171935032168882[417 digits]37163962147628359366 & -10442288961713937897[418 digits]86086266267518395545 & 49860675747404052367[416 digits]60024965193505807977 & -13253357916405795479[418 digits]68461980318400142027 & 13768422266804784107[417 digits]71514595120672325344 & 15696655541800848217[418 digits]18399926876372470407\cr 12609739358642155334[417 digits]57802314032806547340 & -17383608959896020481[418 digits]78499216381863868700 & 81673208107847127971[417 digits]29200832824127271546 & -20653954414963469692[417 digits]04471381311357994334 & -31161557914274171485[417 digits]97962853192070185042 & -84798118358121590160[417 digits]88845627108413875920 & 41678440330915146980[417 digits]79753567469752741441 & -85952558727161375791[417 digits]14248221183260863210 & 15696655541800848217[418 digits]18399926876372470407\cr 32200663351089791530[419 digits]57114456451584344136 & 12124879742313456102[418 digits]99114197642093654073 & -25995672476988127625[417 digits]61625883063609429154 & -39995121007223712365[416 digits]35899967467362592591 & -41263422151016244631[417 digits]84020433893341684519 & -41364356553922307668[417 digits]05151574811514451551 & 75825169982584058945[417 digits]71624326376214209503 & -73205120268630001090[417 digits]81663370246906550601 & 22423793631144068882[417 digits]59771418125196067201}\right]$$ 產生不需要同餘$$N^2$$的方程式$$r(x)=$$ $$-35743980059088545200[416 digits]80722642160047905681$$ $$\displaystyle +46922824634222774487[417 digits]96446709945328871477( \frac{x}{1106212689453879191977235208036134814768946283886104135857})$$ $$\displaystyle +16364540563595223391[417 digits]91327750786549963386( \frac{x}{1106212689453879191977235208036134814768946283886104135857})^2$$ $$\displaystyle -97207301925654907852[417 digits]53799084107614558498( \frac{x}{1106212689453879191977235208036134814768946283886104135857})^3$$ $$\displaystyle -68006717288291680917[417 digits]14045799605521273218( \frac{x}{1106212689453879191977235208036134814768946283886104135857})^4$$ $$\displaystyle -22083850301737135483[417 digits]51281936303530818568( \frac{x}{1106212689453879191977235208036134814768946283886104135857})^5$$ $$\displaystyle +80777391656482090011[417 digits]81364384503413938164( \frac{x}{1106212689453879191977235208036134814768946283886104135857})^6$$ $$\displaystyle -18875467394270883798[417 digits]16922840533503730786( \frac{x}{1106212689453879191977235208036134814768946283886104135857})^7$$ $$\displaystyle +0(\frac{x}{1106212689453879191977235208036134814768946283886104135857})^8$$ $$r(x)=$$ $$-931166326910674526718530634530395511188484760951215019202x^7$$ $$+44081667002866521292[75 digits]22469878202438872436x^6$$ $$-13331579738644988581[132 digits]48018398665104447624x^5$$ $$-45414785555369089229[189 digits]85106015860347068418x^4$$ $$-71809678294997445547[246 digits]13523136087532093186x^3$$ $$+13372929188694233984[303 digits]93165215585922633914x^2$$ $$+42417543282194563777[360 digits]26324257495544510661x$$ $$-35743980059088545200[416 digits]80722642160047905681$$ $$= -(x-83113117101097109105115104032079115115105102114097103101)$$ $$(931166326910674526718530634530395511188484760951215019202x^6$$ $$-43307745643175267650[75 digits]26182397092150127034x^5$$ $$+97321380036192344236[131 digits]32115288696559115190x^4$$ $$+46223653880907932101[189 digits]89490665635112272608x^3$$ $$+75651470252841928353[246 digits]55691765552926250594x^2$$ $$-70852996826996182688[302 digits]24287941312942141920x$$ $$-43006424624419143341[360 digits]20196969789558604581)$$ 整數解為$$[x=83113117101097109105115104032079115115105102114097103101]$$ Evaluation took 1965.2180 seconds (1977.6340 elapsed) using 132237.506 MB.} (x) $$[x=83113117101097109105115104032079115115105102114097103101]$$ 將密碼x從個位數開始每3位數分隔出一個數字 (%i19) makelist(mod(floor(rhs(x[1])/1000^i),1000),i,length-1,0,-1); (%o19) $$[83,113,117,101,97,109,105,115,104,32,79,115,115,105,102,114,97,103,101]$$ 每一個數字轉換成ASCII表示法 (%i20) makelist(ascii(i),i,%); (%o20) $$[S,q,u,e,a,m,i,s,h, ,O,s,s,i,f,r,a,g,e]$$ 將list組合成字串，得到密碼 (%i21) simplode(%); (%o21) $$Squeamish$$ $$Ossifrage$$ 作者: bugmens 時間: 2022-3-17 09:42 2-1.兩個訊息有仿射關係 兩個訊息$$m_1$$和$$m_2=\alpha m_1+\beta$$有仿射關係(affine relation) 經由RSA加密，公鑰$$e=3$$，得到密文$$\cases{c_1=m_1^3 \pmod{N} \cr c_2=m_2^3 \pmod{N}}$$ 若已知$$c_1,c_2,\alpha,\beta,N$$就可以回復明文 $$\displaystyle \frac{\beta(c_2+2\alpha^3 c_1-\beta^3)}{\alpha(c_2-\alpha^3 c_1+2\beta^3)}=\frac{3\alpha^3\beta m_1^3+3\alpha^2 \beta^2 m_1^2+3\alpha \beta^3 m_1}{3 \alpha^3 \beta m_1^2+3\alpha^2 \beta^2 m_1+3 \alpha \beta^3}=m_1 \pmod{N}$$ 上面的式子可以從$$m_1^3-c_1,(\alpha m_1+\beta)^3-c_2$$計算歐幾里得演算法得到最大公因式。 若$$\alpha=\beta=1$$，則 $$\displaystyle \frac{(m+1)^3+2m^3-1}{(m+1)^3-m^3+2}=\frac{3m^3+3m^2+3m}{3m^2+3m+3}=m \pmod{N}$$ 同樣RSA加密，換公鑰$$e=5$$，得到密文$$\cases{c_1=m^5 \pmod{N}\cr c_2=(m+1)^5\pmod{N}}$$ $$P(m)=c_2^3-3c_1c_2^2+3c_1^2c_2-c_1^3+37c_2^2+176c_1c_2+37c_1^2+73c_2-73c_1+14$$ $$mP(m)=2c_2^3-1c_1c_2^2-4c_1^2c_2+3c_1^3+14c_2^2-88c_1c_2-51c_1^2-9c_2+64c_1-7$$ $$\displaystyle m=\frac{mP(m)}{P(m)}$$ 令$$z$$為未知的訊息$$m$$，則$$z$$滿足這兩個方程式$$\cases{z^5-c_1\equiv 0\pmod{N}\cr (z+1)^5-c_2\equiv 0\pmod{N}}$$ 應用歐幾里得演算法找到最大公因式$$gcd(z^5-c_1,(z+1)^5-c_2)\in Z/N[z]$$，得到線性多項式$$z-m$$。 參考資料： Coppersmith D., Franklin M., Patarin J., Reiter M. (1996) Low-Exponent RSA with Related Messages. In: Maurer U. (eds) Advances in Cryptology — EUROCRYPT ’96. EUROCRYPT 1996. Lecture Notes in Computer Science, vol 1070. Springer, Berlin, Heidelberg. https://link.springer.com/chapter/10.1007%2F3-540-68339-9_1 https://link.springer.com/content/pdf/10.1007/3-540-68339-9_1.pdf 顯示數字的全部位數會造成版面凌亂，將太長的數字縮短顯示 功能表選取，編輯/設定/Worksheet/Maximum displayed number of digits調整為80 多項式輾轉相除法副程式 (%i1) GCD(fx1,fx2,var):=block([temp], fx1:expand(fx1), fx2:expand(fx2), while hipow(fx2,var)#1 do (temp:fx2, print(fx1,"除以",fx2,"餘式",fx2:remainder(fx1,fx2,var)), fx1:temp ), fx2 )$

(%i3)
fx1:m1^3-c1;
fx2: (alpha*m1+beta)^3-c2;

(fx1)　$$m_1^3-c_1$$
(fx2)　$$(\alpha m_1+\beta)^3-c_2$$

(%i4)　GCD:GCD(fx1,fx2,m1);
$$m_1^3-c_1$$除以$$\alpha^3m_1^3+3\alpha^2\beta m_1^2+3\alpha\beta^2m_1-c_2+\beta^3$$餘式$$\displaystyle -\frac{3\alpha^2\beta m_1^2+3\alpha\beta^2m_1-c_2+\alpha^3c_1+\beta^3}{\alpha^3}$$
$$\alpha^3m_1^3+3\alpha^2\beta m_1^2+3\alpha\beta^2m_1-c_2+\beta^3$$除以$$\displaystyle -\frac{3\alpha^2\beta m_1^2+3\alpha\beta^2m_1-c_2+\alpha^3c_1+\beta^3}{\alpha^3}$$餘式$$\displaystyle\frac{(\alpha c_2-\alpha^4c_1+2\alpha\beta^3)m1-\beta c_2-2\alpha^3\beta c_1+\beta^4}{3\beta}$$
(GCD)　$$\displaystyle\frac{(\alpha c_2-\alpha^4c_1+2\alpha\beta^3)m1-\beta c_2-2\alpha^3\beta c_1+\beta^4}{3\beta}$$

(%i5)　m1:solve(GCD,m1)[1];
(m1)　$$\displaystyle m_1=\frac{\beta c_2+2 \alpha^3 \beta c_1-\beta^4}{\alpha c_2-\alpha^4 c_1+2 \alpha \beta^3}$$

(%i10)
alpha:3;
beta:5;
N:7790302288510159542362475654705578362485767620973983941084402222135728725117099985850483876481319443405109322651368151685741199347755868542740942256445000879127232585749337061853958340278434058208881085485078737;
c1:132057584044937409231208389323398996878812486949811558724214983072091380989054308161277959733824865068687594213139826622055543700074552293693503940351187203266740911056806170880679978462212228231292575333924006;
c2:3565554769213310049242626511731772915727937147644912090997362096862084038123081043744658925329430451812652081858712220905928591327874274888835176225741122966452992998335410453929161733393892204730002674838955287;

(alpha)　$$3$$
(beta)　$$5$$
(N)　$$77903022885101595423624756[159 digits]78434058208881085485078737$$
(c1)　$$13205758404493740923120838[158 digits]62212228231292575333924006$$
(c2)　$$35655547692133100492426265[159 digits]93892204730002674838955287$$

(%i11)　m1:ev(m1,[alpha=alpha,beta=beta,c1=c1,c2=c2]);
(m1)　$$\displaystyle m_1=\frac{\beta c_2+2 \alpha^3 \beta c_1-\beta^4}{\alpha c_2-\alpha^4 c_1+2 \alpha \beta^3}=\frac{16978832234349095472583935[158 digits]61164325860631773696362722}{51843405275386826203986806[103 digits]08706305166524791817361975}$$

(%i13)
m1:ratsimp(rhs(m1)),modulus:N;
m2:alpha*m1+beta;

warning: assigning 77903022885101595423624756[159 digits]78434058208881085485078737, a non-prime, to 'modulus'
(m1)　$$200805001301070903002315180419000118050019172105011309190800151919090618010705$$
(m2)　$$602415003903212709006945541257000354150057516315033927572400455757271854032120$$

(%i15)
is(power_mod(m1,3,N)=c1);
is(power_mod(m2,3,N)=c2);

(%o14)　$$true$$
(%o15)　$$true$$

(%i16)　kill(m1,m2,alpha,beta,N,c1,c2);
(%o16)　$$done$$

(%i18)
fx1:m1^5-c1;
fx2: (m1+1)^5-c2;

(fx1)　$$m_1^5-c_1$$
(fx2)　$$(m_1+1)^5-c_2$$

(%i19)　GCD:GCD(fx1,fx2,m1)
$$m_1^5-c_1$$除以$$m_1^5+5m_1^4+10m_1^3+10m_1^2+5m_1-c_2+1$$餘式$$-5m_1^4-10m_1^3-10m_1^2-5m_1+c_2-c_1-1$$
$$m_1^5+5m_1^4+10m_1^3+10m_1^2+5m_1-c_2+1$$除以$$-5m_1^4-10m_1^3-10m_1^2-5m_1+c_2-c_1-1$$餘式$$\displaystyle \frac{10m_1^3+15m_1^2+(c_2-c_1+9)m_1-2c_2-3c_1+2}{5}$$
$$-5m_1^4-10m_1^3-10m_1^2-5m_1+c_2-c_1-1$$除以$$\displaystyle \frac{10m_1^3+15m_1^2+(c_2-c_1+9)m_1-2c_2-3c_1+2}{5}$$餘式$$\displaystyle \frac{(2c_2-2c_1-7)m_1^2+(-3c_2-7c_1-7)m_1+2c_2-7c_1-2}{4}$$
$$\displaystyle \frac{10m_1^3+15m_1^2+(c_2-c_1+9)m_1-2c_2-3c_1+2}{5}$$除以$$\displaystyle \frac{(2c_2-2c_1-7)m_1^2+(-3c_2-7c_1-7)m_1+2c_2-7c_1-2}{4}$$餘式$$\displaystyle \frac{4c_2^3+(148-12c_1)c_2^2+(12c_1^2+704c_1+292)c_2-4c_1^3+148c_1^2-292c_1+56)m_1-8c_2^3+(4c_1-56)c_2^2+(16c_1^2+352c_1+36)c_2-12c_1^3+204c_1^2-256c_1+28}{20c_2^2+(-40c_1-140)c_2+20c_1^2+140c_1+245}$$
(GCD)　$$\displaystyle \frac{4c_2^3+(148-12c_1)c_2^2+(12c_1^2+704c_1+292)c_2-4c_1^3+148c_1^2-292c_1+56)m_1-8c_2^3+(4c_1-56)c_2^2+(16c_1^2+352c_1+36)c_2-12c_1^3+204c_1^2-256c_1+28}{20c_2^2+(-40c_1-140)c_2+20c_1^2+140c_1+245}$$

(%i20)　m1:solve(GCD,m1)[1];
(m1)　$$\displaystyle m_1=\frac{2c_2^3+(14-c_1)c_2^2+(-4c_1^2-88c_1-9)c_2+3c_1^3-51c_1^2+64c_1-7}{c_2^3+(37-3c_1)c_2^2+(3c_1^2+176c_1+73)c_2-c_1^3+37c_1^2-73c_1+14}$$

(%i23)
c1:18796237015415790;
c2:7290180156009373;
N:35480779745861123;

(c1)　$$18796237015415790$$
(c2)　$$7290180156009373$$
(N)　$$35480779745861123$$

(%i24)　m1:ev(m1,[c1=c1,c2=c2]);
(m1)　$$\displaystyle m_1=\frac{2c_2^3+(14-c_1)c_2^2+(-4c_1^2-88c_1-9)c_2+3c_1^3-51c_1^2+64c_1-7}{c_2^3+(37-3c_1)c_2^2+(3c_1^2+176c_1+73)c_2-c_1^3+37c_1^2-73c_1+14}=-\frac{43297460062121981374915003596042374969361963498}{7019720390981513672602639591832073102833439091}$$

(%i25)　m1:ratsimp(rhs(m1)),modulus:N;
warning: assigning 35480779745861123, a non-prime, to 'modulus'
(m1)　$$-16036924398274761$$

(%i27)
m1:mod(m1,N);
m2:m1+1;

(m1)　$$19443855347586362$$
(m2)　$$19443855347586363$$

(%i29)
is(power_mod(m1,5,N)=c1);
is(power_mod(m2,5,N)=c2);

(%o28)　$$true$$
(%o29)　$$true$$

2-2.兩個訊息有仿射關係

$$c_1\equiv m_1^3=(2^kM+T_1)^3\pmod{N}$$
$$c_1\equiv m_2^3=(2^kM+T_2)^3\pmod{N}$$

$$t=T_2-T_1$$，$$t=(2^kM+T_2)-(2^kM+T_1)$$，$$t=m_2-m_1$$，$$m_2=m_1+t$$

$$\cases{c_1\equiv m_1^3\pmod{N}\cr c_2\equiv m_2^3\pmod{N}}$$，$$\cases{m_1^3-c1\equiv 0\pmod{N}\cr (m_1+t)^3-c_2\equiv 0\pmod{N}}$$

$$Res_{m_1}(m_1^3-c_1,(m_1+t)^3-c_2)=t^9+(3c_1-3c_2)t^6+(3c_1^2+21c_1c_2+3c_2^2)t^3+(c_1-c_2)^3\equiv 0\pmod{N}$$

$$\displaystyle m_1\equiv \frac{t(c_2+2c_1-t^3)}{c_2-c_1+2t^3}=\frac{t((m_1+t)^3+2m_1^3-t^3)}{(m_1+t)^3-m_1^3+2t^3}=\frac{t(3m_1^3+3m_1^2t+3m_1t^2)}{3m_1^2t+3m_1t^2+3t^3}\pmod{N}$$

D. Coppersmith. Finding a small root of a univariate modular equation. In Proceedings of Eurocrypt 1996, volume 1070 of Lecture Notes in Computer Science, pages 155–165. Springer, 1996.
https://isc.tamu.edu/resources/preprints/1996/1996-02.pdf

 公式 範例 設$$f(x)=a_nx^n+a_{n-1}x^{n-1}+\ldots+a_0$$和 $$g(x)=b_mx^m+b_{m-1}x^{m-1}+\ldots+b_0$$ 是次數為$$n$$和$$m$$的多項式 設$$f(x)$$和$$g(x)$$的Sylvester矩陣為 $$Syl(f,g)=\left[\matrix{a_n&a_{n-1}&\ldots&\ldots&a_0&0&0\cr 0&a_n&a_{n-1}&\ldots&a_1&a_0&0\cr 0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr 0&0&0&a_n&a_{n-1}&\ldots&a_0\cr b_m&b_{m-1}&\ldots&\ldots&b_0&0&0\cr 0&b_m&b_{m-1}&\ldots&b_1&b_0&0\cr 0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr 0&0&0&b_m&b_{m-1}&\ldots&b_0}\right] \matrix{ \cr \cr f(x)取m列\cr \cr \cr \cr g(x)取n列\cr }$$ 則$$f(x)$$和$$g(x)$$的Resultant為Sylvester矩陣的行列式值 $$Res(f,g)=det(Syl(f,g))$$ $$Res(f,g)=\left|\matrix{a_n&a_{n-1}&\ldots&\ldots&a_0&0&0\cr 0&a_n&a_{n-1}&\ldots&a_1&a_0&0\cr 0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr 0&0&0&a_n&a_{n-1}&\ldots&a_0\cr b_m&b_{m-1}&\ldots&\ldots&b_0&0&0\cr 0&b_m&b_{m-1}&\ldots&b_1&b_0&0\cr 0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr 0&0&0&b_m&b_{m-1}&\ldots&b_0}\right|$$ $$f(x)=1x^3+2x^2+3x+4$$ $$g(x)=5x^2+6x+7$$ $$f(x)$$和$$g(x)$$的Sylvester矩陣為 $$Syl(f,g)=\left[\ \matrix{1&2 &3 &4 &0\cr 0 &1&2 &3 &4 \cr 5&6&7&0&0 \cr 0&5&6&7&0 \cr 0&0&5&6&7} \right] \matrix{f(x)取2列\cr \cr \cr g(x)取3列 \cr }$$ $$f(x)$$和$$g(x)$$的Resultant為 $$Res(f,g)= \left|\ \matrix{1&2 &3 &4 &0\cr 0 &1&2 &3 &4 \cr 5&6&7&0&0 \cr 0&5&6&7&0 \cr 0&0&5&6&7} \right|=832$$ 超過3階行列式不能用交叉相乘方式計算，而降階方式計算量又太大，實務上可採用PA=LU分解，再個別計算矩陣$$P,L,U$$的行列式值，$$det(P)\cdot det(A)=det(L)\cdot det(U)$$，進而得到矩陣$$A$$的行列式值。 參考資料：https://ccjou.wordpress.com/2012/04/13/palu-%E5%88%86%E8%A7%A3/ $$P=\left[ \matrix{1&0&0&0&0\cr 0&1&0&0&0\cr 0&0&0&1&0\cr 0&0&1&0&0\cr 0&0&0&0&1}\right]$$，$$det(P)=-1$$ $$L=\left[ \matrix{\displaystyle 1&0&0&0&0\cr 0&1&0&0&0\cr 0&5&1&0&0\cr 5&-4&0&1&0\cr 0&0&-\frac{5}{4}&\frac{1}{2}&1}\right]$$，$$det(L)=1\cdot 1\cdot 1\cdot 1\cdot 1=1$$ $$U=\left[ \matrix{1&2&3&4&0\cr 0&1&2&3&4\cr 0&0&-4&-8&-20\cr 0&0&0&-8&16\cr 0&0&0&0&-26}\right]$$，$$det(U)=1\cdot 1\cdot (-4)\cdot(-8)\cdot(-26)=-832$$ $$\displaystyle Res(f,g)=\frac{det(L)\cdot det(U)}{det(P)}=\frac{1\cdot (-832)}{-1}=832$$ 判斷是否有共同根 若$$Res(f,g)=0$$，則$$f,g$$有共同根 [證明] 設$$x=x_0$$是$$f(x)=0,g(x)=0$$的共同根，則$$f(x_0)=g(x_0)=0$$ $$\left[\matrix{a_n&a_{n-1}&\ldots&\ldots&a_0&0&0\cr 0&a_n&a_{n-1}&\ldots&a_1&a_0&0\cr 0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr 0&0&0&a_n&a_{n-1}&\ldots&a_0\cr b_m&b_{m-1}&\ldots&\ldots&b_0&0&0\cr 0&b_m&b_{m-1}&\ldots&b_1&b_0&0\cr 0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr 0&0&0&b_m&b_{m-1}&\ldots&b_0}\right] \left[\matrix{x_0^{n+m-1}\cr x_0^{n+m-2}\cr \vdots \cr x_0^n \cr x_0^{n-1}\cr \vdots \cr x_0 \cr 1}\right]=\left[\matrix{f(x_0)x_0^{m-1}\cr f(x_0)x_0^{m-2}\cr \vdots \cr f(x_0)x_0 \cr f(x_0)\cr g(x_0)x_0^{n-1} \cr g(x_0)x_0^{n-2}\cr \vdots \cr g(x_0)x_0 \cr g(x_0)} \right]=0$$ $$Syl(f,g)x=0$$是齊次方程組 若$$x$$有非0解，則$$Syl(f,g)$$的行列式值要為0，得到 $$Res(f,g)=\left|\matrix{a_n&a_{n-1}&\ldots&\ldots&a_0&0&0\cr 0&a_n&a_{n-1}&\ldots&a_1&a_0&0\cr 0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr 0&0&0&a_n&a_{n-1}&\ldots&a_0\cr b_m&b_{m-1}&\ldots&\ldots&b_0&0&0\cr 0&b_m&b_{m-1}&\ldots&b_1&b_0&0\cr 0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr 0&0&0&b_m&b_{m-1}&\ldots&b_0}\right|=0$$ $$f(x)=(x^2-1)(x^2+x+2)=x^4+x^3+x^2-x-2$$ $$g(x)=(x^2-1)(x^3+x^2+x-1)=x^5+x^4-2x^2-x+1$$有共同根 設$$x=x_0$$是$$f(x)=0,g(x)=0$$的共同根，則$$f(x_0)=g(x_0)=0$$ $$\left[\matrix{1&1&1&-1&-2&0&0&0&0\cr 0&1&1&1&-1&-2&0&0&0\cr 0&0&1&1&1&-1&-2&0&0\cr 0&0&0&1&1&1&-1&-2&0\cr 0&0&0&0&1&1&1&-1&-2\cr 1&1&0&-2&-1&1&0&0&0\cr 0&1&1&0&-2&-1&1&0&0\cr 0&0&1&1&0&-2&-1&1&0\cr 0&0&0&1&1&0&-2&-1&1}\right] \left[\matrix{x_0^8\cr x_0^7\cr x_0^6\cr x_0^5\cr x_0^4\cr x_0^3\cr x_0^2\cr x_0^1\cr 1} \right]= \left[\matrix{f(x_0)\cdot x_0^4\cr f(x_0)\cdot x_0^3\cr f(x_0)\cdot x_0^2\cr f(x_0)\cdot x_0\cr f(x_0)\cr g(x_0)\cdot x_0^3\cr g(x_0)\cdot x_0^2\cr g(x_0)\cdot x_0\cr g(x_0)} \right]=0$$ $$Syl(f,g)x=0$$是齊次方程組 若$$x$$有非0解，則$$Syl(f,g)$$的行列式值要為0，得到 $$Res(f,g)=\left|\ \matrix{1&1&1&-1&-2&0&0&0&0\cr 0&1&1&1&-1&-2&0&0&0\cr 0&0&1&1&1&-1&-2&0&0\cr 0&0&0&1&1&1&-1&-2&0\cr 0&0&0&0&1&1&1&-1&-2\cr 1&1&0&-2&-1&1&0&0&0\cr 0&1&1&0&-2&-1&1&0&0\cr 0&0&1&1&0&-2&-1&1&0\cr 0&0&0&1&1&0&-2&-1&1}\right|=0$$ 兩變數方項式消除共同變數 $$f(x,y)=0,g(x,y)=0$$為兩變數方程式，已知$$f(x)$$和$$g(x)$$有共同根，可利用Resultant消除共同變數 設$$f(x,y)=x^2y^2-25x^2+9=0$$ $$g(x,y)=4x+y=0$$ 若要消去$$x$$變數，先以$$x$$為變數降冪排列 $$f(x,y)=(y^2-25)x^2+0x+9$$，$$g(x,y)=4x+y$$ 計算$$f(x,y)$$和$$g(x,y)$$的Resultant $$Res_x(f,g)=\left|\ \matrix{y^2-25&0&9 \cr 4&y&0 \cr 0&4&y} \right|\ =y^4-25y^2+144=0$$ 解得$$y=\pm 3,\pm 4$$，代回$$g(x,y)=0$$ 得$$\displaystyle (x,y)=(1,-4),(-1,4),(\frac{3}{4},-3),(-\frac{3}{4},3)$$ 若要消去$$y$$變數，先以$$y$$為變數降冪排列 $$f(x,y)=x^2y^2+0y+(-25x^2+9),g(x,y)=y+4x$$ 計算$$f(x,y)$$和$$g(x,y)$$的Resultant $$Res_y(f,g)=\left|\ \matrix{x^2&0&-25x^2+9 \cr 1&4x&0 \cr 0&1&4x} \right|\ =16x^4-25x^2+9=0$$ 解得$$\displaystyle x=\pm \frac{3}{4},\pm 1$$，代回$$g(x,y)=0$$ 得$$\displaystyle (x,y)=(1,-4),(-1,4),(\frac{3}{4},-3),(-\frac{3}{4},3)$$ 範例出處 http://buzzard.ups.edu/courses/2 ... ts-ups-434-2016.pdf

(%i1)
coeffs(P,x):=block (local(l),l:[],
for i from hipow(P,x) step -1 thru 0 do l:cons(coeff(P,x,i),l),
reverse(l));

(%o1)　coeffs(P,x):=block(local(l),l:[],for i from hipow(P,x) step -1 thru 0 do l:cons(coeff(P,x,i),l),reverse(l))

(%i2)
result(P,Q,x):=block(local(mat,len1,len2,ll1,ll2),
len1:hipow(P,x)+1,
len2:hipow(Q,x)+1,   /* assume len1 >= len2 */
mat:zeromatrix(len1+len2-2,len1+len2-2),
ll1:coeffs(P,x),
ll2:coeffs(Q,x),
for i from 1 thru len2-1 do (
for j from i thru i+len1-1 do (
mat[i,j]:ll1[j-i+1])),
for i from len2 thru len2+len1-2 do (
for j from i-len2+1 thru i do (
mat[i,j]:ll2[j-i+len2])),
mat)$第2個例子 (%i5) f:x^3+2*x^2+3*x+4; g:5*x^2+6*x+7; result(f,g,x); (f) $$x^3+2x^2+3x+4$$ (g) $$5x^2+6x+7$$ (%o5) $$\left[\matrix{1&2&3&4&0\cr 0&1&2&3&4\cr 5&6&7&0&0\cr 0&5&6&7&0\cr 0&0&5&6&7}\right]$$ 計算LU分解 (%i6) [P,L,U]:get_lu_factors(lu_factor(%,generalring)); (%o6) $$[\left[\matrix{1&0&0&0&0\cr 0&1&0&0&0\cr 0&0&0&1&0\cr 0&0&1&0&0\cr 0&0&0&0&1} \right],\left[\matrix{\displaystyle 1&0&0&0&0\cr 0&1&0&0&0\cr 0&5&1&0&0\cr 5&-4&0&1&0\cr 0&0&-\frac{5}{4}&\frac{1}{2}&1} \right],\left[\matrix{1&2&3&4&0\cr 0&1&2&3&4\cr 0&0&-4&-8&-20\cr 0&0&0&-8&16\cr 0&0&0&0&-26} \right]]$$ 計算矩陣P,L,U的行列式值 (%i9) detP:determinant(P); detL:determinant(L); detU:determinant(U); (detP) $$-1$$ (detL) 1 (detU) $$-832$$ 計算行列式值 (%i10) detL*detU/detP; (%o10) 832 第3個例子 (%i14) f:x^4+x^3+x^2-x-2; g:x^5+x^4-2x^2-x+1; result(f,g,x); determinant(%); (f) $$x^4+x^3+x^2-x-2$$ (g) $$x^5+x^4-2*x^2-x+1$$ (%o13) $$\left[\matrix{1&1&1&-1&-2&0&0&0&0\cr 0&1&1&1&-1&-2&0&0&0\cr 0&0&1&1&1&-1&-2&0&0\cr 0&0&0&1&1&1&-1&-2&0\cr 0&0&0&0&1&1&1&-1&-2\cr 1&1&0&-2&-1&1&0&0&0\cr 0&1&1&0&-2&-1&1&0&0\cr 0&0&1&1&0&-2&-1&1&0\cr 0&0&0&1&1&0&-2&-1&1}\right]$$ (%o14) $$0$$ 第4個例子 (%i16) f:x^2*y^2-25*x^2+9; g:4*x+y; (f) $$x^2y^2-25x^2+9$$ (g) $$y+4x$$ 消掉共同變數x (%i19) result(f,g,x); determinant(%); ratsimp(%); (%o17) $$\left[\matrix{y^2-25&0&9\cr 4&y&0\cr 0&4&y}\right]$$ (%o18) $$y^2(y^2-25)+144$$ (%o19) $$y^4-25y^2+144$$ 先解出y (%i20) solve(%,y); (%o20) $$[y=-4,y=4,y=-3,y=3]$$ 將y代回g(x,y)=0求x (%i21) map(lambda([y],[solve(ev(g,y),x)[1],y]),%); (%o21) $$\displaystyle [[x=1,y=-4],[x=-1,y=4],[x=\frac{3}{4},y=-3],[x=-\frac{3}{4},y=3]]$$ 消掉共同變數y (%i23) result(f,g,y); determinant(%); (%o22) $$\left[\matrix{x^2&0&9-25x^2\cr 1&4x&0\cr 0&1&4x}\right]$$ (%o23) $$16x^4-25x^2+9$$ 先解出x (%i24) solve(%,x); (%o24) $$\displaystyle [x=-1,x=1,x=-\frac{3}{4},x=\frac{3}{4}]$$ 將x代回g(x,y)=0求y (%i25) map(lambda([x],[x,solve(ev(g,x),y)[1]]),%); (%o25) $$\displaystyle [[x=-1,y=4],[x=1,y=-4],[x=-\frac{3}{4},y=3],[x=\frac{3}{4},y=-3]]$$ 第1個例子 (%i30) f:m1^3-c1; g: (m1+t)^3-c2; result(f,expand(g),m1); determinant(%); ratsimp(%); (f) $$m1^3-c1$$ (g) $$(t+m1)^3-c2$$ (%o28) $$\left[\matrix{1&0&0&-c1&0&0\cr 0&1&0&0&-c1&0\cr 0&0&1&0&0&-c1\cr 1&3t&3t^2&t^3-c2&0&0\cr 0&1&3t&3t^2&t^3-c2&0\cr 0&0&1&3t&3t^2&t^3-c2}\right]$$ (%o29) $$(t^3-c2)^3+c1((t^3-c2)^2+c1(10t^3-c2)-9t^3(t^3-c2))+c1((t^3-c2)^2-c1(8t^3+c2)+c1(t^3-c2+c1))+c1(3t^2(9t^4-3t(t^3-c2))-(t^3-c2)(8t^3+c2))$$ (%o30) $$t^9+(3c1-3c2)t^6+(3c2^2+21c1c2+3c1^2)t^3-c2^3+3c1c2^2-3c1^2c2+c1^3$$ 也可以使用maxima內建指令計算resultant (%i31) resultant(f,g,m1); (%o31) $$t^9+c1(3t^6+21c2t^3+3c2^2)-3c2t^6+c1^2(3t^3-3c2)+3c2^2t^3-c2^3+c1^3$$ 整理成t的多項式 (%i32) ratsimp(%); (%o32) $$t^9+(3c1-3c2)t^6+(3c2^2+21c1c2+3c1^2)t^3-c2^3+3c1c2^2-3c1^2c2+c1^3$$ 作者: bugmens 時間: 2022-9-3 19:37 2-3.兩個訊息有仿射關係 設明文$$M$$乘$$10^5$$倍，各加上隨機補綴值$$T_1$$和$$T_2$$(假設$$0\le T_1,T_2<10^5,T_1<T_2$$)後$$e=3$$次方同餘$$N$$得到密文$$c_1,c_2$$。 $$c1=1881676371789154860897069000$$ $$c2=1881678004162711039676405223$$ $$N=54957464841358314276864542898551$$ 若2個補綴值$$T_1$$和$$T_2$$很接近，設$$t$$為兩個補綴值的差，$$t$$未知但足夠小($$t<N^{\frac{1}{9}}$$)。 將密文$$c_1,c_2$$，公鑰$$N$$代入9次同餘方程式 $$t^9+(3c_1-3c_2)t^6+(3c_1^2+21c_1c_2+3c_2^2)t^3+(c_1-c_2)^3\equiv 0\pmod{N}$$ 雖然論文說能找到比$$N^{\frac{1}{9}}=3362$$還小的解，但以Coppersmith_Howgrave()副程式精算的上界$$X$$卻小很多。 $$\displaystyle X=ceiling(\frac{1}{\sqrt{2}}(hk)^{-1/(hk-1)}N^{(h-1)/(hk-1)})$$ 設$$h=3$$，9次方程式$$k=9$$，計算出$$X=172$$ 而且會產生$$27 \times 27$$的超大矩陣，導致LLL化簡的時間大幅增加還無法求得較小的解。 換另一個作法，令$$t^3=x$$，先解3次同餘方程式，不僅Coppersmith_Howgrave()副程式精算的上界$$X$$提高很多。 $$x^3+(3c_1-3c_2)x^2+(3c_1^2+21c_1c_2+3c_2^2)x+(c_1-c_2)^3\equiv 0\pmod{N}$$ 設$$h=3$$，3次方程式$$k=3$$，計算出$$X=46260610$$ 而且產生$$9\times 9$$較小的矩陣，LLL化簡的時間變得更短了 所得到的較小$$x$$的解，再解一次3次同餘方程式，得到兩個補綴值的差$$t$$。 $$t^3-x\equiv 0\pmod{N}$$ 再將密文$$c_1,c_2$$，補綴值的差$$t$$，公鑰$$N$$代入以下公式得到有補綴值的$$m_1$$，再將後5位補綴值刪除得到明文$$M$$。 $$\displaystyle m_1\equiv \frac{t(c_2+2c_1-t^3)}{c_2-c_1+2t^3}\pmod{N}$$ 請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.46.0\share\maxima\5.46.0\share目錄下 要先載入LLL.mac才能使用Coppersmith_Howgrave指令 (%i1) load("LLL.mac"); (%o1) C:/maxima-5.46.0/share/maxima/5.46.0/share/LLL.mac 已知密文$$c_1,c_2$$，公鑰$$N$$ (%i4) c1:1881676371789154860897069000; c2:1881678004162711039676405223; N:54957464841358314276864542898551; (c1) 1881676371789154860897069000 (c2) 1881678004162711039676405223 (N) 54957464841358314276864542898551 9次同餘方程式 (%i5) fx:x^9+(3*c1-3*c2)*x^6+(3*c1^2+21*c1*c2+3*c2^2)*x^3+(c1-c2)^3; (fx) $$x^9-4897120668536338008669x^6+95599144073213399280057649148373498671072396308207166187x^3$$ $$-4349693466736349905369332025355097289037604766707550608234921567$$ 同餘方程式係數同餘N，讓係數變小 (%i6) fx:polymod(fx,N); (fx) $$x^9-4897120668536338008669x^6-1516451737447758219766669752498x^3-21000738238808374545647388458802$$ 參數h (%i7) h:3; (h) 3 利用Coppersmith_Howgrave方法解9次同餘方程式，執行時間需2262秒(37分鐘) 但執行結果無法求得較小的整數解，故省略執行過程 (%i10) showtime:true$
Coppersmith_Howgrave(fx,N,h);
showtime:false$... 整數解為[] Evaluation took 2262.6870 seconds (2264.0150 elapsed) using 420496.373 MB. (%o9) [] 令t^3=x，化簡成3次同餘方程式 (%i11) fx:x^3+(3*c1-3*c2)*x^2+(3*c1^2+21*c1*c2+3*c2^2)*x+(c1-c2)^3; (fx) $$x^3-4897120668536338008669x^2+95599144073213399280057649148373498671072396308207166187x$$ $$-4349693466736349905369332025355097289037604766707550608234921567$$ 同餘方程式係數同餘N，讓係數變小 (%i12) fx:polymod(fx,N); (fx) $$x^3-4897120668536338008669x^2-1516451737447758219766669752498x-21000738238808374545647388458802$$ 利用Coppersmith_Howgrave方法解3次同餘方程式，執行時間需43秒 (%i15) showtime:true$
X:Coppersmith_Howgrave(fx,N,h);
showtime:false$Evaluation took 0.0000 seconds (0.0000 elapsed) using 0 bytes. 參數$$h=3$$ $$p(x)$$最高次方$$k=3$$ $$\displaystyle X=ceiling(\frac{1}{\sqrt{2}}(hk)^{-1/(hk-1)}N^{(h-1)/(hk-1)})=ceiling(\frac{1}{\sqrt{2}}9^{-1/8}54957464841358314276864542898551^{1/4})=46260610$$ $$q_uv=N^{h-1-v} x^u p(x)^v =$$ $$[3020322941789135243826751301254310584993059920451586964677899601,$$ $$3020322941789135243826751301254310584993059920451586964677899601x,$$ $$3020322941789135243826751301254310584993059920451586964677899601x^2,$$ $$54957464841358314276864542898551(x^3-4897120668536338008669x^2-1516451737447758219766669752498x-21000738238808374545647388458802),$$ $$54957464841358314276864542898551x(x^3-4897120668536338008669x^2-1516451737447758219766669752498x-21000738238808374545647388458802),$$ $$54957464841358314276864542898551x^2(x^3-4897120668536338008669x^2-1516451737447758219766669752498x-21000738238808374545647388458802),$$ $$(x^3-4897120668536338008669x^2-1516451737447758219766669752498x-21000738238808374545647388458802)^2,$$ $$x(x^3-4897120668536338008669x^2-1516451737447758219766669752498x-21000738238808374545647388458802)^2,$$ $$x^2(x^3-4897120668536338008669x^2-1516451737447758219766669752498x-21000738238808374545647388458802)^2]$$ 用$$46260610x$$取代$$x$$,得到$$q_{uv}=$$ $$[3020322941789135243826751301254310584993059920451586964677899601,$$ $$139721981684159887751924249514318172791235797686641888454048089061016610x,$$ $$6463624103118063744935544456324562407407970654820642611436221569296955598732100x^2,$$ $$54957464841358314276864542898551(98999742604948264981000x^3-10480053887972286407738186731512534900x^2-70151982409893138378920200419106503780x-21000738238808374545647388458802),$$ $$2542365847614788847019462641858137376110x(98999742604948264981000x^3-10480053887972286407738186731512534900x^2-70151982409893138378920200419106503780x-21000738238808374545647388458802),$$ $$117611394953827177084317023684568968482648027100x^2(98999742604948264981000x^3-10480053887972286407738186731512534900x^2-70151982409893138378920200419106503780x-21000738238808374545647388458802),$$ $$(98999742604948264981000x^3-10480053887972286407738186731512534900x^2-70151982409893138378920200419106503780x-21000738238808374545647388458802)^(2),$$ $$46260610x(98999742604948264981000x^3-10480053887972286407738186731512534900x^2-70151982409893138378920200419106503780x-21000738238808374545647388458802)^(2),$$ $$2140044037572100x^2(98999742604948264981000x^3-10480053887972286407738186731512534900x^2-70151982409893138378920200419106503780x-21000738238808374545647388458802)^(2)]$$ 產生矩陣$$M=\left[ \matrix{ 3020322941789135243826751301254310584993059920451586964677899601&0&0&0&0&0&0&0&0\cr 0&139721981684159887751924249514318172791235797686641888454048089061016610&0&0&0&0&0&0&0\cr 0&0&6463624103118063744935544456324562407407970654820642611436221569296955598732100&0&0&0&0&0&0\cr -1154147333401880370164435877744830779893335235336308145728995902&-3855375106843289059874469643405077531431008453876682145059536838022780&-575957193083777435966023818707724430220694882620408968134835546929900&5440774873514967046498526949032608069078072148942531000&0&0&0&0&0\cr 0&-53391559673044361070832604010361296224641422921151169969392245114020220&-178352004221385726316119489130401363701292623991492180806562660444404996695800&-26644131085943325292024201127948743853911779893898517315388054650660801239000&251693564521475219700920220763687359166473755234092339003910000&0&0&0&0\cr 0&0&-2469926119326432700196969469407759883742609255600435024997766588244094929534200&-8250672510003878744676740400060736629653654574347063094341880675381046234195692438000&-1232573756955700653437467678941596939415709824077480689105413794852905568404895790000&11643497827837801763248586973862843084330167466119804398647668985100000&0&0&0\cr 441031006574948269107459443949256719868815747806770028851275204&2946486839047310595109751478204161934049771268347937188112057574543120&4921301076215693158799367543245210199690179969531456795727185981205628668000&1470393112007528062187159841915196407503917007629683675986668119372838320000&109831529494789146606929429768530109268611975609482301299443587987461650000&-2075045274790487347904810593080778841186998131216420673800000&9800949035846008678895673107522190930361000000&0&0\cr 0&20402363393071117647355229427353424907730536471147343664377590214914440&136306278531300406989240120330126235607922189234249266563748531753485202503200&227662389779394457098885610164724803415889536400306605558985017074020917615167480000&68021282301266572748895948454500554080939778162323820958185619069740318114575200000&5080873551661937743415985648044361658132643844999773042316053040888648280606500000&-95992860189425566911358759970378608468403657618931662386599018000000&453397880977148227551007964314572140974967380210000000&0\cr 0&0&943825776005139675748417799999320121820808332782523517793742593671973092208400&6305611591687860920570511402945041036226201306511803963291610965520595093771558952000&10531801025252553016013278646442369888149133646495387760188037870704622801637392876962800000&3146706012238795427973303402033752877122263511053778975056451231393819657574298642872000000&235044309832747753792446979829777477365827565182434950799096426463863811536307859965000000&-4440688268007542274915272165073296358699518927682926250318126398080980000000&20974462546710273066928434544050339130507985738616528100000000}\right]$$ LLL化簡$$B=\left[ \matrix{ 53771676921999198037128719975410481845009948321580737058118762&50209380384868519769271355772363021078882998018525986723096380&107113429339000465042631199484653568414097906566121374434204800&2566158289017059510580947933126354061025546078929008772549000&-39201258910319328503256252507864134476510009966583646884840000&-82244768124108488515911014612606850013994967332618611133000000&-103326720791445976823937028600478023227439055205294880233000000&37553747697339884108136344819118362708215810289041024760000000&-41948925093420546133856869088100678261015971477233056200000000\cr 145771311156080366680612542702670552709050420859148668552121201&-102701813735090026820390486307494510321459974199722868939788630&55690597658188982675500688460805070018767816245101070397610800&-3690675191418901829302352712732398605405813417421315444807000&-34161730786036250811133667107244245173497899683329768637600000&105158149470961723712865498187081390865505368625840232003900000&-83943991120073620894214705274131521444270306664078709465000000&-94290002110963796909267598874077903051034921264274818610000000&0\cr 22520257569452314079351935267514264370266330796992552972684997&-98310513164562058062910678303618723610419189844159039543246600&-59216755675973590492737933555662165421890387526607433485560200&210122354709341487106669358644005820317705567891681532969573000&-13547462576968605065539206672838828517502007656710102017580000&23570869821207231876579884845247791136173699754579501358900000&-40641684543556222622266012007342445503983888770262907798000000&-86958932882212997194203757223689795368058144049335172070000000&41948925093420546133856869088100678261015971477233056200000000\cr 169015127177354263666121860022442922657381338158956682760146316&-44086339219025359808922118654836582121338928607019431900103130&-55743427083965516899322695992901696889154913782390199199450100&-99213756448548832412671199081590293096668700399267187647555000&-13681783036472695133702522618982681148717527439219162384970000&-15336537742431604945023054843850719026627918786732999429600000&64672345006900325309865538762091565046333246270689577751000000&-71951332896677550420724086465591699219582263948746051800000000&62923387640130819200785303632151017391523957215849584300000000\cr -111109391058117478677425543043666767886469428988351808979162264&68706199548070844584789292006960471026818898889658819004932390&114242801459017508543027293838247104016630443508968997031447000&-70229925147280191228538106815486527561582710206602914483698000&-108177296750967223863314840883237590333571940265343423758290000&21114534120011920453814163485385935919207972703328940545600000&-34780235497393011659779194620008032778904564753918395174000000&44536869417475438776116536835516252809621296087125152680000000&83897850186841092267713738176201356522031942954466112400000000\cr 32124330345979841767629832716536687416322338071176926036776624&27164161165425888332075134727974947827481095848187898522695730&-79639511287230298148663766719580830450559479484044659434682900&-51041393060884297450399678845972688262211525661235763838740000&-120857089745132822141399493042839109949450984516626943707450000&220466029767922832433728342036436413650585457627045150329700000&-42081776027182400361358030886271577560506458471894525675000000&58148929768074224345419762221788597120206147540057861770000000&-41948925093420546133856869088100678261015971477233056200000000\cr -118279971490860306266688062364858934470851326591670377750842105&186394623214470748860705331927751369982342478110034345905919190&-5844542338433954468770696410970613047578620794759879329291700&-31690810413815853326709322936928777204830797244545090618294000&36631940618043663684819094023611438217838817287345595588310000&14670122074875238001436616319545787277339265229080644956400000&-87941416624880050595555558070529584290459598827529416836000000&-58985200396438287348022673963584538334771708074420956690000000&62923387640130819200785303632151017391523957215849584300000000\cr -67402575181872320450341662740231249645051561595949203267092646&81687875727598274014317606405009186128237310267665643776123970&-60606071715445114152730683837370692931748434259046928181917500&118448345919188327186093480437680808892299725583302023014092000&5659950991122719764062671142382391292964286805841933824120000&61863373560034972019278274616457949997753618484681115789000000&87493980444210846078712251695585839215963143393159467086000000&-110345238655812995600366365368792036283900354142468092020000000&-125846775280261638401570607264302034783047914431699168600000000\cr 391536656683468813127560730295755766606487863741754115343991921&447549940911495565399271813369673072505177321547345359598698170&345431307115038022995995779076001023195500573892855741305309800&330776015310331719481270882134135987680304349298242517737362000&334129783160230133456909028931418304394164386380225530980110000&298169048606388347296126093056185837124427112397441890970200000&317606145581069503748397520803157118676806368270962392206000000&313838224166290677083070069124989059103490292778965585030000000&440463713480915734405497125425057121740667700510947090100000000}\right]$$ 產生不需要同餘$$N^2$$的方程式 $$r(x)=53771676921999198037128719975410481845009948321580737058118762$$ $$\displaystyle +50209380384868519769271355772363021078882998018525986723096380 ( \frac{x}{46260610} )$$ $$\displaystyle +107113429339000465042631199484653568414097906566121374434204800 ( \frac{x}{46260610} )^2$$ $$\displaystyle +2566158289017059510580947933126354061025546078929008772549000 (\frac{x}{46260610})^3$$ $$\displaystyle -39201258910319328503256252507864134476510009966583646884840000 (\frac{x}{46260610})^4$$ $$\displaystyle -82244768124108488515911014612606850013994967332618611133000000 (\frac{x}{46260610})^5$$ $$\displaystyle -103326720791445976823937028600478023227439055205294880233000000 (\frac{x}{46260610})^6$$ $$\displaystyle +37553747697339884108136344819118362708215810289041024760000000 (\frac{x}{46260610})^7$$ $$\displaystyle -41948925093420546133856869088100678261015971477233056200000000 (\frac{x}{46260610})^8$$ $$r(x)= -2x^8+82827356x^7-10542521995935153x^6-388196401064276818832330x^5-8559622143684325599618510860324x^4$$ $$+25920858191087824461843813370140390129x^3+50051974379238314010577044980314319102425126688x^2+1085359237261863165428889843267588150672526756965072158x+53771676921999198037128719975410481845009948321580737058118762$$ $$= -(x-45499293)(2x^7+8171230x^6+10914307183875543x^5+884789661515435025323429x^4+48816926196345927839271626696021x^3$$ $$+2195214770175831075654032836258741023024x^2+49828745646919485619110961668243162515263595344x+1181813460749801058164326201187576295856068539825019634)$$ 整數解為$$[x=45499293]$$ Evaluation took 43.1100 seconds (43.1220 elapsed) using 5541.766 MB. (X) $$[x=45499293]$$ 再解一次3次同餘方程式 (%i16) fx:x^3-rhs(X[1]); (fx) $$x^3-45499293$$ 利用Coppersmith_Howgrave方法解3次同餘方程式，執行時間需0.328秒 (%i19) showtime:true$
X:Coppersmith_Howgrave(fx,N,h);
showtime:false$Evaluation took 0.0000 seconds (0.0000 elapsed) using 0 bytes. 參數$$h=3$$ p(x)最高次方$$k=3$$ $$\displaystyle X=ceiling(\frac{1}{\sqrt{2}}(hk)^{-1/(hk-1)}N^{(h-1)/(hk-1)})=ceiling(\frac{1}{\sqrt{2}}9^{-1/8}54957464841358314276864542898551^{1/4})=46260610$$ $$q_{uv}=N^{h-1-v} x^u p(x)^v =$$ $$[3020322941789135243826751301254310584993059920451586964677899601,$$ $$3020322941789135243826751301254310584993059920451586964677899601x,$$ $$3020322941789135243826751301254310584993059920451586964677899601x^2,$$ $$54957464841358314276864542898551(x^3-45499293),$$ $$54957464841358314276864542898551x(x^3-45499293),$$ $$54957464841358314276864542898551x^2(x^3-45499293),$$ $$(x^3-45499293)^2,$$ $$x(x^3-45499293)^2,$$ $$x^2(x^3-45499293)^2]$$ 用$$46260610x$$取代$$x$$,得到$$q_uv=$$ $$[3020322941789135243826751301254310584993059920451586964677899601,$$ $$139721981684159887751924249514318172791235797686641888454048089061016610x,$$ $$6463624103118063744935544456324562407407970654820642611436221569296955598732100x^2,$$ $$54957464841358314276864542898551(98999742604948264981000x^3-45499293),$$ $$2542365847614788847019462641858137376110x(98999742604948264981000x^3-45499293),$$ $$117611394953827177084317023684568968482648027100x^2(98999742604948264981000x^3-45499293),$$ $$(98999742604948264981000x^3-45499293)^2,$$ $$46260610x(98999742604948264981000x^3-45499293)^2,$$ $$2140044037572100x^2(98999742604948264981000x^3-45499293)^2]$$ 產生矩陣$$M=\left[ \matrix{ 3020322941789135243826751301254310584993059920451586964677899601&0&0&0&0&0&0&0&0\cr 0&139721981684159887751924249514318172791235797686641888454048089061016610&0&0&0&0&0&0&0\cr 0&0&6463624103118063744935544456324562407407970654820642611436221569296955598732100&0&0&0&0&0&0\cr -2500525795354160459269142958652241224443&0&0&5440774873514967046498526949032608069078072148942531000&0&0&0&0&0\cr 0&-115675848613818628883670707444457456909880090230&0&0&251693564521475219700920220763687359166473755234092339003910000&0&0&0&0\cr 0&0&-5351235319142904201522225965512143075699768000894840300&0&0&11643497827837801763248586973862843084330167466119804398647668985100000&0&0&0\cr 2070185663499849&0&0&-9008836591414248716424316866000&0&0&9800949035846008678895673107522190930361000000&0&0\cr 0&95768051606757749647890&0&0&-416754276109143908313505917054448260000&0&0&453397880977148227551007964314572140974967380210000000&0\cr 0&0&4430288485840093620938676612900&0&0&-19279307032917423776366854961548179721038600000&0&0&20974462546710273066928434544050339130507985738616528100000000}\right]$$ LLL化簡$$B=\left[ \matrix{ 2070185663499849&0&0&-9008836591414248716424316866000&0&0&9800949035846008678895673107522190930361000000&0&0\cr 0&95768051606757749647890&0&0&-416754276109143908313505917054448260000&0&0&453397880977148227551007964314572140974967380210000000&0\cr -2500525795354160459269142958652241224443&0&0&5440774873514967046498526949032608069078072148942531000&0&0&0&0&0\cr 0&0&4430288485840093620938676612900&0&0&-19279307032917423776366854961548179721038600000&0&0&20974462546710273066928434544050339130507985738616528100000000\cr 0&-115675848613818628883670707444457456909880090230&0&0&251693564521475219700920220763687359166473755234092339003910000&0&0&0&0\cr 3020322941789135243826751301254310584993059920451586964677899601&0&0&0&0&0&0&0&0\cr 0&0&-5351235319142904201522225965512143075699768000894840300&0&0&11643497827837801763248586973862843084330167466119804398647668985100000&0&0&0\cr 0&139721981684159887751924249514318172791235797686641888454048089061016610&0&0&0&0&0&0&0\cr 0&0&6463624103118063744935544456324562407407970654820642611436221569296955598732100&0&0&0&0&0&0}\right]$$ 產生不需要同餘$$N^2$$的方程式 $$\displaystyle r(x)= 2070185663499849 + 0 ( \frac{x}{46260610} ) + 0 (\frac{x}{46260610})^2$$ $$\displaystyle -9008836591414248716424316866000 (\frac{x}{46260610})^3 + 0 (\frac{x}{46260610})^4 + 0 (\frac{x}{46260610})^5$$ $$\displaystyle +9800949035846008678895673107522190930361000000 (\frac{x}{46260610})^6 + 0 (\frac{x}{46260610})^7 + 0 (\frac{x}{46260610})^8$$ $$r(x)=x^6-90998586x^3+2070185663499849=(x-357)^2(x^2+357x+127449)^2$$ 整數解為$$[x=357]$$ Evaluation took 0.3280 seconds (0.3280 elapsed) using 88.429 MB. (X) $$[x=357]$$ 從密文$$c_1,c_2$$，兩個補綴值的差$$t=T_2-T_1$$求得加上補綴值得明文$$m_1$$ (%i20) m1:t*(c2+2*c1-t^3)/(c2-c1+2*t^3); (m1) $$\displaystyle \frac{t(5645030747741020761470543223-t^3)}{2t^3+1632373556178779336223}$$ 將$$t$$值帶入$$m_1$$公式 (%i21) ev(m1,t=rhs(X[1])); (%o21) $$1234567890$$ 將後5位補綴值刪除，得到明文M (%i22) M:floor(%/10^5); (M) $$12345$$ 作者: bugmens 時間: 2023-2-15 14:58  方法 範例 問題敘述 相同的明文$$m$$，為明文加上隨機補綴值後加密成$$k$$個密文$$c_i$$。 其中$$\displaystyle \alpha<\frac{k-2}{6k-3}<\frac{1}{6}$$，$$\displaystyle |\; t_i|\;\le \frac{1}{2}N^{\alpha}$$ $$A_0\equiv m^3\pmod N$$，第0個直接三次方不加補綴 $$A_i\equiv (m+t_i)^3 \pmod N$$，第$$i$$個加上補綴後三次方 $$c_i\equiv A_i-A_0\equiv 3m^2t_i+3mt_i^2+t_i^3 \pmod N$$，第$$i$$個減第0個得到密文$$c_i$$ 已知$$c_i,N$$，則透過Coppersmith方法可以回復補綴值$$t_i$$和明文$$m$$。 明文$$m=25152118001609140014150009191379$$ 公鑰$$N=54957464841358314276864542898551$$ 出自Cryptanalytic Attacks on RSA $$k=4$$，$$\displaystyle \alpha=\frac{1}{11}$$，$$\displaystyle \alpha<\frac{4-2}{6\cdot 4-3}<\frac{1}{6}$$ $$t_1=761,t_2=683,t_3=714,t_4=756$$ 其中$$t_1,t_2$$為質數，可以解出明文$$m$$ 但$$t_3=2\cdot 3 \cdot 7\cdot 17,t_4=2^2\cdot 3^3 \cdot 7$$可以分解成小質數乘積，反而無法解出明文$$m$$ $$A_0\equiv m^3 \equiv 37393323096087665763922106857101\pmod{N}$$ $$A_1\equiv (m+761)^3\equiv 21904263018805857488488858542023\pmod{N}$$ $$A_2\equiv (m+683)^3\equiv 37153632560891277497054197384710\pmod{N}$$ $$A_3\equiv (m+714)^3\equiv 18092792378564256587234068711460\pmod{N}$$ $$A_4\equiv (m+756)^3\equiv 39662861356261303674301781451309\pmod{N}$$ 密文 $$c_1\equiv A_1-A_0\equiv 39468404764076506001431294583473\pmod{N}$$ $$c_2\equiv A_2-A_0\equiv 54717774306161926009996633426160\pmod{N}$$ $$c_3\equiv A_3-A_0\equiv 35656934123834905100176504752910\pmod{N}$$ $$c_4\equiv A_4-A_0\equiv 2269538260173637910379674594208\pmod{N}$$ 步驟1：利用恆等式建立矩陣$$M$$的右上角區塊 設下標$$i6\alpha(C_2^k+C_3^k)$$ [證明] $$(3\alpha C_2^k+C_3^k)-6\alpha(C_2^k+C_3^k)$$ $$=(1-6\alpha)C_3^k-3\alpha C_2^k$$ $$\displaystyle =(1-6\alpha)\left[\frac{k(k-1)(k-2)}{6}-\frac{k(k-1)}{2}\right]$$ $$\displaystyle =\frac{k(k-1)}{2}\left[(1-6\alpha)\frac{k-2}{3}-3\alpha \right]$$ $$\displaystyle \frac{k(k-1)}{2}>0$$為正，還需要$$\displaystyle (1-6\alpha)\frac{k-2}{3}-3\alpha>0$$亦為正 $$\displaystyle \frac{1-6\alpha}{\alpha}>\frac{9}{k-2}$$ $$\displaystyle \frac{1}{\alpha}-6>\frac{9}{k-2}$$ $$\displaystyle \frac{1}{\alpha}>\frac{9}{k-2}+\frac{6k-12}{k-2}=\frac{6k-3}{k-2}$$ $$\displaystyle \alpha<\frac{k-2}{6k-3}$$就是當初的條件 步驟可以逆推回去 $$M=\left[\matrix{N^{3\alpha}&&&&&&c_3&c_4&&\cr &N^{3\alpha}&&&&&-c_2&&c_4&\cr &&N^{3\alpha}&&&&&-c_2&-c_3&\cr &&&N^{3\alpha}&&&c_1&&&c_4\cr &&&&N^{3\alpha}&&&c_1&&-c_3\cr &&&&&N^{3\alpha}&&&c_1&c_2\cr &&&&&&N&&&\cr &&0&&&&&N&&\cr &&&&&&&&N&\cr &&&&&&&&&N}\right]$$ $$r=[\displaystyle d_{12},d_{13},d_{14},d_{23},d_{24},d_{34},$$ $$\displaystyle \frac{e_{123}-(d_{12}c_3+d_{23}c_1-d_{13}c_2)}{N},$$ $$\displaystyle \frac{e_{124}-(d_{12}c_4+d_{24}c_1-d_{14}c_2)}{N},$$ $$\displaystyle \frac{e_{134}-(d_{13}c_4+d_{34}c_1-d_{14}c_3)}{N},$$ $$\displaystyle \frac{e_{234}-(d_{23}c_4+d_{34}c_2-d_{24}c_3)}{N}]$$ 計算$$rM=s$$ $$s=[d_{12}N^{3\alpha},d_{13}N^{3\alpha},d_{14}N^{3\alpha},d_{23}N^{3\alpha},d_{24}N^{3\alpha},d_{34}N^{3\alpha},$$ $$e_{123},e_{124},e_{134},e_{234}]$$ 利用lattice化簡演算法找到短向量$$s$$，若真的找到$$s$$，從$$r=sM^{-1}$$得到$$r$$向量。 步驟3：再用Franklin和Reiter的技巧回復明文$$m$$ 利用$$r$$向量計算最大公因數來回復$$t_i$$ $$gcd(d_{1,2},d_{1,3},\ldots,d_{1,k})=gcd\{\;t_1t_2(t_1-t_2),t_1t_3(t_1-t_3),\ldots,t_1t_k(t_1-t_k) \}\;$$ $$=t_1\times gcd\{\; t_2(t_1-t_2),t_3(t_1-t_3),\ldots,t_k(t_1-t_k) \}\;$$ 希望後面的gcd足夠小而可以暴力搜尋找到$$t_i$$，再用Franklin和Reiter的技巧回復明文$$m$$。 $$c_1\equiv 3m^2t_1+3mt_1^2+t_1^3\pmod{N}$$ $$c_2\equiv 3m^2t_2+3mt_2^2+t_2^3\pmod{N}$$ $$\displaystyle m \equiv -\frac{t_1t_2^3+(c_1-t_1^3)t_2-c_2t_1}{3t_1t_2^2-3t_1^2t_2}\pmod{N}$$ 計算$$gcd(r_1,r_2,r_3)$$得到$$t_1$$ 計算$$gcd(r_1,r_4,r_5)$$得到$$t_2$$ 計算$$gcd(r_2,r_4,r_6)$$得到$$t_3$$ 計算$$gcd(r_3,r_5,r_6)$$得到$$t_4$$ 再用Franklin和Reiter的技巧回復明文$$m$$ 參考資料： D. Coppersmith. Finding a small root of a univariate modular equation. In Proceedings of Eurocrypt 1996, volume 1070 of Lecture Notes in Computer Science, pages 155–165. Springer, 1996. https://link.springer.com/chapter/10.1007/3-540-68339-9_14 請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.46.0\share\maxima\5.46.0\share目錄下 要先載入LLL.mac才能使用LLL指令 (%i1) load("LLL.mac"); (%o1) C:/maxima-5.46.0/share/maxima/5.46.0/LLL.mac 公鑰N (%i2) N:54957464841358314276864542898551; (N) 54957464841358314276864542898551 密文$$c_1,c_2,c_3,c_4$$ (%i3) c:[39468404764076506001431294583473, 54717774306161926009996633426160, 35656934123834905100176504752910, 2269538260173637910379674594208]; (c) $$[39468404764076506001431294583473,$$ $$54717774306161926009996633426160,$$ $$35656934123834905100176504752910,$$ $$2269538260173637910379674594208]$$ 有$$k=4$$個密文 (%i4) k:length(c); (k) 4 取$$\displaystyle \alpha=\frac{1}{11}$$ (%i5) alpha:1/ceiling((6*k-3)/(k-2)); (alpha) $$\displaystyle \frac{1}{11}$$ 檢查是否符合$$\displaystyle \alpha<\frac{k-2}{6k-3}$$ (%i6) is(alpha<(k-2)/(6*k-3)); (%o6) $$true$$ 從集合$$S$$中任選$$n$$個的組合 (%i7) Combination(L,n):=block ([c:[],s], if length(L)>n then (for r in L do (s:delete(r,L), c:unique(append(c,Combination(s,n))) ) ) else (c:[L]), return(c) )$

(%i8)　S:Combination(create_list(i,i,1,k),3);
(S)　$$[[1,2,3],[1,2,4],[1,3,4],[2,3,4]]$$

(%i9)　CoefficientMatrix:zeromatrix(k*(k-1)/2,k*(k-1)*(k-2)/6);
(CoefficientMatrix)　$$\left[\matrix{0&0&0&0\cr 0&0&0&0\cr 0&0&0&0\cr 0&0&0&0\cr 0&0&0&0\cr 0&0&0&0}\right]$$

(%i10)
for column:1 thru length(S) do
([i,j,l]:S[column],
print("d",i,j,"c",l,"+d",j,l,"c",i,"-d",i,l,"c",j,"=e",i,j,l,"mod(N)"),
dij_position: (2*k-i)*(i-1)/2+j-i,
CoefficientMatrix[dij_position][column]:'c[l],
djl_position: (2*k-j)*(j-1)/2+l-j,
CoefficientMatrix[djl_position][column]:'c[ i ],
dil_position: (2*k-i)*(i-1)/2+l-i,
CoefficientMatrix[dil_position][column]:-'c[j]
);

$$d12c3+d23c1-d13c2=e123\pmod{N}$$
$$d12c4+d24c1-d14c2=e124\pmod{N}$$
$$d13c4+d34c1-d14c3=e134\pmod{N}$$
$$d23c4+d34c2-d24c3=e234\pmod{N}$$
(%o10)　$$done$$

(%i11)　CoefficientMatrix;
(%o11)　$$\left[\matrix{c_3&c_4&0&0\cr -c_2&0&c_4&0\cr 0&-c_2&-c_3&0\cr c_1&0&0&c_4\cr 0&c_1&0&-c_3 \cr 0&0&c_1&c_2}\right]$$

(%i12)　NalphaMatrix:round('N^(3*'alpha))*ident(k*(k-1)/2);
(NalphaMatrix)　$$\left[\matrix{ round(N^{3\alpha})&0&0&0&0&0\cr 0&round(N^{3\alpha})&0&0&0&0\cr 0&0&round(N^{3\alpha})&0&0&0\cr 0&0&0&round(N^{3\alpha})&0&0\cr 0&0&0&0&round(N^{3\alpha})&0\cr 0&0&0&0&0&round(N^{3\alpha})}\right]$$

(%i13)　NMatrix:'N*ident(k*(k-1)*(k-2)/6);
(NMatrix)　$$\left[\matrix{ N&0&0&0\cr 0&N&0&0\cr 0&0&N&0\cr 0&0&0&N}\right]$$

(%i14)　ZeroMatrix:zeromatrix(k*(k-1)*(k-2)/6,k*(k-1)/2);
(ZeroMatrix)　$$\left[\matrix{ 0&0&0&0&0&0\cr 0&0&0&0&0&0\cr 0&0&0&0&0&0\cr 0&0&0&0&0&0}\right]$$

(M)　$$\left[\matrix{ round(N^{3\alpha})&0&0&0&0&0&c_3&c_4&0&0\cr 0&round(N^{3\alpha})&0&0&0&0&-c_2&0&c_4&0\cr 0&0&round(N^{3\alpha})&0&0&0&0&-c_2&-c_3&0\cr 0&0&0&round(N^{3\alpha})&0&0&c_1&0&0&c_4\cr 0&0&0&0&round(N^{3\alpha})&0&0&c_1&0&-c_3\cr 0&0&0&0&0&round(N^{3\alpha})&0&0&c_1&c_2\cr 0&0&0&0&0&0&N&0&0&0\cr 0&0&0&0&0&0&0&N&0&0\cr 0&0&0&0&0&0&0&0&N&0\cr 0&0&0&0&0&0&0&0&0&N}\right]$$

(%i16)　M:ev(M,append(create_list('c[i ]=c[ i ],i,1,k),['N=N,'alpha=alpha]));
(M)　$$\left[\matrix{ 453284549&0&0&0&0&0&35656934123834905100176504752910&2269538260173637910379674594208&0&0\cr 0&453284549&0&0&0&0&-54717774306161926009996633426160&0&2269538260173637910379674594208&0\cr 0&0&453284549&0&0&0&0&-54717774306161926009996633426160&-35656934123834905100176504752910&0\cr 0&0&0&453284549&0&0&39468404764076506001431294583473&0&0&2269538260173637910379674594208\cr 0&0&0&0&453284549&0&0&39468404764076506001431294583473&0&-35656934123834905100176504752910\cr 0&0&0&0&0&453284549&0&0&39468404764076506001431294583473&54717774306161926009996633426160\cr 0&0&0&0&0&0&54957464841358314276864542898551&0&0&0\cr 0&0&0&0&0&0&0&54957464841358314276864542898551&0&0\cr 0&0&0&0&0&0&0&0&54957464841358314276864542898551&0\cr 0&0&0&0&0&0&0&0&0&54957464841358314276864542898551}\right]$$

(%i17)　B: LLL(M);
(B)　$$\left[\matrix{ 3062806981544531&1929302787225877&217318211327070&-1142089856961263&-2847639605402466&-1712730228981912&-7029209321862&-1864504228860&-675725901480&-5840140628952\cr 30350192335087291&-33755294424101878&-35992078252296415&10262189034662282&-12649485090783171&26238535675026248&45236596803297303&32667816209644487&17312818708413949&29899743372135217\cr -105442779364366051&-35112147780672047&15105397548793484&-162848150710657127&-47818354180209784&-39252485567286516&93004125926333727&66987628433829075&35630166688401243&61279750174710207\cr 1463179406660001&-38794361299156843&127104398505831225&15663924344526657&-53193847940963451&49664226773200368&34028664295792700&-108825608856904341&-70649517214082037&72089239243509663\cr 3555015074767161&-238087723867355568&-173132241548157991&-194306209012687083&-142531522469114792&82794656207822923&-190601615804163537&-137506222531495333&-73344681040746143&-126138894058078265\cr -195888746853505215&-146909831017677869&61301299463938392&224903490834995215&-303473180577620820&-157213305662347620&-69229181322847560&222932053809272745&145526846414244939&-148701738837887865\cr 307004212366900391&12863118098726871&599044032676087473&-259437126504168679&178098884431111932&513690572043907629&-143869831596583000&457614818638557519&299900502491764839&-303250617849528111\cr 1991487835630480536&-3276384603102473239&1317877116205579554&-212626855403276543&2241302488597860594&-3546671373603670004&4710859391231467810&-3897062285598526116&3293990032544411069&-4885714390931151907\cr 3040490414277923020&-5012515185936123906&2047825263139913024&-333778398019756331&3453617971057334454&-5468786420936785769&3167236119733748050&8002984534870019480&-15326812883649580004&-4476135453415756279\cr -10796555276199580276&17895467629929799515&-7198812808408856722&1270730505249622124&-12198909881552966272&19372609181153480002&26360591268575871440&7060175662321356&-17588138285651759645&-29785375118608432724}\right]$$

(%i18)　s:B[1];
(s)　$$\left[\matrix{3062806981544531&1929302787225877&217318211327070&-1142089856961263&-2847639605402466&-1712730228981912&-7029209321862&-1864504228860&-675725901480&-5840140628952}\right]$$

(%i19)　r:s.invert(M);
(r)　$$\left[\matrix{6756919&4256273&479430&-2519587&-6282234&-3778488&1663229&4709970&2848860&-209916}\right]$$

(%i21)
t:create_list(0,i,1,k)$for i:1 thru k do (dij:[], for j:1 thru k do (if i<j then (print("取d",i,j,"=r[",index: (2*k-i-2)*(i-1)/2+j-1,"]=",r[1,index]), dij:append(dij,[r[1,index]]) ), if i>j then (print("取d",j,i,"=r[",index: (2*k-j-2)*(j-1)/2+i-1,"]=",r[1,index]), dij:append(dij,[r[1,index]]) ) ), print("t",i,"=gcd(",dij,")=",t[ i ]:lreduce('gcd,dij)) ); 取$$d_{12}=r[1]=6756919$$ 取$$d_{13}=r[2]=4256273$$ 取$$d_{14}=r[3]=479430$$ $$t_1=gcd([6756919,4256273,479430])=761$$ 取$$d_{12}=r[1]=6756919$$ 取$$d_{23}=r[4]=-2519587$$ 取$$d_{24}=r[5]=-6282234$$ $$t_2=gcd([6756919,-2519587,-6282234])=683$$ 取$$d_{13}=r[2]=4256273$$ 取$$d_{23}=r[4]=-2519587$$ 取$$d_{34}=r[6]=-3778488$$ $$t_3=gcd([4256273,-2519587,-3778488])=119$$ 取$$d_{14}=r[3]=479430$$ 取$$d_{24}=r[5]=-6282234$$ 取$$d_{34}=r[6]=-3778488$$ $$t_4=gcd([479430,-6282234,-3778488])=126$$ (%o21) $$done$$ 使用Franklin和Reiter的兩個訊息有仿射關係，利用輾轉相除法找出關係式 https://math.pro/db/viewthread.php?tid=3498&page=2#pid23631 (%i22) GCD(fx1,fx2,var):=block([temp], fx1:expand(fx1), fx2:expand(fx2), while hipow(fx2,var)#1 do (temp:fx2, print(fx1,"除以",fx2,"餘式",fx2:remainder(fx1,fx2,var)), fx1:temp ), fx2 )$

(%i24)
fx1: (m+t1)^3-m^3-c1;
fx2: (m+t2)^3-m^3-c2;

(fx1)　$$(t1+m)^3-m^3-c1$$
(fx2)　$$(t2+m)^3-m^3-c2$$

(%i25)　GCD:GCD(fx1,fx2,m);
$$t1^3+3mt1^2+3m^2t1-c1$$除以$$t2^3+3mt2^2+3m^2t2-c2$$餘式$$\displaystyle -\frac{t1t2^3+m(3t1t2^2-3t1^2t2)+(c1-t1^3)t2-c2t1}{t2}$$
(GCD)　$$\displaystyle -\frac{t1t2^3+m(3t1t2^2-3t1^2t2)+(c1-t1^3)t2-c2t1}{t2}$$

(%i26)　m:solve(GCD,m)[1];
(m)　$$\displaystyle m=-\frac{t1t2^3+(c1-t1^3)t2-c2t1}{3t1t2^2-3t1^2t2}$$

(%i27)　m:ev(m,['t1=t[1],'t2=t[2],'c1=c[1],'c2=c[2]]);
(m)　$$\displaystyle m=-\frac{t1t2^3+(c1-t1^3)t2-c2t1}{3t1t2^2-3t1^2t2}=-\frac{14683305793124972094629922378741917}{121624542}$$

(%i28)　m:ratsimp(rhs(m)),modulus:N;
warning: assigning 54957464841358314276864542898551, a non-prime, to 'modulus'
(m)　$$25152118001609140014150009191379$$

(%i29)　PinNumber:mod(m,10000);
(PinNumber)　$$1379$$

(%i30)　m:floor(m/10000);
(m)　$$2515211800160914001415000919$$

(%i33)
Message: PinNumber$while m#0 do (char:ascii(mod(m,100)+cint("A")-1), Message:concat(char,Message), m:floor(m/100) )$
Message;

(%o33)　$$YOUR@PIN@NO@IS1379$$

(%i34)　Message:ssubst(" ","@",Message);
(Message)　$$YOUR$$ $$PIN$$ $$NO$$ $$IS1379$$

3-1.針對大的$$r$$，分解RSA公鑰$$n=p^rq$$

 RSA　$$n=pq$$ RSA　$$n=p^rq$$ 產生公鑰和私鑰 產生兩個隨機質數$$p,q$$，$$n=pq$$ 計算$$\phi(n)=(p-1)(q-1)$$ 找$$e,d$$符合$$ed\equiv 1 \pmod{\phi(n)}$$和$$GCD(e,p)=1$$ $$e,n$$是公鑰，$$d,p,q$$是私鑰 產生兩個隨機質數$$p,q$$，$$n=p^r q$$ 計算$$L=LCM(p-1.q-1)$$ 找$$e,d$$符合$$ed \equiv 1\pmod{L}$$和$$GCD(e,p)=1$$ $$e,n$$是公鑰，$$d,p,q$$是私鑰 加密 $$c\equiv m^e \pmod{n}$$ $$m$$為明文，$$c$$為密文 相同 解密 $$m\equiv c^d \pmod{n}$$ 無法使用$$m\equiv c^d \pmod{n}$$來回復明文 利用中國餘數定理快速解密 $$m\equiv c^d \pmod{pq}$$ 分解成$$m_p\equiv c^d \pmod{p}$$，$$m_q\equiv c^d\pmod{q}$$ 設$$d_p\equiv d\pmod{p-1}$$，$$m_p\equiv c^{d_p}\pmod{p}$$ 設$$d_q\equiv d\pmod{q-1}$$，$$m_q\equiv c^{d_q}\pmod{q}$$ 利用中國餘數定理 $$m\equiv \left(m_p\cdot q(q^{-1}\pmod{p})+m_q\cdot p(p^{-1}\pmod{q})\right)\pmod{n}$$ $$m_q\equiv c^d\pmod{q}$$ 設$$d_q\equiv d\pmod{q-1}$$，$$m_q\equiv c^{d_q}\pmod{q}$$ 利用中國餘數定理 $$m\equiv (m_p\cdot q(q^{-1}\pmod{p^r})+m_q\cdot p^r(p^{-r}\pmod{q}))\pmod{n}$$ $$m_p\equiv m\pmod{p^r}$$的$$m_p$$無法用$$m_p\equiv c^d\pmod{p^r}$$直接計算，改用以下的方法計算$$m_p$$

$$m_p\equiv K_0+pK_1+p^2K_2+\ldots+p^{r-1}K_{r-1}\pmod{p^r}$$。

$$c_p\equiv (\bbox[border:1px solid black]{K_0+pK_1+p^2K_2+\ldots+p^{i-1}K_{i-1}}+\bbox[border:1px solid black]{p^iK_i})^e\pmod{p^{i+1}}$$，$$i=1,2,\ldots,r-1$$

$$c_p\equiv C_0^e(K_0+pK_1+p^2K_2+\ldots+p^{i-1}K_{i-1})^e(p^iK_i)^0$$
$$+C_1^e(K_0+pK_1+p^2K_2+\ldots+p^{i-1}K_{i-1})^{e-1}(p^iK_i)^1$$
$$+C_2^e(K_0+pK_1+p^2K_2+\ldots+p^{i-1}K_{i-1})^{e-2}(p^iK_i)^2$$　超過$$p^{i+1}$$
...
$$+C_e^e(K_0+pK_1+p^2K_2+\ldots+p^{i-1}K_{i-1})^{0}(p^iK_i)^e$$超過$$p^{i+1}$$$$\pmod{p^{i+1}}$$

$$c_p\equiv (K_0+pK_1+p^2K_2+\ldots+p^{i-1}K_{i-1})^e+e(K_0+pK_1+p^2K_2+\ldots+p^{i-1}K_{i-1})^{e-1}p^iK_i\pmod{p^{i+1}}$$

$$F_i=(A_i)^e\pmod{p^{i+1}}$$，
$$(K_0+pK_1+p^2K_2+\ldots+p^{i-1}K_{i-1})^{e-1}=F_iA_i^{-1}$$

https://en.wikipedia.org/wiki/RSA_(cryptosystem)#Example

$$L=LCM(p-1,q-1)=LCM(60,52)=780$$

$$\equiv 1234567^{17}\pmod{12029993}$$
$$\equiv 10259995$$

 $$L=LCM(p-1,q-1)$$ $$d\equiv e^{-1}\pmod{L}$$ $$\phi(n)=p^{r-1}(p-1)(q-1)$$ $$d\equiv e^{-1}\pmod{\phi(n)}$$ $$\lambda(n)=LCM(p^{r-1}(p-1),(q-1))$$ $$d\equiv e^{-1}\pmod{\lambda(n)}$$ $$L=LCM(60,52)=780$$ $$d\equiv 17^{-1}\equiv 413\pmod{L}$$ 私鑰$$d$$較小，但不能直接計算$$m\equiv c^d \pmod{n}$$來回復明文，改用以下的中國餘數定理來加速解密。 $$\phi(n)=61^2\cdot 60\cdot 52=11609520$$ $$d\equiv 17^{-1}\equiv 682913\pmod{\phi(n)}$$ 雖然可以直接計算$$m\equiv c^d \pmod{n}$$來回復明文， 但解密速度會比$$n=pq$$且使用中國餘數定理的RSA還慢，變成使用$$n=p^rq$$的RSA沒有顯著的優點。 $$\lambda(n)=LCM(61^2\cdot 60,52)=2902380$$ $$d\equiv 17^{-1}\equiv 682913\pmod{\lambda(n)}$$ 雖然可以直接計算$$m\equiv c^d \pmod{n}$$來回復明文， 但解密速度會比$$n=pq$$且使用中國餘數定理的RSA還慢，變成使用$$n=p^rq$$的RSA沒有顯著的優點。

 虛擬碼 範例 $$A_i=K_0+pK_1+p^2K_2+\ldots+p^{i-1}K_{i-1}$$改成遞迴關係式$$A_{i+1}=A_i+p^iK_i$$ $$F_i=(A_i)^e\pmod{p^{i+1}}$$ 計算$$\displaystyle K_{i}\equiv \frac{(c_p-F_i)(eF_i)^{-1}A_i}{p^i}\pmod{p^{i+1}}$$，$$i=1,2,\ldots,r-1$$ 分解成 $$E_i=c-F_i\pmod{p^{i+1}}$$ $$\displaystyle B_i=\frac{E_i}{p^i}$$ $$K_i=[(eF_i)^{-1}A_iB_i]\pmod{p}$$ －－－－－－－－－－－－－－－－ 解密 輸入：$$d,p,q,e,r,c$$ 輸出：$$m$$ (1)　$$d_p=d\pmod{p-1}$$ 　　$$d_q=d\pmod{q-1}$$ (2)　$$K_0=c^{d_p}\pmod{p}$$ 　　$$m_q=c^{d_q}\pmod{q}$$ (3)　$$A_1=K_0$$ 　　for $$i=1$$ to $$(r-1)$$ do 　　　$$F_i=A_i^e \pmod{p^{i+1}}$$ 　　　$$E_i=(c-F_i)\pmod{p^{i+1}}$$ 　　　$$\displaystyle B_i=\frac{E_i}{p^i}$$為整數 　　　$$K_i=[(eF_i)^{-1}A_iB_i]\pmod{p}$$ 　　　$$A_{i+1}=A_i+p^iK_i$$為整數 (4)　$$m_p=A_r$$ (5)　$$p_1=[(p^r)^{-1}]\pmod{q}$$ 　　$$q_1=[q^{-1}]\pmod{p^r}$$ (6)　$$m=[q_1qm_p+p_1p^rm_q]\pmod{p^rq}$$ 輸入：$$d=413$$，$$p=61$$，$$q=53$$，$$e=17$$，$$r=3$$，$$c=10259995$$ 輸出：$$m=1234567$$ (1)$$d_p\equiv 413\pmod{60}\equiv 53$$ 　$$d_q\equiv 413\pmod{52}\equiv 49$$ (2)$$K_0\equiv 10259995^{53}\equiv 49\pmod{61}$$ 　$$m_q\equiv 10259995^{49}\equiv 38\pmod{53}$$ (3)$$A_1=49$$ 當$$i=1$$時 　$$F_1=A_1^e= 49^{17} = 527 \pmod{61 ^2}$$ 　$$E_1=(c-F_1)=(10259995-527)=671 \pmod{61 ^2}$$ 　$$\displaystyle B_1=\frac{E_1}{p}=\frac{671}{61}=11$$ 　$$K_1=(eF_1)^{-1} A_1B_1=( 17 \cdot 527 )^{-1} 49 \cdot 11 = 47 \pmod{61}$$ 　$$A_2=A_1+p \cdot K_1= 49 + 61 \cdot 47 = 2916$$ 當$$i=2$$時 　$$F_2=A_2^e= 2916^{17}= 57013 \pmod{61^3}$$ 　$$E_2=(c-F_2)=(10259995-57013)= 215818 \pmod{61 ^3}$$ 　$$\displaystyle B_2=\frac{E_2}{p^2}=\frac{215818}{3721}= 58$$ 　$$K_2=(eF_2)^{-1} A_2B_2=( 17 \cdot 57013 )^{-1} 2916 \cdot 58 = 26 \pmod{61}$$ 　$$A_3=A_2+p^2 \cdot K_2= 2916 + 61 ^2 \cdot 26 = 99662$$ (4)$$m_p=A_r=99662$$ (5)$$p_1\equiv 61^{-3}\equiv 50\pmod{53}$$ 　$$q_1\equiv 53^{-1}\equiv 12848 \pmod{61^3}$$ (6)$$m\equiv [12848\cdot 53\cdot 99662+50\cdot 61^3 \cdot 38]\pmod{61^3\cdot 53}$$ 　　$$\equiv 1234567 \pmod{61^3\cdot 53}$$

1.論文的$$A[0]$$index從0開始，但maxima的list從1開始，所以將$$A_{i-1}$$改為$$A_i$$和$$A_i$$改為$$A_{i+1}$$和$$A_{r-1}$$改為$$A_r$$。
2.原論文公鑰$$n=p^kq$$，順應分解RSA公鑰$$n=p^rq$$論文，符號$$k$$另有他用，$$p$$的次方改為$$r$$。

Takagi, T. (1998). Fast RSA-type cryptosystem modulo p k q . In: Krawczyk, H. (eds) Advances in Cryptology — CRYPTO '98. CRYPTO 1998. Lecture Notes in Computer Science, vol 1462. Springer, Berlin, Heidelberg. https://doi.org/10.1007/BFb0055738

(%i2)
p:61;
q:53;

(p)　$$61$$
(q)　$$53$$

(%i4)
r:3;
n:p^r*q;

(r)　$$3$$
(n)　$$12029993$$

(%i5)　e:17;
(e)　$$17$$

(%i6)　d:inv_mod(e,lcm(p-1,q-1));
(d)　$$413$$

(%i7)　m:1234567;
(m)　$$1234567$$

(%i8)　c:power_mod(m,e,n);
(c)　$$10259995$$

(%i9)　m:power_mod(c,d,n);
(m)　$$2330554$$

(%i18)
dp:mod(d,p-1);
dq:mod(d,q-1);
K:create_list(0,i,1,r);
K[1]:power_mod(c,dp,p);
mq:power_mod(c,dq,q);
A:create_list(0,i,1,r);
B:create_list(0,i,1,r);
F:create_list(0,i,1,r);
A[1]:K[1];

(dp)　$$53$$
(dq)　$$49$$
(K)　$$[0,0,0]$$
(K[1])　$$49$$
(mq)　$$38$$
(A)　$$[0,0,0]$$
(B)　$$[0,0,0]$$
(F)　$$[0,0,0]$$
(A[1])　$$49$$

(%i9)
for i:1 thru r-1 do
(print("F[",i,"]=A[",i,"]"^"e=",A[ i ],""^e," =",F[ i ]:power_mod(A[ i ],e,p^(i+1)),"(mod",p,""^(i+1),")"),
print("E[",i,"]=(c-F[",i,"])=(",c,"-",F[ i ],")=",E[ i ]:mod(c-F[ i ],p^(i+1)),"(mod",p,""^(i+1),")"),
print("B[",i,"]=E[",i,"]/p"^i,"=",E[ i ],"/",p^i,"=",B[ i ]:E[ i ]/p^i),
print("K[",i,"]=(eF[",i,"])"^"-1","A[",i,"]B[",i,"]=(",e,"*",F[ i ],")"^"-1",A[ i ],"*",B[ i ],"=",
K[ i ]:mod(inv_mod(e*F[ i ],p)*A[ i ]*B[ i ],p),"(mod",p,")"),
print("A[",i+1,"]=A[",i,"]+p"^i,"*K[",i,"]=",A[ i ],"+",p,""^i,"*",K[ i ],"=",A[i+1]:A[ i ]+p^i*K[ i ]),
print("－－－－－－")
)\$

$$F[1]=A[1]^e=49^{17}=527\pmod{61^2}$$
$$E[1]=(c-F[1])=(10259995-527)=671\pmod{61^2}$$
$$B[1]=E[1]/p=671/61=11$$
$$K[1]=(eF[1])^{-1}A[1]B[1]=(17*527)^{-1}49*11=47\pmod{61}$$
$$A[2]=A[1]+p*K[1]=49+61*47=2916$$
－－－－－－
$$F[2]=A[2]^e=2916^{17}=57013\pmod{61^3}$$
$$E[2]=(c-F[2])=(10259995-57013)=215818\pmod{61^3}$$
$$B[2]=E[2]/p^2=215818/3721=58$$
$$K[2]=(eF[2])^{-1}A[2]B[2]=(17*57013)^{-1}2916*58=26\pmod{61}$$
$$A[3]=A[2]+p^2*K[2]=2916+61^2*26=99662$$
－－－－－－

(%i23)
mp:A[r];
p1:inv_mod(p^r,q);
q1:inv_mod(q,p^r);
m:mod(q1*q*mp+p1*p^r*mq,p^r*q);

(mp)　$$99662$$
(p1)　$$50$$
(q1)　$$12848$$
(m)　$$1234567$$

3-2.針對大的$$r$$，分解RSA公鑰$$n=p^rq$$

 方法 範例 問題敘述 定理 令$$N=p^rq$$，對某些的$$c$$，$$q 參考資料： Boneh, D., Durfee, G., Howgrave-Graham, N. (1999). Factoring N = p r q for Large r . In: Wiener, M. (eds) Advances in Cryptology — CRYPTO’ 99. CRYPTO 1999. Lecture Notes in Computer Science, vol 1666. Springer, Berlin, Heidelberg. https://doi.org/10.1007/3-540-48405-1_21 https://link.springer.com/chapte ... 5-1_21#chapter-info 請下載LLL.zip，解壓縮後將LLL.mac放到C:\maxima-5.46.0\share\maxima\5.46.0\share目錄下 要先載入LLL.mac才能使用LLL指令 load("LLL.mac"); C:/maxima-5.47.0/share/maxima/5.47.0/share/LLL.mac 要因數分解的公鑰\(N$$
N:197213;
$$197213$$

$$N=p^r q$$，因數$$p$$的次方$$r$$
r:2;
$$2$$

c:1;
$$1$$

d:2*r*(r+c);
$$12$$

m:floor(d/(r+c)-1/2);
$$3$$

d:9;
$$9$$

epsilon: (c+1)/(r+c);
$$\displaystyle \frac{2}{3}$$

for k:1 thru floor(log(N)/(log(2)*r)) do
(steps:floor(float(2^(epsilon*k))),
for j:0 thru steps do
(P:2^k+j*floor(float(2^((1-epsilon)*k))),
print("k=",k,",j=",j,",P=2"^k,"+",j,"*2"^((1-epsilon)*k),"=",P)
)
);

$$k=1,j=0,P=2+0*2^{1/3}=2$$
$$k=1,j=1,P=2+1*2^{1/3}=3$$
$$k=2,j=0,P=2^2+0*2^{2/3}=4$$
$$k=2,j=1,P=2^2+1*2^{2/3}=5$$
$$k=2,j=2,P=2^2+2*2^{2/3}=6$$
$$k=3,j=0,P=2^3+0*2=8$$
$$k=3,j=1,P=2^3+1*2=10$$
$$k=3,j=2,P=2^3+2*2=12$$
$$k=3,j=3,P=2^3+3*2=14$$
$$k=3,j=4,P=2^3+4*2=16$$
$$k=4,j=0,P=2^4+0*2^{4/3}=16$$
$$k=4,j=1,P=2^4+1*2^{4/3}=18$$
$$k=4,j=2,P=2^4+2*2^{4/3}=20$$
$$k=4,j=3,P=2^4+3*2^{4/3}=22$$
$$k=4,j=4,P=2^4+4*2^{4/3}=24$$
$$k=4,j=5,P=2^4+5*2^{4/3}=26$$
$$k=4,j=6,P=2^4+6*2^{4/3}=28$$
$$k=5,j=0,P=2^5+0*2^{5/3}=32$$
$$k=5,j=1,P=2^5+1*2^{5/3}=35$$
$$k=5,j=2,P=2^5+2*2^{5/3}=38$$
$$k=5,j=3,P=2^5+3*2^{5/3}=41$$
$$k=5,j=4,P=2^5+4*2^{5/3}=44$$
$$k=5,j=5,P=2^5+5*2^{5/3}=47$$
$$k=5,j=6,P=2^5+6*2^{5/3}=50$$
$$k=5,j=7,P=2^5+7*2^{5/3}=53$$
$$k=5,j=8,P=2^5+8*2^{5/3}=56$$
$$\bbox[border:1px solid black]{k=5,j=9,P=2^5+9*2^{5/3}=59}$$
$$k=5,j=10,P=2^5+10*2^{5/3}=62$$
$$k=6,j=0,P=2^6+0*2^2=64$$
$$k=6,j=1,P=2^6+1*2^2=68$$
$$k=6,j=2,P=2^6+2*2^2=72$$
$$k=6,j=3,P=2^6+3*2^2=76$$
$$k=6,j=4,P=2^6+4*2^2=80$$
$$k=6,j=5,P=2^6+5*2^2=84$$
$$k=6,j=6,P=2^6+6*2^2=88$$
$$k=6,j=7,P=2^6+7*2^2=92$$
$$k=6,j=8,P=2^6+8*2^2=96$$
$$k=6,j=9,P=2^6+9*2^2=100$$
$$k=6,j=10,P=2^6+10*2^2=104$$
$$k=6,j=11,P=2^6+11*2^2=108$$
$$k=6,j=12,P=2^6+12*2^2=112$$
$$k=6,j=13,P=2^6+13*2^2=116$$
$$k=6,j=14,P=2^6+14*2^2=120$$
$$k=6,j=15,P=2^6+15*2^2=124$$
$$k=6,j=16,P=2^6+16*2^2=128$$
$$k=7,j=0,P=2^7+0*2^{7/3}=128$$
$$k=7,j=1,P=2^7+1*2^{7/3}=133$$
$$k=7,j=2,P=2^7+2*2^{7/3}=138$$
$$k=7,j=3,P=2^7+3*2^{7/3}=143$$
$$k=7,j=4,P=2^7+4*2^{7/3}=148$$
$$k=7,j=5,P=2^7+5*2^{7/3}=153$$
$$k=7,j=6,P=2^7+6*2^{7/3}=158$$
$$k=7,j=7,P=2^7+7*2^{7/3}=163$$
$$k=7,j=8,P=2^7+8*2^{7/3}=168$$
$$k=7,j=9,P=2^7+9*2^{7/3}=173$$
$$k=7,j=10,P=2^7+10*2^{7/3}=178$$
$$k=7,j=11,P=2^7+11*2^{7/3}=183$$
$$k=7,j=12,P=2^7+12*2^{7/3}=188$$
$$k=7,j=13,P=2^7+13*2^{7/3}=193$$
$$k=7,j=14,P=2^7+14*2^{7/3}=198$$
$$k=7,j=15,P=2^7+15*2^{7/3}=203$$
$$k=7,j=16,P=2^7+16*2^{7/3}=208$$
$$k=7,j=17,P=2^7+17*2^{7/3}=213$$
$$k=7,j=18,P=2^7+18*2^{7/3}=218$$
$$k=7,j=19,P=2^7+19*2^{7/3}=223$$
$$k=7,j=20,P=2^7+20*2^{7/3}=228$$
$$k=7,j=21,P=2^7+21*2^{7/3}=233$$
$$k=7,j=22,P=2^7+22*2^{7/3}=238$$
$$k=7,j=23,P=2^7+23*2^{7/3}=243$$
$$k=7,j=24,P=2^7+24*2^{7/3}=248$$
$$k=7,j=25,P=2^7+25*2^{7/3}=253$$
$$k=8,j=0,P=2^8+0*2^{8/3}=256$$
$$k=8,j=1,P=2^8+1*2^{8/3}=262$$
$$k=8,j=2,P=2^8+2*2^{8/3}=268$$
$$k=8,j=3,P=2^8+3*2^{8/3}=274$$
$$k=8,j=4,P=2^8+4*2^{8/3}=280$$
$$k=8,j=5,P=2^8+5*2^{8/3}=286$$
$$k=8,j=6,P=2^8+6*2^{8/3}=292$$
$$k=8,j=7,P=2^8+7*2^{8/3}=298$$
$$k=8,j=8,P=2^8+8*2^{8/3}=304$$
$$k=8,j=9,P=2^8+9*2^{8/3}=310$$
$$k=8,j=10,P=2^8+10*2^{8/3}=316$$
$$k=8,j=11,P=2^8+11*2^{8/3}=322$$
$$k=8,j=12,P=2^8+12*2^{8/3}=328$$
$$k=8,j=13,P=2^8+13*2^{8/3}=334$$
$$k=8,j=14,P=2^8+14*2^{8/3}=340$$
$$k=8,j=15,P=2^8+15*2^{8/3}=346$$
$$k=8,j=16,P=2^8+16*2^{8/3}=352$$
$$k=8,j=17,P=2^8+17*2^{8/3}=358$$
$$k=8,j=18,P=2^8+18*2^{8/3}=364$$
$$k=8,j=19,P=2^8+19*2^{8/3}=370$$
$$k=8,j=20,P=2^8+20*2^{8/3}=376$$
$$k=8,j=21,P=2^8+21*2^{8/3}=382$$
$$k=8,j=22,P=2^8+22*2^{8/3}=388$$
$$k=8,j=23,P=2^8+23*2^{8/3}=394$$
$$k=8,j=24,P=2^8+24*2^{8/3}=400$$
$$k=8,j=25,P=2^8+25*2^{8/3}=406$$
$$k=8,j=26,P=2^8+26*2^{8/3}=412$$
$$k=8,j=27,P=2^8+27*2^{8/3}=418$$
$$k=8,j=28,P=2^8+28*2^{8/3}=424$$
$$k=8,j=29,P=2^8+29*2^{8/3}=430$$
$$k=8,j=30,P=2^8+30*2^{8/3}=436$$
$$k=8,j=31,P=2^8+31*2^{8/3}=442$$
$$k=8,j=32,P=2^8+32*2^{8/3}=448$$
$$k=8,j=33,P=2^8+33*2^{8/3}=454$$
$$k=8,j=34,P=2^8+34*2^{8/3}=460$$
$$k=8,j=35,P=2^8+35*2^{8/3}=466$$
$$k=8,j=36,P=2^8+36*2^{8/3}=472$$
$$k=8,j=37,P=2^8+37*2^{8/3}=478$$
$$k=8,j=38,P=2^8+38*2^{8/3}=484$$
$$k=8,j=39,P=2^8+39*2^{8/3}=490$$
$$k=8,j=40,P=2^8+40*2^{8/3}=496$$
done

P:59;
$$59$$

X:floor(N^((1-epsilon)/(r+1)));
$$3$$

fx: ('P+x)^r;
$$(x+P)^2$$

fXx:subst(x=x*'X,fx);
$$(Xx+P)^2$$

powerdisp:true;
$$true$$

$$g(xX)$$多項式
gxX:[];
[]

for k:0 thru m-1 do
(for i:0 thru r-1 do
(print("i=",i,",k=",k,",g",i,",",k,"(xX)=N"^(m-k),"*","(xX)"^i,"*","f(xX)"^k,"=",gik:'N^(m-k)*(x*'X)^i*fXx^k,"=",expand(gik)),
gxX:append(gxX,[gik])
)
);

$$i=0,k=0,g_{0,0}(xX)=N^3*1*1=N^3=N^3$$
$$i=1,k=0,g_{1,0}(xX)=N^3*(xX)*1=N^3Xx=N^3Xx$$
$$i=0,k=1,g_{0,1}(xX)=N^2*1*f(xX)=N^2(P+Xx)^2=N^2P^2+2N^2PXx+N^2X^2x^2$$
$$i=1,k=1,g_{1,1}(xX)=N^2*(xX)*f(xX)=N^2Xx(P+Xx)^2=N^2P^2Xx+2N^2PX^2x^2+N^2X^3x^3$$
$$i=0,k=2,g_{0,2}(xX)=N*1*f(xX)^2=N(P+Xx)^4=NP^4+4NP^3Xx+6NP^2X^2x^2+4NPX^3x^3+NX^4x^4$$
$$i=1,k=2,g_{1,2}(xX)=N*(xX)*f(xX)^2=NXx(P+Xx)^4=NP^4Xx+4NP^3X^2x^2+6NP^2X^3x^3+4NPX^4x^4+NX^5x^5$$
done

for j:0 thru d-m*r-1 do
(print("j=",j,",g",j,",",m,"(xX)=","(xX)"^j,"*f(xX)"^m,"=",gim: (x*'X)^j*fXx^m,"=",expand(gim)),
gxX:append(gxX,[gim])
);

$$j=0,g_{0,3}(xX)=1*f(xX)^3=(P+Xx)^6=P^6+6P^5Xx+15P^4X^2x^2+20P^3X^3x^3+15P^2X^4x^4+6PX^5x^5+X^6x^6$$
$$j=1,g_{1,3}(xX)=(xX)*f(xX)^3=Xx(P+Xx)^6=P^6Xx+6P^5X^2x^2+15P^4X^3x^3+20P^3X^4x^4+15P^2X^5x^5+6PX^6x^6+X^7x^7$$
$$j=2,g_{2,3}(xX)=(xX)^2*f(xX)^3=X^2x^2(P+Xx)^6=P^6X^2x^2+6P^5X^3x^3+15P^4X^4x^4+20P^3X^5x^5+15P^2X^6x^6+6PX^7x^7+X^8x^8$$
done

gxX;
$$[N^3,N^3Xx,N^2(P+Xx)^2,N^2Xx(P+Xx)^2,N(P+Xx)^4,NXx(P+Xx)^4,(P+Xx)^6,Xx(P+Xx)^6,X^2x^2(P+Xx)^6]$$

$$x^1,\ldots,x^{d-1}$$
xpower:create_list(x^i,i,1,d-1);
$$[x,x^2,x^3,x^4,x^5,x^6,x^7,x^8]$$

M:augcoefmatrix(gxX,xpower);
$$\left[\matrix{0&0&0&0&0&0&0&0&N^3\cr N^3X&0&0&0&0&0&0&0&0\cr 2N^2PX&N^2X^2&0&0&0&0&0&0&N^2P^2\cr N^2P^2X&2N^2PX^2&N^2X^3&0&0&0&0&0&0\cr 4NP^3X&6NP^2X^2&4NPX^3&NX^4&0&0&0&0&NP^4\cr NP^4X&4NP^3X^2&6NP^2X^3&4NPX^4&NX^5&0&0&0&0\cr 6P^5X&15P^4X^2&20P^3X^3&15P^2X^4&6PX^5&X^6&0&0& P^6\cr P^6X&6P^5X^2&15P^4X^3&20P^3X^4&15P^2X^5&6P X^6&X^7&0&0\cr 0& P^6X^2&6P^5X^3&15P^4X^4&20P^3X^5&15P^2X^6&6PX^7&X^8&0}\right]$$

$$\left[\matrix{N^3&0&0&0&0&0&0&0&0\cr 0&N^3X&0&0&0&0&0&0&0\cr N^2P^2&2N^2PX&N^2X^2&0&0&0&0&0&0\cr 0&N^2P^2X&2N^2PX^2&N^2X^3&0&0&0&0&0\cr NP^4&4NP^3X&6NP^2X^2&4NPX^3&NX^4&0&0&0&0\cr 0&NP^4X&4NP^3X^2&6NP^2X^3&4NPX^4&NX^5&0&0&0\cr P^6&6P^5X&15P^4X^2&20P^3X^3&15P^2X^4&6PX^5&X^6&0&0\cr 0& P^6X&6P^5X^2&15P^4X^3&20P^3X^4&15P^2X^5&6PX^6&X^7&0\cr 0&0& P^6X^2&6P^5X^3&15P^4X^4&20P^3X^5&15P^2X^6&6PX^7&X^8}\right]$$

M:ev(M,[N=N,P=P,X=X]);
$$\left[\matrix{7670198773742597&0&0&0&0&0&0&0&0\cr 0&23010596321227791&0&0&0&0&0&0&0\cr 135386419411489&13768110448626&350036706321&0&0&0&0&0&0\cr 0&406159258234467&41304331345878&1050110118963&0&0&0&0&0\cr 2389701114893&486040904724&37070916462&1256641236&15974253&0&0&0&0\cr 0&7169103344679&1458122714172&111212749386&3769923708&47922759&0&0&0\cr 42180533641&12868637382&1635843735&110904660&4229415&86022&729&0&0\cr 0&126541600923&38605912146&4907531205&332713980&12688245&258066&2187&0\cr 0&0&379624802769&115817736438&14722593615&998141940&38064735&774198&6561}\right]$$

LLL化簡
B: LLL(M);
$$\left[\matrix{83412628&-91271724&-27587799&-100623168&-100709649&89252928&78155361&202680225&228782070\cr 164609528&-217976916&-267622146&110184705&219274371&225169146&-62478216&-7989111&-216513\cr -78834856&97014168&-7341966&273951288&-166154733&-57299643&-299831139&-30143421&120564936\cr -148796076&254769516&149231061&-295864218&87910272&28543023&-249134292&82347111&-96958458\cr 1763788&20402880&-16597377&-47384811&-126043452&287403633&82562166&-398327058&234910044\cr 23658984&-157701924&142819218&-8117631&410281605&-146082852&-373406193&-393869952&369922302\cr -92491784&338523084&-376090650&50862033&300067821&-401077818&111970026&-180821160&337996476\cr 524968778&-114638199&-300863016&-411132456&-492107157&-216884061&-403226667&-322669980&-332078454\cr 28705084293&19003686300&12994353171&8305795458&5569771815&3738017241&2182968630&1375264332&1161841563}\right]$$

for i:1 thru d do
(print("第",i,"列向量B[",i,"]=",B[ i ]),
print("產生不需要同餘p"^"rm","=p"^(r*m),"的方程式h(x)"),
printList:["h(x)=",B[ i ][1]],
for j:2 thru d do
(if B[ i ][j]>=0 then printList:append(printList,["+"]),/*若係數為正則補印+號*/
printList:append(printList,[B[ i ][j],"(",x/X,")"^(j-1)])
),
apply(print,printList),/*再用apply(print,)將全部內容印在同一行*/
print("h(x)=",hx:sum(B[ i ][j+1]*(x/X)^j,j,0,d-1),"=",factor(hx)),
print("整數解為",integerx:sublist(solve(hx,x),lambda([x],integerp(rhs(x))))),
if length(integerx)>0 then/*若有整數解*/
(for x in integerx do
(print("當整數解",x,"時，可能的因數p=P+x=",P,"+",rhs(x),"=",p: P+rhs(x)),
if mod(N,p^r)=0 then
(print("N可被p"^r,"整除，N可分解成",N,"=",p,""^r,"*",q:N/(p^r)),
i:d/*將i設為d，直接結束for迴圈*/
)
else
(print("N無法被p"^r,"整除"))
)
),
print("－－－－－－－－－")
);

$$\displaystyle h(x)=83412628-91271724\left(\frac{x}{3}\right)-27587799\left(\frac{x}{3}\right)^2-100623168\left(\frac{x}{3}\right)^3-100709649\left(\frac{x}{3}\right)^4+89252928\left(\frac{x}{3}\right)^5+78155361\left(\frac{x}{3}\right)^6+202680225\left(\frac{x}{3}\right)^7+228782070\left(\frac{x}{3}\right)^8$$
$$h(x)=83412628-30423908x-3065311x^2-3726784x^3-1243329x^4+367296x^5+107209x^6+92675x^7+34870x^8$$
$$=(-2+x)^2(20853157+13247180x+7267563x^2+3024072x^3+896349x^4+232155x^5+34870x^6)$$

$$N$$可被$$p^2$$整除，$$N$$可分解成$$197213=61^2 *53$$
done

 歡迎光臨 Math Pro 數學補給站 (https://math.pro/db/) 論壇程式使用 Discuz! 6.1.0