Board logo

標題: 用Maxima學密碼學-Lattice Reduction應用2-找出同餘方程式較小的解 [打印本頁]

作者: bugmens    時間: 2021-4-15 10:20     標題: 用Maxima學密碼學-Lattice Reduction應用2-找出同餘方程式較小的解









方法

範例

問題敘述

設同餘方程式為\(f(x)=a_d x^d+a_{d-1}x^{d-1}+\ldots+a_1 x+a_0\equiv 0 \pmod{N}\)
利用LLL方法可以找出比邊界\(X\)還小的解\(x_0\)(\( |\;x_0|\;<X=N^{\displaystyle \frac{2}{d(d+1)}}\))
使得\(f(x_0)\equiv 0 \pmod{N}\)
設同餘方程式為\(f(x)=1131x^3+14531x^2+116024x+57592\equiv 0 \pmod{123107}\)
\(\displaystyle d=3,X=N^{\frac{2}{3\cdot 4}}=7.0531\)
利用LLL方法可以找出比邊界\(X=7\)還小的解
使得\(f(x_0)\equiv 0 \pmod{123107}\)

步驟1.產生lattice證明向量線性組合方程式的解和原方程式相同。

將\(f(x)\)各項係數取lattice如下
\(B=\matrix{\matrix{常數項&1次方&2次方&\ldots&d-1次方&d次方&} \cr \left[\matrix{a_0&a_1X&a_2X^2&\ldots&a_{d-1}X^{d-1}&a_dX^d&\frac{1}{d+1} \cr N&0&0&0&0&0&0\cr
0&NX&0&0&0&0&0\cr
0&0&NX^2&0&0&0&0\cr
&&&\ddots&&&\cr
0&0&0&0&NX^{d-1}&0&0\cr
0&0&0&0&0&NX^d&0}\right]}\)
該lattice的向量線性組合為
\(\matrix{\matrix{s\cr -s_0 \cr -s_1 \cr -s_2 \cr \vdots \cr -s_{d-1}\cr -s_d}&\left[\matrix{a_0&a_1X&a_2X^2&\ldots&a_{d-1}X^{d-1}&a_dX^d&\frac{1}{d+1} \cr N&0&0&0&0&0&0\cr
0&NX&0&0&0&0&0\cr
0&0&NX^2&0&0&0&0\cr
&&&\ddots&&&\cr
0&0&0&0&NX^{d-1}&0&0\cr
0&0&0&0&0&NX^d&0}\right]}\)
\(=\left[\matrix{sa_0&sa_1X&sa_2X^2&\ldots&sa_{d-1}X^{d-1}&sa_dX^d&\frac{s}{d+1}\cr
-s_0N&0&0&0&0&0&0\cr
0&-s_1NX&0&0&0&0&0\cr
0&0&-s_2NX^2&0&0&0&0\cr
0&0&0&\ddots&0&0&0\cr
0&0&0&0&-s_{d-1}NX^{d-1}&0&0\cr
0&0&0&0&0&-s_dNX^d&0}\right]\)
\(=[(sa_0-s_0N),(sa_1-s_1N)X,\ldots,(sa_{d-1}-s_{d-1}N)X^{d-1},(sa_d-s_dN)X^d,\frac{s}{d+1}]\)

將向量線性組合前\(d+1\)個分量除以\(X^i\)為係數的方程式
\(h(x)=(sa_0-s_0N)+(sa_1-s_1N)x+\ldots+(sa_{d-1}-s_{d-1}N)x^{d-1}+(sa_d-s_dN)x^d\)
 \(=s(a_0+a_1x+\ldots+a_{d-1}x^{d-1}+a_d x^d)-N(s_0+s_1x^1+\ldots+s_{d-1}x^{d-1}+s_dx^d)\)
 \(=sf(x)-N(s_0+s_1x^1+\ldots+s_{d-1}x^{d-1}+s_dx^d)\)
得到\(h(x)\equiv sf(x)\pmod{N}\)
若\(x=x_0\)是\(h(x)\equiv 0 \pmod{N}\)的解,那\(x=x_0\)也會是\(f(x)\equiv 0 \pmod{N}\)的解。
\(B=\left[\matrix{57592&116024\cdot 7^1&14531\cdot 7^2&1131\cdot 7^3& \frac{1}{4}\cr
123107&0&0&0&0\cr
0&123107\cdot 7^1&0&0&0\cr
0&0&123107\cdot 7^2&0&0\cr
0&0&0&123107\cdot 7^3&0}\right]\)

  \(\left[\matrix{57592&812168&712019&387933&\frac{1}{4}\cr
123107&0&0&0&0\cr
0&861749&0&0&0\cr
0&0&6032243&0&0\cr
0&0&0&42225701&0}
\right]\)

步驟2.經LLL化簡得到短向量所形成的方程式不需再同餘\(N\)。

lattice經LLL化簡後第一行為整個lattice中較短向量
取前\(d+1\)個分量\((c_0,c_1X,\ldots,c_{d-1}X^{d-1},c_dX^d)\)將每個分量除以\(X^i\)得到係數\(c_i\)
將係數\(c_i\)組成新方程式\(\displaystyle h(x)=\sum_{i=0}^d c_ix^i\)
若每個係數\(\displaystyle |\;c_i|\;<\frac{N}{(d+1)X^i}\),要求的解\(x\)小於邊界\(X\)(\(|\;x|\;<X\))。
\(\displaystyle |\;h(x)|\;= |\;\sum_{i=0}^d c_i x^i|\;\le \sum_{i=0}^d |\;c_i|\; |\;x|\;^i<\sum_{i=0}^d \frac{N}{(d+1)X^i} X^i\)
\(\displaystyle =\sum_{i=0}^d \frac{N}{d+1}=\frac{N}{d+1}\cdot (d+1)=N\),得到\(|\;h(x)|\;<N\)
原本要解同餘方程式\(h(x)\equiv 0\pmod{N}\),因為\(|\;h(x)|\;<N\),變成解一般方程式\(h(x)=0\)。
\(B=\left[\matrix{-9310&13671&-4704&343&5905\cr
9310&-13671&4704&-343&\frac{99487}{4}\cr
85867&54684&-18816&1372&-\frac{28627}{4}\cr
-28932&-96173&-263424&19208&-\frac{31457}{4}\cr
44745&-4151&-100499&-432523&\frac{3537}{2}}\right]\)
\(\displaystyle h(x)=-9310+\frac{13671}{7^1}x-\frac{4704}{7^2}x^2+\frac{343}{7^3}x^3\)
  \(=-9310+1953x-96x^2+x^3\)
其中各項係數符合
\(\displaystyle |\;-9310|\;<\frac{123107}{4\cdot 7^0}=30776.75\)
\(\displaystyle |\;1953|\;<\frac{123107}{4\cdot 7^1}=4396.68\)
\(\displaystyle |\;-96|\;<\frac{123107}{4\cdot 7^2}=628.10\)
\(\displaystyle |\;1|\;<\frac{123107}{4\cdot 7^3}=89.73\)

步驟3.解一般方程式得到小於\(X\)的解\(x=x_0\)。

\(h(x)=(x-7)(x-19)(x-70)=0\)
\(x=7,19,70\),也是\(f(x)\equiv 0 \pmod{123107}\)的解。
驗算
\(f(7)=1969712\equiv 0\pmod{123107}\)
\(f(19)=15265268\equiv 0\pmod{123107}\)
\(f(70)=467314172\equiv 0\pmod{123107}\)


步驟4.計算邊界\(X\)的範圍
計算行列式值\(\displaystyle det(B)\)
\(=\left|\ \matrix{a_0&a_1X&a_2X^2&\ldots&a_{d-1}X^{d-1}&a_dX^d&\frac{1}{d+1} \cr N&0&0&0&0&0&0\cr
0&NX&0&0&0&0&0\cr
0&0&NX^2&0&0&0&0\cr
&&&\ddots&&&\cr
0&0&0&0&NX^{d-1}&0&0\cr
0&0&0&0&0&NX^d&0}\right|\)
以第\(d+2\)行降階,0降階後仍是0,只剩下\(\displaystyle \frac{1}{d+1}\)再乘上餘因子
\(\displaystyle =\frac{1}{d+1}\left|\matrix{N&0&0&0&0&0\cr
0&NX&0&0&0&0\cr
0&0&NX^2&0&0&0\cr
&&&\ddots&&\cr
0&0&0&0&NX^{d-1}&0\cr
0&0&0&0&0&NX^d} \right|\)
行列式只有對角線有值,其餘為0,行列式值由對角線元素相乘
\(\displaystyle =\frac{N^{d+1}X^{\frac{d(d+1)}{2}}}{d+1}\)

經LLL化簡後的第一列向量\(\vec{b_1}\)是整個lattice中較短的向量,向量長度符合不等式\(\Vert\;\vec{b_1}\Vert\;\le 2^{(n-1)/4}\cdot (det(B))^{1/n}\)
https://en.wikipedia.org/wiki/Le ... reduction_algorithm

其中lattice有\(d+2\)列,\(n=d+2\)。將\(\displaystyle det(B)=\frac{N^{d+1}X^{\frac{d(d+1)}{2}}}{d+1}\)代入得到\(\displaystyle \Vert\;\vec{b_1}\Vert\;\le 2^{\frac{d+1}{4}}\left(\frac{N^{d+1}X^{\frac{d(d+1)}{2}}}{d+1}\right)^{\frac{1}{d+2}}\)

若想找到邊界\(X\)的範圍,需要第一列向量長度再小於\(\displaystyle \frac{N}{d+1}\)和需要\(\displaystyle 2^{\frac{d+1}{4}}\left(\frac{N^{d+1}X^{\frac{d(d+1)}{2}}}{d+1}\right)^{\frac{1}{d+2}}<\frac{N}{d+1}\)
不等式兩邊\(d+2\)次方,\(\displaystyle 2^{\frac{(d+1)(d+2)}{4}}\frac{N^{d+1}X^{\frac{d(d+1)}{2}}}{d+1}<\frac{N^{d+2}}{(d+1)^{d+2}}\)
重新整理不等式,\(\displaystyle 2^{\frac{(d+1)(d+2)}{4}}(d+1)^{d+1}X^{\frac{d(d+1)}{2}}<N\)
令\(\epsilon(d)=2^{\frac{(d+1)(d+2)}{4}}(d+1)^{d+1}\)僅和\(d\)有關的函數,當\(d\)固定時\(\epsilon(d)\)是常數
\(\epsilon(d)X^{\frac{d(d+1)}{2}}<N\),得到邊界\(\displaystyle X<N^{\frac{2}{d(d+1)}}\)

參考資料
Håstad, J.: Solving Simultaneous Modular Equations of Low Degree. SIAM Journalon Computing 17(2), 336–341 (1988)
http://www.csc.kth.se/~johanh/rsalowexponent.pdf
http://citeseerx.ist.psu.edu/vie ... p=rep1&type=pdf
註:
原本論文以\(n\)代表邊界,但之後的資料改以\(X\)表示,本文章也以\(X\)表示能找到小於\(X\)的解\(x_0\)。



請下載LLL.zip,解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下
要先載入LLL.mac才能使用LLL指令

(%i1) load("LLL.mac");
(%o1) C:/maxima-5.43.2/share/maxima/5.43.2/LLL.mac

同餘方程式\(f(x)\)
(%i2) fx:1131*x^3+14531*x^2+116024*x+57592;
(fx) \(1131x^3+14531x^2+116024x+57592\)

\(f(x)\equiv 0\pmod{N}\)
(%i3) N:123107;
(N) \(123107\)

\(f(x)\)的次數d
(%i4) d:hipow(fx,x);
(d) \(3\)

希望能找到\(|\;x|\;<X=N^{2/d(d+1)}\),\(f(x)\equiv 0\pmod{N}\)
(%i5) X:floor(N^(2/(d*(d+1))));
(X) \(7\)

定義lattice產生方式
(%i7)
kill(genlattice)$
genlattice[i,j]:=
if i=1 and j=d+2 then 1/(d+1)/*第1列第d+2行為1/(d+1)*/
else if i=1 then coeff(fx,x,j-1)*X^(j-1)/*第一行為f(x)係數乘上X^(j-1)*/
else if i=j+1 then N*X^(j-1)/*子對角線為NX^(j-1)*/
else 0$/*剩下元素為0*/


根據\(f(x)\)係數,產生lattice
(%i8) latticeB:genmatrix(genlattice,d+2,d+2);
(latticeB) \(\left[\matrix{\displaystyle 57592&812168&712019&387933&\frac{1}{4}\cr
123107&0&0&0&0\cr
0&861749&0&0&0\cr
0&0&6032243&0&0\cr
0&0&0&42225701&0}\right]\)

經LLL化簡後的lattice B
(%i9) latticeB: LLL(latticeB);
(latticeB) \(\left[\matrix{\displaystyle -9310&13671&-4704&343&5905\cr
9310&-13671&4704&-343&\frac{99487}{4}\cr
85867&54684&-18816&1372&-\frac{28627}{4}\cr
-28932&-96173&-263424&19208&-\frac{31457}{4}\cr
44745&-4151&-100499&-432523&\frac{3537}{2}}\right]\)

lattice第一行是整個lattice中較短的向量\(\vec{b_1}\)
(%i10) b1:latticeB[1];
(b1) \([-9310,13671,-4704,343,5905]\)

取\(\vec{b_1}\)前\(d+1\)個分量除以\(X^i\)乘上\(x^i\)形成\(h(x)\)
(%i11) hx:sum(b1[i+1]/X^i*x^i,i,0,d);
(hx) \(x^3-96x^2+1953x-9310\)

將\(h(x)\)因式分解
(%i12) factor(hx);
(%o12) \((x-70)(x-19)(x-7)\)

得到\(h(x)\)的解,因為這個範例比較簡單\(f(x)\equiv 0\pmod{N}\)的三個解都找出來
(%i13) roots:solve(hx,x);
(roots) \([x=7,x=19,x=70]\)

驗證答案
(%i14)
for root in roots do
  (print(將,root,代入f(,rhs(root),)=,ev(fx,root),≡0 (mod ,N,))
  )$

將\(x=7\)代入\(f(7)=1969712\equiv 0 \pmod{123107}\)
將\(x=19\)代入\(f(19)=15265268\equiv 0 \pmod{123107}\)
將\(x=70\)代入\(f(70)=467314172\equiv 0 \pmod{123107}\)
作者: bugmens    時間: 2021-5-10 16:40

使用低次方公鑰\(e\)的RSA傳送線性相關訊息是不安全的,傳送超過\(\displaystyle \frac{e(e+1)}{2}\)個加密訊息能讓破解者回復原本的訊息。

設使用低次方公鑰\(e=3\),原本訊息\(m\),在訊息後面串接加密時間\(TimeStamp_i\)當作補綴,計算3次方後同餘\(n_i\)得到密文\(Cipertext_i\)。
\(Cipertext_i=(10000m+TimeStamp_i)^3\pmod{n_i}\)
當破解者收集超過\(\displaystyle \frac{3\cdot 4}{2}=6\)個密文\(Cipertext_i\)、加密時間\(TimeStamp_i\)和公鑰\(n_i\),利用前一篇文章的方法可以在多項式時間內回復原本的訊息\(m\)。
此時\(\displaystyle n_1>2^{\frac{(e+1)(e+2)}{4}}(e+1)^{(e+1)}\),\(n=min(n_i)\),\(n_i\ge n\)
\(\displaystyle N=\prod_{i=1}^k n_i\ge n_1\prod_{i=2}^{\frac{d(d+1)}{2}+1}n_i>2^{\frac{(e+1)(e+2)}{2}}(e+1)^{(e+1)}n^{\frac{d(d+1)}{2}}\)

破解者收集到7組密文、加密時間和公鑰
\(TimeStamp_1=\)13點40分產生密文\(Cipertext_1=10117\),公鑰\(n_1=14857\)
\(TimeStamp_2=\)13點47分產生密文\(Cipertext_2=13166\),公鑰\(n_2=15397\)
\(TimeStamp_3=\)13點56分產生密文\(Cipertext_3=11707\),公鑰\(n_3=16199\)
\(TimeStamp_4=\)14點09分產生密文\(Cipertext_4=1590\),公鑰\(n_4=16463\)
\(TimeStamp_5=\)14點18分產生密文\(Cipertext_5=15758\),公鑰\(n_5=16171\)
\(TimeStamp_6=\)14點20分產生密文\(Cipertext_6=7371\),公鑰\(n_6=16157\)
\(TimeStamp_7=\)14點24分產生密文\(Cipertext_7=6303\),公鑰\(n_7=16241\)

根據密文和加密時間產生多項式
\(f_i(x)=(10000x+TimeStamp_i)^3-Cipertext_i\pmod{n_i}\)
\(f_1(x)=(10000x+1340)^3-10117\equiv-7380x^3+7136x^2-5462x+2733\pmod{14857}\)
\(f_2(x)=(10000x+1347)^3-13166\equiv1351x^3+7316x^2-5044x-847\pmod{15397}\)
\(f_3(x)=(10000x+1356)^3-11707\equiv-4994x^3+4461x^2-2123x-3373\pmod{16199}\)
\(f_4(x)=(10000x+1409)^3-1590\equiv-7473x^3-3954x^2+4418x-1917\pmod{16463}\)
\(f_5(x)=(10000x+1418)^3-15758\equiv-5245x^3-2021x^2-7211x+1009\pmod{16171}\)
\(f_6(x)=(10000x+1420)^3-7371\equiv1554x^3-2117x^2-1884x+1717\pmod{16157}\)
\(f_7(x)=(10000x+1424)^3-6303\equiv4317x^3+441x^2-301x-5633\pmod{16241}\)

\(\displaystyle N=\prod_{i=1}^7 n_i=258865864180238903908838873371\)
\(X=\lfloor\;N^{2/(d(d+1))}\rfloor\;=79832\)

利用中國餘數定理計算新的方程式係數
將\(f_i(x)\)的常數項係數以中國餘數定理計算新的常數項\(c_0\)
\(c_0\equiv\cases{2733\pmod{14857}\cr
-847\pmod{15397}\cr
-3373\pmod{16199}\cr
-1917\pmod{16463}\cr
1009\pmod{16171}\cr
1717\pmod{16157}\cr
-5633\pmod{16241}}\),\(c_0\equiv 204373190208566474382317165684\pmod{N}\)

將\(f_i(x)\)的1次方係數以中國餘數定理計算新的1次方係數\(c_1\)
\(c_1\equiv\cases{-5462\pmod{14857}\cr
-5044\pmod{15397}\cr
-2123\pmod{16199}\cr
4418\pmod{16463}\cr
-7211\pmod{16171}\cr
-1884\pmod{16157}\cr
-301\pmod{16241}}\),\(c_1\equiv 249751034306884980399002316934\pmod{N}\)

將\(f_i(x)\)的2次方係數以中國餘數定理計算新的2次方係數\(c_2\)
\(c_2\equiv\cases{7136\pmod{14857}\cr
7316\pmod{15397}\cr
4461\pmod{16199}\cr
-3954\pmod{16463}\cr
-2021\pmod{16171}\cr
-2117\pmod{16157}\cr
441\pmod{16241}}\),\(c_2\equiv 189008702173331023044971363347\pmod{N}\)

將\(f_i(x)\)的3次方係數以中國餘數定理計算新的3次方係數\(c_3\)
\(c_3\equiv\cases{-7380\pmod{14857}\cr
1351\pmod{15397}\cr
-4994\pmod{16199}\cr
-7473\pmod{16463}\cr
-5245\pmod{16171}\cr
1554\pmod{16157}\cr
4317\pmod{16241}}\),\(c_3\equiv 1000000000000\pmod{N}\)

產生新的同餘方程式\(g(x)\pmod{N}\),若\(x=x_0\)是\(g(x)\equiv 0\pmod{N}\)解,那\(x=x_0\)也會是\(f_i(x)\equiv 0\pmod{n_i}\)的解
\(g(x)=c_0+c_1x+c_2x^2+c_3x^3\pmod{N}\)
 \(=204373190208566474382317165684+249751034306884980399002316934x+189008702173331023044971363347x^2+1000000000000x^3\pmod{N}\)

產生lattice,希望能找到較小的解\(x=x_0\)\((x_0<X=78932)\)
\(B=\left[\matrix{c_0&c_1X&c_2X^2&c_3X^3&\frac{1}{d+1}\cr
N&0&0&0&0\cr
0&NX&0&0&0\cr
0&0&NX^2&0&0\cr
0&0&0&NX^3&0}\right]\)
\(\left[\matrix{
204373190208566474382317165684&19938124570787241755213152965475088&1204580474576509549683162316445791745728&508781169018368000000000000&\frac{1}{4}\cr
258865864180238903908838873371&0&0&0&0\cr
0&20665779669236832176850424938953672&0&0&0\cr
0&0&1649790522554514786342323123726549543104&0&0\cr
0&0&0&131706076996572024423280339613337903125078528&0}\right]\)

經LLL化簡lattice
\(B=\left[\matrix{
0&0&0&0&\frac{258865864180238903908838873371}{4}\cr
19032544658836594241198114925&-110020730529168337991621111320&-69821420216485869263622535616&-94549927515912701524841700864&-\frac{74058264293788734740876853939}{4}\cr
2056083148951895180465932260&8991794266570450022519459504&-157772457706749993512226999616&88218148052792936245521824256&-\frac{31442973836260991406843209159}{2}\cr
258865864180238903908838873371&0&0&0&0\cr
-60101849692113834636025787760&433902895535857979265114013016&-240340197778189487664217294976&-337639116008434960645370124800&-\frac{44674685201276114130186287835}{4}}\right]\)

第1列向量都是0,改取第2列向量
\(\vec{b_2}=[19032544658836594241198114925,-110020730529168337991621111320,-69821420216485869263622535616,-94549927515912701524841700864,-\frac{74058264293788734740876853939}{4}]\)

化簡後方程式\(h(x)\)不需要同餘\(N\)
\(\displaystyle h(x)=\frac{19032544658836594241198114925}{X^0}-\frac{110020730529168337991621111320}{X^1}x-\frac{69821420216485869263622535616}{X^2}x^2-\frac{94549927515912701524841700864}{X^3}x^3\)
 \(\displaystyle =\frac{19032544658836594241198114925}{79832^0}-\frac{110020730529168337991621111320}{79832^1}x-\frac{69821420216485869263622535616}{79832^2}x^2-\frac{94549927515912701524841700864}{79832^3}x^3\)
 \(=19032544658836594241198114925-1378153253446842594343385x-10955561955008732159x^2-185836137957573x^3\)
 \(=-(x-12345)(185836137957573x^2+13249709078094970844x+1541720912015925009412565)\)
得\(x=12345\)


參考資料
Håstad, J.: Solving Simultaneous Modular Equations of Low Degree. SIAM Journalon Computing 17(2), 336–341 (1988)
http://www.csc.kth.se/~johanh/rsalowexponent.pdf
http://citeseerx.ist.psu.edu/vie ... p=rep1&type=pdf
註:
原本論文以n代表邊界,但之後的資料改以X表示,本文章也以X表示能找到小於X的解x0。


請下載LLL.zip,解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下
要先載入LLL.mac才能使用LLL指令

(%i1) load("LLL.mac");
(%o1) C:/maxima-5.43.2/share/maxima/5.43.2/LLL.mac

有7個密文
(%i2) Cipertext:[10117,13166,11707,1590,15758,7371,6303];
(Cipertext) \([10117,13166,11707,1590,15758,7371,6303]\)

有7個公鑰\(n_i\)
(%i3) n:[14857,15397,16199,16463,16171,16157,16241];
(n) \([14857,15397,16199,16463,16171,16157,16241]\)

有7個時戳
(%i4) Timestamp:[1340,1347,1356,1409,1418,1420,1424];
(Timestamp) \([1340,1347,1356,1409,1418,1420,1424]\)

公鑰\(e\)
(%i5) e:3;
(e) 3

同餘方程式最高次方\(d\)
(%i6) d:e;
(d) 3

根據密文和時戳產生同餘方程式\(f_i(x)\)
(%i7) fx:create_list(polymod((10000*x+Timestamp[ i ])^3-Cipertext[ i ],n[ i ]),i,1,length(n));
(fx) \(\matrix{[-7380x^3+7136x^2-5462x+2733,\cr
1351x^3+7316x^2-5044x-847,\cr
-4994x^3+4461x^2-2123x-3373,\cr
-7473x^3-3954x^2+4418x-1917,\cr
-5245x^3-2021x^2-7211x+1009,\cr
1554x^3-2117x^2-1884x+1717,\cr
4317x^3+441x^2-301x-5633]}\)

\(f_i(x)\)的常數項係數
(%i8) a0:create_list(coeff(fx[ i ],x,0),i,1,length(n));
(a0) \([2733,-847,-3373,-1917,1009,1717,-5633]\)

\(f_i(x)\)的1次方係數
(%i9) a1:create_list(coeff(fx[ i ],x,1),i,1,length(n));
(a1) \([-5462,-5044,-2123,4418,-7211,-1884,-301]\)

\(f_i(x)\)的2次方係數
(%i10) a2:create_list(coeff(fx[ i ],x,2),i,1,length(n));
(a2) \([7136,7316,4461,-3954,-2021,-2117,441]\)

\(f_i(x)\)的3次方係數
(%i11) a3:create_list(coeff(fx[ i ],x,3),i,1,length(n));
(a3) \([-7380,1351,-4994,-7473,-5245,1554,4317]\)

利用中國餘數定理計算新的常數項\(c_0\)
(%i12) c0:chinese(a0,n);
(c0) \(204373190208566474382317165684\)

利用中國餘數定理計算新的1次方係數\(c_1\)
(%i13) c1:chinese(a1,n);
(c1) \(249751034306884980399002316934\)

利用中國餘數定理計算新的2次方係數\(c_2\)
(%i14) c2:chinese(a2,n);
(c2) \(189008702173331023044971363347\)

利用中國餘數定理計算新的3次方係數\(c_3\)
(%i15) c3:chinese(a3,n);
(c3) \(1000000000000\)

產生新的同餘方程式\(g(x)\pmod{N}\),若\(x=x_0\)是\(g(x)\equiv 0\pmod{N}\)的解,那\(x=x_0\)也會是\(f_i(x)\equiv 0\pmod{n_i}\)的解
(%i16) gx:c0+c1*x+c2*x^2+c3*x^3;
(gx) \(1000000000000x^3+189008702173331023044971363347x^2+249751034306884980399002316934x+204373190208566474382317165684\)

\(N=\prod_{i=1}^7 n_i\)
(%i17) N:product(n[ i ],i,1,length(n));
(N) \(258865864180238903908838873371\)

希望能找到\(|\;x_0|\;<X=\lfloor\;N^{2/(d(d+1))} \rfloor\;,g(x_0)\equiv 0\pmod{N}\)
(%i18) X:floor(N^(2/(d*(d+1))));
(X) \(79832\)

定義lattice產生方式
(%i20)
kill(genlattice)$
genlattice[i,j]:=
if i=1 and j=d+2 then 1/(d+1)/*第1列第d+2行為1/(d+1)*/
else if i=1 then coeff(gx,x,j-1)*X^(j-1)/*第一行為f(x)係數乘上X^(j-1)*/
else if i=j+1 then N*X^(j-1)/*子對角線為NX^(j-1)*/
else 0$/*剩下元素為0*/


根據\(g(x)\)係數,產生lattice
(%i21) latticeB:genmatrix(genlattice,d+2,d+2);
(latticeB) \(\left[\matrix{
204373190208566474382317165684&19938124570787241755213152965475088&1204580474576509549683162316445791745728&508781169018368000000000000&\frac{1}{4}\cr
258865864180238903908838873371&0&0&0&0\cr
0&20665779669236832176850424938953672&0&0&0\cr
0&0&1649790522554514786342323123726549543104&0&0\cr
0&0&0&131706076996572024423280339613337903125078528&0}\right]\)

經LLL化簡後的lattice B
(%i22) latticeB: LLL(latticeB);
(latticeB) \(\left[\matrix{
0&0&0&0&\frac{258865864180238903908838873371}{4}\cr
19032544658836594241198114925&-110020730529168337991621111320&-69821420216485869263622535616&-94549927515912701524841700864&-\frac{74058264293788734740876853939}{4}\cr
2056083148951895180465932260&8991794266570450022519459504&-157772457706749993512226999616&88218148052792936245521824256&-\frac{31442973836260991406843209159}{2}\cr
258865864180238903908838873371&0&0&0&0\cr
-60101849692113834636025787760&433902895535857979265114013016&-240340197778189487664217294976&-337639116008434960645370124800&-\frac{44674685201276114130186287835}{4}}\right]\)

第1列向量都是0,改取第2列向量
(%i23) b2:latticeB[2];
(b2) \([19032544658836594241198114925,-110020730529168337991621111320,-69821420216485869263622535616,-94549927515912701524841700864,-\frac{74058264293788734740876853939}{4}]\)

化簡後方程式\(h(x)\)不需要同餘\(N\)
(%i24) hx:sum(b2[i+1]/X^i*x^i,i,0,d);
(hx) \(-185836137957573x^3-10955561955008732159x^2-1378153253446842594343385x+19032544658836594241198114925\)

將h(x)因式分解
(%i25) factor(hx);
(%o25) \(-(x-12345)(185836137957573x^2+13249709078094970844x+1541720912015925009412565)\)

得到較小的解\(x\)
(%i26) x:12345;
(x) \(12345\)

驗證答案\(f_i(12345)\equiv 0 \pmod{n_i}\)
(%i27) create_list(mod(ev(fx[ i ],x=x),n[ i ]),i,1,length(n));
(%o27) \([0,0,0,0,0,0,0]\)
作者: bugmens    時間: 2021-5-22 00:05

Rabin加密法請參閱wiki。https://en.wikipedia.org/wiki/Rabin_cryptosystem


公式範例
產生金鑰
1.選擇兩個不相同的大質數\(p\)和\(q\),其中\(p\equiv 3\pmod{4}\)和\(q\equiv 3\pmod{4}\)
2.計算\(n=pq\)
\(n\)是公鑰和\((p,q)\)是私鑰
私鑰\(p=7\)和\(q=11\)
公鑰\(n=77\)
加密
訊息\(M\)轉換成數字\(m\)(\(m<n\))
計算密文\(c=m^2\pmod{n}\)
明文\(m=20\)
密文\(c=20^2=400=15\pmod{77}\)
解密
計算密文\(c\)在同餘\(n\)的平方根得到\(m\)
1.計算\(c\)在同餘\(p\)和\(q\)的平方根
\(m_p=c^{\frac{1}{4}(p+1)}\pmod{p}\)
\(m_q=c^{\frac{1}{4}(q+1)}\pmod{q}\)
2.使用擴展歐幾里得演算法計算\(y_p\)和\(y_q\)使得\(y_p\cdot p+y_q\cdot q=1\)。
3.使用中國餘數定理\(c\)在同餘\(n\)的平方根
\(r_1=(y_p\cdot p\cdot m_q+y_q\cdot q\cdot m_p)\pmod{n}\)
\(r_2=n-r_1\)
\(r_3=(y_p\cdot p\cdot m_q-y_q\cdot q\cdot m_p)\pmod{n}\)
\(r_4=n-r_3\)
4個\(r_i\)值其中一個會是明文\(m\)
1.計算\(m_p=15^{\frac{1}{4}(7+1)}=15^2=1\pmod{7}\)
\(m_q=15^{\frac{1}{4}(11+1)}=15^3=9\pmod{11}\)
2.使用擴展歐幾里得演算法計算\(y_p\)和\(y_q\)
\(p=7\),\(q=11\)
\(q-p=11-7=4\)
\(p-(q-p)=7-4\),\(2p-q=3\)
\((q-p)-(2p-q)=4-3\),\(-3p+2q=1\)
\(y_p=-3\)和\(y_q=2\)
3.計算4個\(r_i\)值
\(r_1=(-3\cdot 7\cdot 9+2\cdot 11\cdot 1)\pmod{77}=64\)
\(r_2=77-64=13\)
\(r_3=(-3\cdot 7\cdot 9-2\cdot 11\cdot 1)\pmod{77}=20\)
\(r_4=77-20=57\)
其中\(r_3=20\)是當初的明文


使用Rabin加密函數傳送線性相關訊息是不安全的,傳送3個加密訊息能讓破解者在多項式時間內回復原本的訊息。

設原本訊息\(m\),在訊息後面串接加密時間\(TimeStamp_i\)當作補綴,計算2次方後同餘\(n_i\)得到密文\(Cipertext_i\)。
\(Cipertext_i=(10000m+TimeStamp_i)^2\pmod{n_i}\)
破解者收集到3組密文、加密時間和公鑰
\(TimeStamp_1=\)13點40分產生密文\(Cipertext_1=5926\),公鑰\(n_1=14857\)
\(TimeStamp_2=\)13點47分產生密文\(Cipertext_2=3031\),公鑰\(n_2=15397\)
\(TimeStamp_3=\)13點56分產生密文\(Cipertext_3=5421\),公鑰\(n_3=16199\)

根據密文和加密時間產生多項式
\(f_i(x)=(10000x+TimeStamp_i)^2-Cipertext_i\pmod{n_i}\)
\(f_1(x)=-2467x^2-2028x+6834\pmod{14857}\)
\(f_2(x)=-3515x^2-4750x-5468\pmod{15397}\)
\(f_3(x)=3573x^2+2874x+2828\pmod{16199}\)

\(\displaystyle N=\prod_{i=1}^3 n_i=3705573556571\)
\(X=\lfloor\;N^{2/(d(d+1))}\rfloor\;=15474\)

利用中國餘數定理計算新的方程式係數
將\(f_i(x)\)的常數項係數以中國餘數定理計算新的常數項\(c_0\)
\(c_0\equiv\cases{6834\pmod{14857}\cr -5468\pmod{15397}\cr 2828\pmod{16199}}\),\(c_0\equiv 489114568907 \pmod{N}\)

將\(f_i(x)\)的1次方係數以中國餘數定理計算新的1次方係數\(c_1\)
\(c_1\equiv\cases{-2028 \pmod{14857}\cr -4750\pmod{15397}\cr 2874\pmod{16199}}\),\(c_1\equiv 3243065948060 \pmod{N}\)

將\(f_i(x)\)的2次方係數以中國餘數定理計算新的2次方係數\(c_1\)
\(c_2\equiv\cases{-2467 \pmod{14857}\cr -3515\pmod{15397}\cr 3573\pmod{16199}}\),\(c_2\equiv 100000000 \pmod{N}\)

產生新的同餘方程式\(g(x)\pmod{N}\),若\(x=x_0\)是\(g(x)\equiv 0\pmod{N}\)解,那\(x=x_0\)也會是\(f_i(x)\equiv 0\pmod{n_i}\)的解
\(g(x)=c_0+c_1x+c_2x^2\pmod{N}\)
 \(=489114568907+3243065948060x+100000000x^2\pmod{N}\)

產生lattice,希望能找到較小的解\(x=x_0\)\((x_0<X=15474)\)
\(B=\left[\matrix{c_0&c_1X&c_2X^2&\frac{1}{d+1}\cr
N&0&0&0\cr
0&NX&0&0\cr
0&0&NX^2&0}\right]\)
\(\left[\matrix{489114568907&50183202480280440&23944467600000000&\frac{1}{3}\cr
3705573556571&0&0&0\cr
0&57340045214379654&0&0\cr
0&0&887279859647310765996&0}\right]\)

經LLL化簡lattice
\(B=\left[\matrix{0&0&0&\frac{3705573556571}{3}\cr
3705573556571&0&0&0\cr
-705084292305&-1585793949534&3095540771328&\frac{167522755129}{3}\cr
233266894054&-3534864776520&-1757763366516&240304851747}\right]\)

第1,2列向量都有0,改取第3列向量
\(\displaystyle \vec{b_3}=[-705084292305,-1585793949534,3095540771328,\frac{167522755129}{3}]\)

化簡後方程式\(h(x)\)不需要同餘\(N\)
\(\displaystyle h(x)=-\frac{705084292305}{X^0}-\frac{1585793949534}{X^1}x+\frac{3095540771328}{X^2}x^2\)
 \(\displaystyle =-\frac{705084292305}{15474^0}-\frac{1585793949534}{15474^1}x+\frac{3095540771328}{15474^2}x^2\)
 \(=-705084292305-102481191x+12928x^2\)
 \(=(x-12345)(12928x+57114969)\)
得\(x=12345\)


參考資料
Håstad, J.: Solving Simultaneous Modular Equations of Low Degree. SIAM Journalon Computing 17(2), 336–341 (1988)
http://www.csc.kth.se/~johanh/rsalowexponent.pdf
http://citeseerx.ist.psu.edu/vie ... p=rep1&type=pdf
註:
原本論文以n代表邊界,但之後的資料改以X表示,本文章也以X表示能找到小於X的解x0。


請下載LLL.zip,解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下
要先載入LLL.mac才能使用LLL指令

(%i1) load("LLL.mac");
(%o1) C:/maxima-5.43.2/share/maxima/5.43.2/LLL.mac

有3個密文
(%i2) Cipertext:[5926,3031,5421];
(Cipertext) \([5926,3031,5421]\)

有3個公鑰\(n_i\)
(%i3) n:[14857,15397,16199];
(n) \([14857,15397,16199]\)

有3個時戳
(%i4) Timestamp:[1340,1347,1356];
(Timestamp) \([1340,1347,1356]\)

同餘方程式最高次方\(d\)
(%i5) d:2;
(d) 2

根據密文和時戳產生同餘方程式\(f_i(x)\)
(%i6) fx:create_list(polymod((10000*x+Timestamp[ i ])^3-Cipertext[ i ],n[ i ]),i,1,length(n));
(fx) \(\matrix{[-2467x^2-2028x+6834,\cr -3515x^2-4750x-5468,\cr 3573x^2+2874x+2828]}\)

\(f_i(x)\)的常數項係數
(%i7) a0:create_list(coeff(fx[ i ],x,0),i,1,length(n));
(a0) \([6834,-5468,2828]\)

\(f_i(x)\)的1次方係數
(%i8) a1:create_list(coeff(fx[ i ],x,1),i,1,length(n));
(a1) \([-2028,-4750,2874]\)

\(f_i(x)\)的2次方係數
(%i9) a2:create_list(coeff(fx[ i ],x,2),i,1,length(n));
(a2) \([-2467,-3515,3573]\)

利用中國餘數定理計算新的常數項\(c_0\)
(%i10) c0:chinese(a0,n);
(c0) \(489114568907\)

利用中國餘數定理計算新的1次方係數\(c_1\)
(%i11) c1:chinese(a1,n);
(c1) \(3243065948060\)

利用中國餘數定理計算新的2次方係數\(c_2\)
(%i12) c2:chinese(a2,n);
(c2) \(100000000\)

產生新的同餘方程式\(g(x)\pmod{N}\),若\(x=x_0\)是\(g(x)\equiv 0\pmod{N}\)的解,那\(x=x_0\)也會是\(f_i(x)\equiv 0\pmod{n_i}\)的解
(%i13) gx:c0+c1*x+c2*x^2+c3*x^3;
(gx) \(100000000x^2+3243065948060x+489114568907\)

\(\displaystyle N=\prod_{i=1}^3 n_i\)
(%i14) N:product(n[ i ],i,1,length(n));
(N) \(3705573556571\)

希望能找到\(|\;x_0|\;<X=\lfloor\;N^{2/(d(d+1))} \rfloor\;,g(x_0)\equiv 0\pmod{N}\)
(%i15) X:floor(N^(2/(d*(d+1))));
(X) \(15474\)

定義lattice產生方式
(%i17)
kill(genlattice)$
genlattice[i,j]:=
if i=1 and j=d+2 then 1/(d+1)/*第1列第d+2行為1/(d+1)*/
else if i=1 then coeff(gx,x,j-1)*X^(j-1)/*第一行為f(x)係數乘上X^(j-1)*/
else if i=j+1 then N*X^(j-1)/*子對角線為NX^(j-1)*/
else 0$/*剩下元素為0*/


根據\(g(x)\)係數,產生lattice
(%i18) latticeB:genmatrix(genlattice,d+2,d+2);
(latticeB) \(\left[\matrix{
489114568907&50183202480280440&23944467600000000&\frac{1}{3}\cr
3705573556571&0&0&0\cr
0&57340045214379654&0&0\cr
0&0&887279859647310765996&0}\right]\)

經LLL化簡後的lattice B
(%i19) latticeB: LLL(latticeB);
(latticeB) \(\left[\matrix{\displaystyle 0&0&0&\frac{3705573556571}{3}\cr
3705573556571&0&0&0\cr
-705084292305&-1585793949534&3095540771328&\frac{167522755129}{3}\cr
233266894054&-3534864776520&-1757763366516&240304851747}\right]\)

第1,2列向量都有0,改取第3列向量
(%i20) b3:latticeB[3];
(b3) \(\displaystyle [-705084292305,-1585793949534,3095540771328,\frac{167522755129}{3}]\)

化簡後方程式\(h(x)\)不需要同餘\(N\)
(%i21) hx:sum(b2[i+1]/X^i*x^i,i,0,d);
(hx) \(12928x^2-102481191x-705084292305\)

將\(h(x)\)因式分解
(%i22) factor(hx);
(%o22) \((x-12345)(12928x+57114969)\)

得到較小的解\(x\)
(%i23) x:12345;
(x) \(12345\)

驗證答案\(f_i(12345)\equiv 0 \pmod{n_i}\)
(%i24) create_list(mod(ev(fx[ i ],x=x),n[ i ]),i,1,length(n));
(%o24) \([0,0,0]\)
作者: bugmens    時間: 2021-6-6 21:25



Håstad方法

Coppersmith方法

可以找出比邊界\(X\)還小的解\(x_0\)(\(\displaystyle |\;x_0|\;<X=N^{\displaystyle \frac{2}{d(d+1)}}\))可以找出比邊界\(X\)還小的解\(x_0\)(\(\displaystyle |\;x_0|\;<X=\frac{1}{2}N^{\displaystyle \frac{1}{d}}\))
將\(f(x)\)各項係數取lattice如下
\(B=\matrix{\matrix{常數項&1次方&2次方&\ldots&d-1次方&d次方&} \cr \left[\matrix{a_0&a_1X&a_2X^2&\ldots&a_{d-1}X^{d-1}&a_dX^d&\frac{1}{d+1} \cr N&0&0&0&0&0&0\cr
0&NX&0&0&0&0&0\cr
0&0&NX^2&0&0&0&0\cr
&&&\ddots&&&\cr
0&0&0&0&NX^{d-1}&0&0\cr
0&0&0&0&0&NX^d&0}\right]}\)
該lattice的向量線性組合為
\(\matrix{\matrix{s\cr -s_0 \cr -s_1 \cr -s_2 \cr \vdots \cr -s_{d-1}\cr -s_d}&\left[\matrix{a_0&a_1X&a_2X^2&\ldots&a_{d-1}X^{d-1}&a_dX^d&\frac{1}{d+1} \cr N&0&0&0&0&0&0\cr
0&NX&0&0&0&0&0\cr
0&0&NX^2&0&0&0&0\cr
&&&\ddots&&&\cr
0&0&0&0&NX^{d-1}&0&0\cr
0&0&0&0&0&NX^d&0}\right]}\)
\(=\left[\matrix{sa_0&sa_1X&sa_2X^2&\ldots&sa_{d-1}X^{d-1}&sa_dX^d&\frac{s}{d+1}\cr
-s_0N&0&0&0&0&0&0\cr
0&-s_1NX&0&0&0&0&0\cr
0&0&-s_2NX^2&0&0&0&0\cr
0&0&0&\ddots&0&0&0\cr
0&0&0&0&-s_{d-1}NX^{d-1}&0&0\cr
0&0&0&0&0&-s_dNX^d&0}\right]\)
\(=[(sa_0-s_0N),(sa_1-s_1N)X,\ldots,(sa_{d-1}-s_{d-1}N)X^{d-1},(sa_d-s_dN)X^d,\frac{s}{d+1}]\)

將向量線性組合前\(d+1\)個分量除以\(X^i\)為係數的方程式
\(h(x)=(sa_0-s_0N)+(sa_1-s_1N)x+\ldots+(sa_{d-1}-s_{d-1}N)x^{d-1}+(sa_d-s_dN)x^d\)
 \(=s(a_0+a_1x+\ldots+a_{d-1}x^{d-1}+a_d x^d)-N(s_0+s_1x^1+\ldots+s_{d-1}x^{d-1}+s_dx^d)\)
 \(=sf(x)-N(s_0+s_1x^1+\ldots+s_{d-1}x^{d-1}+s_dx^d)\)
得到\(h(x)\equiv sf(x)\pmod{N}\)
若\(x=x_0\)是\(h(x)\equiv 0 \pmod{N}\)的解,那\(x=x_0\)也會是\(f(x)\equiv 0 \pmod{N}\)的解。
將\(f(x)\)各項係數取lattice如下
\(B=\left[\matrix{1&0&0&\ldots&0&0&a_0 \cr 0&X^{-1}&0&0&0&0&a_1\cr
0&0&X^{-2}&0&0&0&a_2\cr
0&0&0&X^{-3}&0&0&a_3\cr
&&&\ddots&&&\cr
0&0&0&0&X^{-(d-1)}&0&a_{d-1}\cr
0&0&0&0&0&X^{-d}&a_d\cr
0&0&0&0&0&0&N}\right] \matrix{常數項\cr 1次方\cr 2次方\cr 3次方\cr \vdots \cr d-1次方\cr d次方}\)
該lattice的向量線性組合為
\(\matrix{\matrix{1\cr x_0 \cr x_0^2 \cr x_0^3 \cr \vdots \cr x_0^{d-1}\cr x_0^d\cr -y_0}&\left[\matrix{1&0&0&\ldots&0&0&a_0 \cr 0&X^{-1}&0&0&0&0&a_1\cr
0&0&X^{-2}&0&0&0&a_2\cr
0&0&0&X^{-3}&0&0&a_3\cr
&&&\ddots&&&\cr
0&0&0&0&X^{-(d-1)}&0&a_{d-1}\cr
0&0&0&0&0&X^{-d}&a_d\cr
0&0&0&0&0&0&N}\right]}\)
\(=\left[\matrix{1&0&0&\ldots&0&0&a_0 \cr 0&x_0^1X^{-1}&0&0&0&0&a_1x_0^1\cr
0&0&x_0^2X^{-2}&0&0&0&a_2x_0^2\cr
0&0&0&x_0^3X^{-3}&0&0&a_3x_0^3\cr
&&&\ddots&&&\cr
0&0&0&0&x_0^{(d-1)}X^{-(d-1)}&0&a_{d-1}x_0^{(d-1)}\cr
0&0&0&0&0&x_0^{d}X^{-d}&a_dx_0^d\cr
0&0&0&0&0&0&-y_0N}\right]\)
\(\displaystyle =\left[1,\left(\frac{x_0}{X}\right),\left(\frac{x_0}{X}\right)^2,,\left(\frac{x_0}{X}\right)^3,\ldots,,\left(\frac{x_0}{X}\right)^{d-1},\left(\frac{x_0}{X}\right)^d,f(x_0)-y_0N\right]\)
若能找到\(x_0,y_0\)使得\(|\;x_0|\;<X\)、\(f(x_0)-y_0N\equiv 0\pmod{N}\)
此時向量長度\(\sqrt{1^2+\left(\frac{x_0}{X}\right)^2+\left(\frac{x_0}{X}\right)^4+\ldots+\left(\frac{x_0}{X}\right)^{2d}+0^2}<\sqrt{d+1}\)是短向量。

上面是Håstad和Coppersmith所用的lattice比較表,Håstad僅針對一個方程式\(h(x_0)=sf(x_0)\pmod{N}\)來產生lattice,而Coppersmith增加方程式個數,產生更大的lattice雖然增加LLL執行時間,但能提高解的上界。
\(f(x_0)-y_0N=0\)
\(x_0f(x_0)-x_0y_0N=0\)
\((f(x_0))^2-y_0^2N^2=0\)
\(x_0(f(x_0))^2-x_0y_0^2N^2=0\)

Coppersmith方法如下:









方法

範例

問題敘述

設同餘方程式為\(p(x)=x^k+a_{k-1}x^{k-1}+\ldots+a_1 x+a_0\equiv 0 \pmod{N}\)
且\(p(x)\)為monic(最高次方項係數為1)且不可分解。
利用LLL方法可以找出比邊界\(X\)還小的解\(x_0\)(\(\displaystyle |\;x_0|\;<X=\frac{1}{2}N^{\displaystyle \frac{1}{k}}\))
使得\(p(x_0)\equiv 0 \pmod{N}\)
設同餘方程式為\(p(x)=x^2+14x+19\equiv 0\pmod{35}\)
且\(p(x)\)為monic(最高次方項係數為1)且不可分解。
利用LLL方法可以找出比邊界\(X\)還小的解
使得\(p(x_0)\equiv 0 \pmod{35}\)

步驟1:計算參數\(h\)和\(X\)

步驟3需要\(hk\ge7\)、\(\displaystyle h-1\ge (hk-1)(\frac{1}{k}-\epsilon)\)和\(\displaystyle X=\frac{1}{2}N^{\frac{1}{k}}\)
\(hk\ge7\)化簡為\(\displaystyle h\ge \frac{7}{k}\)
\(\displaystyle h-1\ge (hk-1)(\frac{1}{k}-\epsilon)\)化簡為
\(\displaystyle h-1\ge h-\epsilon hk-\frac{1}{k}+\epsilon\)
\(\displaystyle \epsilon hk\ge \frac{k+\epsilon k-1}{k}\)
\(\displaystyle h\ge \frac{k+\epsilon k-1}{\epsilon k^2}\)
兩個條件合併一起
\(\displaystyle h\ge max\left(\frac{7}{k},\frac{k+\epsilon k-1}{\epsilon k^2}\right)\)
\(p(x)\)最高次方為2次方\((k=2)\)
設\(\epsilon=0.1\)
\(\displaystyle h\ge max\left(\frac{7}{2},\frac{2+0.1\cdot 2-1}{0.1\cdot 2^2}\right)=max(3.5,3)\)
\(h\ge 4\)但本範例取\(h=3\)就能得到答案
\(\displaystyle X=\frac{1}{2}35^{1/2}=2.958\),取\(X=2\)

步驟2:產生矩陣\(M\)

矩陣\(M\)是大小\((2hk-k)\times(2hk-k)\)的上三角矩陣
\(M=\left[\matrix{D&A\cr0_{hk}&D'}\right]\)
左上角矩陣\(D=(d(i,j))\)是大小\(hk\times hk\)的對角矩陣,
對角線元素為\(d_{i,i}=\delta X^{1-i}\),\(\displaystyle \delta=\frac{1}{\sqrt{hk}}\)
右上角矩陣\(A=(a_{i,j})\)是大小\((hk\times (h-1)k)\)矩陣,
矩陣元素\(a_{i,j}\)是\(x^u(p(x))^v\)的\(x^i\)項係數
其中\(\displaystyle v=\lfloor\;\frac{k+j-1}{k}\rfloor\;\)和\(u=(j-1)-k(v-1)\)
左下角\(0_{hk}\)為零矩陣
右下角矩陣\(D'=(d_{i,j}')\)是大小\(((h-1)k\times (h-1)k)\)的對角矩陣,
對角線元素為\(d_{i,i}'=N^v\)

\(M\)為上三角矩陣,行列式值為對角線元素相乘
\(\displaystyle det(M)=\prod_{g=0}^{hk-1}\delta X^{-g}\prod_{\gamma(i,j)=hk}^{2hk-k}N^j\)
  \(\displaystyle =\delta^{hk} X^{-{\frac{hk(hk-1)}{2}}}N^{\frac{hk(h-1)}{2}}\)
  \(\displaystyle =(N^{h-1}X^{-(hk-1)}(hk)^{-1})^{\frac{hk}{2}}\)
-------------------
\(p(x)=x^2+ax+b\equiv 0\pmod{N}\)
\(xp(x)=x^3+ax^2+bx\equiv 0\pmod{N}\)
\((p(x))^2=x^4+cx^3+dx^2+ex+f\equiv 0\pmod{N^2}\)
\(x(p(x))^2=x^5+cx^4+dx^3+ex^2+fx\equiv 0\pmod{N^2}\)
\(M=\left[\matrix{\matrix{\delta&&&&&\cr&\delta X^{-1}&&&&\cr&&\delta X^{-2}&&&\cr&&&\delta X^{-3}&&\cr&&&&\delta X^{-4}&\cr&&&&&\delta X^{-5}}&\matrix{│\cr │\cr │\cr │}&
\matrix{
b&0&f&0\cr
a&b&e&f\cr
1&a&d&e\cr
&1&c&d\cr
&&1&c\cr
&&&1}\cr ―――――――――&┼&――――――― \cr
\matrix{0}&\matrix{│\cr │\cr │}&\matrix{N&&&\cr &N&&\cr &&N^2&\cr &&&N^2}}\right]\)
設\(r\)向量左手邊為\(r_g=x_0^g\),右手邊為\(x_0\)和\(y_0\)的非負次方\(r_{\gamma(i,j)}=-x_0^iy_0^j\)
\(r=[1,x_0,x_0^2,x_0^3,x_0^4,x_0^5,-y_0,-x_0y_0,-y_0^2,-x_0y_0^2]\)
計算向量線性組合\(s=rM\)
\(\displaystyle s=[1,\delta\frac{x_0}{X},\delta\left(\frac{x_0}{X}\right)^2,\delta\left(\frac{x_0}{X}\right)^3,\delta\left(\frac{x_0}{X}\right)^4,\delta\left(\frac{x_0}{X}\right)^5,\)
\(-p(x_0)-y_0N,x_0p(x_0)-x_0y_0N,(p(x_0))^2-y_0^2N^2,x_0(p(x_0))^2-x_0y_0^2N^2]\)
存在\(|\;x_0|\;<X\)和\(y_0\)使得\(p(x_0)-y_0N=0\)
\(\displaystyle s=\left[1,\delta\frac{x_0}{X},\delta\left(\frac{x_0}{X}\right)^2,\delta\left(\frac{x_0}{X}\right)^3,\delta\left(\frac{x_0}{X}\right)^4,\delta\left(\frac{x_0}{X}\right)^5,0,0,0,0\right]\)
計算向量\(s\)長度比1短
\(\displaystyle \Vert\;s\Vert\;=\sqrt{\sum_{k=0}^{hk-1}\left(\delta \left( \frac{x_0}{X}\right)^{k}\right)^2}<\sqrt{\sum_{k=0}^{hk-1}(\delta \cdot 1)^2}=\sqrt{\delta^2\cdot hk}=1\)
\(p(x)=x^2+14x+19\equiv 0\pmod{35}\)
\(xp(x)=x^3+14x^2+19x\equiv 0\pmod{35}\)
\(p(x)^2=x^4+28x^3+234x^2+532x+361\equiv 0\pmod{35^2}\)
\(xp(x)^2=x^5+28x^4+234x^3+532x^2+361x\equiv 0\pmod{35^2}\)
原本\(\displaystyle \delta=\frac{1}{\sqrt{hk}}=\frac{1}{\sqrt{6}}\),但本範例忽略\(\delta\)也能算出答案
\(M=\left[\matrix{\matrix{1&&&&&\cr&2^{-1}&&&&\cr&&2^{-2}&&&\cr&&&2^{-3}&&\cr&&&&2^{-4}&\cr&&&&&2^{-5}}&\matrix{│\cr │\cr │\cr │}&
\matrix{
19&0&361&0\cr
14&19&532&361\cr
1&14&234&532\cr
&1&28&234\cr
&&1&28\cr
&&&1}\cr ―――――――――&┼&――――――― \cr
\matrix{0}&\matrix{│\cr │\cr │}&\matrix{35&&&\cr &35&&\cr &&1225&\cr &&&1225}}\right]\)

\(det(M)=1\cdot 2^{-1}\ldots 2^{-5}\cdot 35 \cdot 35 \cdot 1225 \cdot 1225\)
  \(=2^{-15}35^6\)

步驟3:矩陣\(M\)基本列運算得到\(\widehat{M}\)

因為\(p(x)\)為monic(最高次方項係數為1),在矩陣\(A\)的對角線元素為1,進行基本列運算將右上角化簡為零,右下角化簡為零,再將對角線元素為1的一整列移到整個矩陣下方。
\(\widetilde{M}=\left[\matrix{\widehat{M}&│&0_{(hk\times (h-1)k)}\cr ―&┼&――――――\cr A'&│&I_{(h-1)k}}\right]\)
得到左上角矩陣\(\widehat{M}\)
-------------------
\(|\;det(M)|\;=|\;det(\widetilde{M})|\;=|\;det(\widehat{M})det(I)|\;=|\;det(\widehat{M})|\;\)
得到\(\displaystyle det(M)=(N^{h-1}X^{-(hk-1)}(hk)^{-1})^{\frac{hk}{2}}=det(\widehat{M})\)
設\(hk\ge 7\),可推得\(\displaystyle hk<2^{\frac{hk-1}{2}}\),\((hk)^{-1}>2^{-\frac{(hk-1)}{2}}\)
\(\displaystyle det(\widehat{M})>(N^{h-1}X^{-(hk-1)}2^{-\frac{(hk-1)}{2}})^{\frac{hk}{2}}\)
設\(\displaystyle X=\frac{1}{2}N^{\frac{1}{k}-\epsilon}\),可推得\(\displaystyle X^{-1}=2N^{-(\frac{1}{k}-\epsilon)}\),\(\displaystyle X^{-(hk-1)}=2^{hk-1}N^{-(hk-1)(\frac{1}{k}-\epsilon)}\)
\(\displaystyle det(\widehat{M})>(N^{n-1-(hk-1)(\frac{1}{k}-\epsilon)}\cdot 2^{+\frac{(hk-1)}{2}})^{\frac{hk}{2}}\)
設\(\displaystyle n-1\ge (hk-1)(\frac{1}{k}-\epsilon)\)
\(\displaystyle det(\widehat{M})>(N^0\cdot 2^{+\frac{(hk-1)}{2}})2^{\frac{hk}{2}}=2^{\frac{(hk)(hk-1)}{4}}\)
設\(n=hk=dim(\widehat{M})\)
\(\displaystyle det(\widehat{M})>2^{\frac{n(n-1)}{4}}\)
\(\displaystyle det(\widehat{M})^{\frac{1}{n}}>2^{\frac{n-1}{4}}\)
\(\displaystyle det(\widehat{M})^{\frac{1}{n}}\cdot 2^{-\frac{n-1}{4}}>1\)
由步驟2結論可知向量\(s\)長度小於1(\(1>\Vert\;s\Vert\;\))
得到\(\displaystyle det(\widehat(M))^{\frac{1}{n}}\cdot 2^{-\frac{n-1}{4}}>\Vert\;s\Vert\;\)
將右上角化簡為零
\(\widetilde{M}=\left[\matrix{\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr
&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr
&&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}\cr
&&&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}\cr
&&&&\frac{1}{16}&-\frac{7}{8}\cr
&&&&&\frac{1}{32}}&\matrix{│\cr│\cr│\cr│\cr│\cr│}&\matrix{\displaystyle 0&0&0&0\cr 0&0&0&0\cr 1&0&0&0\cr &1&0&0\cr &&1&0\cr &&&1}\cr
――――――――――――――&┼&―――――――――\cr
\matrix{0}&\matrix{│\cr│\cr│\cr│}&\matrix{35&&&\cr&35&&\cr&&1225&\cr&&&1225}}\right]\)
將右下角化簡為零
\(\widetilde{M}=\left[\matrix{\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr
&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr
&&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}\cr
&&&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}\cr
&&&&\frac{1}{16}&-\frac{7}{8}\cr
&&&&&\frac{1}{32}}&\matrix{│\cr│\cr│\cr│\cr│\cr│}&\matrix{\displaystyle 0&0&0&0\cr 0&0&0&0\cr 1&0&0&0\cr &1&0&0\cr &&1&0\cr &&&1}\cr
――――――――――――――&┼&―――\cr
\matrix{\displaystyle &&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&-\frac{3675}{2}\cr
&&&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr
&&&&-\frac{1225}{16}&-\frac{8575}{8}\cr
&&&&&-\frac{1225}{32}}&\matrix{│\cr│\cr│\cr│}&\matrix{0&&&\cr&0&&\cr&&0&\cr&&&0}}\right]\)
將對角線元素為1的一整列移到整個矩陣下方
\(\widetilde{M}=\left[\matrix{\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr
&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr
&&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&-\frac{3675}{2}\cr
&&&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr
&&&&-\frac{1225}{16}&-\frac{8575}{8}\cr
&&&&&-\frac{1225}{32}}&\matrix{│\cr│\cr│\cr│\cr│\cr│}&\matrix{\displaystyle 0&0&0&0\cr 0&0&0&0\cr 0&0&0&0\cr &0&0&0\cr &&0&0\cr &&&0}\cr
――――――――――――――&┼&―――\cr
\matrix{\displaystyle   & &\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}\cr
&&&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}\cr
&&&&\frac{1}{16}&-\frac{7}{8}\cr
&&&&&\frac{1}{32}\cr}&\matrix{│\cr│\cr│\cr│}&\matrix{1&&&\cr&1&&\cr&&1&\cr&&&1}}\right]\)
得到左上角矩陣\(\widehat{M}\)
\(\widehat{M}=\left[\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr
&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr
&&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&-\frac{3675}{2}\cr
&&&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr
&&&&-\frac{1225}{16}&-\frac{8575}{8}\cr
&&&&&-\frac{1225}{32}}\right]\)
\(\displaystyle det(\widehat{M})=1\cdot \frac{1}{2}\cdot \frac{-35}{4}\cdot \frac{-35}{8}\cdot \frac{-1225}{16}\cdot \frac{-1225}{35}\)
  \(\displaystyle =2^{-15}35^6\)
\(\widehat{M}\)乘32倍變成整數
\(\widehat{M}=\left[\matrix{
32&0&-152&1064&-6726&42028\cr
&16&-112&708&-4424&27605\cr
&&-280&1960&-11060&58800\cr
&&&-140&1960&-19250\cr
&0&&&-2450&34300\cr
&&&&&-1225}\right]\)

步驟4:經LLL化簡和Gram-Schmidt正交化後得到不需要同餘\(N\)的方程式

矩陣\(\widehat{M}\)經LLL化簡為\(B\)
\(B=LLL(\widehat{M})\)
矩陣\(B\)經Gram-Schmidt正交化得到\(B^{*}\)
\(B^{*}=\)Gram-Schmidt\((B)\)
-------------------
引理1:
假設lattice \(L\)經LLL化簡後向量為\(b_1,b_2,\ldots,b_n\),經Gram-Schmidt化簡後向量為\(b_1^{*},b_2^{*},\ldots,b_n^{*}\),則\(\displaystyle \Vert\;b_n^{*}\Vert\;\ge det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}\)。
[證明]
\(\displaystyle det(L)^2=\prod_{i=1}^n \Vert\;b_i^{*}\Vert\;^2=\Vert\;b_1^{*}\Vert\;^2 \Vert\;b_2^{*}\Vert\;^2\cdot \Vert\;b_n^{*}\Vert\;^2\)
經LLL化簡後向量長度滿足\(\Vert\;b_i^{*}\Vert\;^2\le 2\Vert\;b_{i+1}^{*}\Vert\;^2\) \((i=1,2,\ldots,n-1)\)
\(\displaystyle det(L)^2 \le \left(2^{n-1}\Vert\;b_n^{*}\Vert\;^2\right)\left(2^{n-2}\Vert\;b_n^{*}\Vert\;^2\right)\ldots \left(\Vert\;b_n^{*}\Vert\;^2\right)\left(\Vert\;b_n^{*}\Vert\;^2\right)\)
\(\displaystyle det(L)^2 \le 2^{\frac{n(n-1)}{2}}\Vert\;b_n^{*}\Vert\;^{2n}\)
\(\displaystyle \Vert\;b_n^{*}\Vert\;^{2n}\ge det(L)^2 2^{-\frac{n(n-1)}{2}}\)
兩邊各加上\(\displaystyle \frac{1}{2n}\)次方\(\Vert\;b_n^{*}\Vert\;\ge det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}\)

引理2:
假設lattice \(L\)其中一個元素\(s\)滿足\(\displaystyle det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}>\Vert\;s\Vert\;\),則\(s\)會落在由\(b_1,b_2,\ldots,b_{n-1}\)所展開的超平面上。
[證明]
將lattice 元素\(s\)表示成\(b_1,b_2,\ldots,b_n\)的線性組合\(\displaystyle s=\sum_{i=1}^n a_ib_i\),其中\(a_i\)是整數
向量長度\(\Vert\;s\Vert\;=\Vert\;a_1b_1+a_2b_2+\ldots+a_nb_n\Vert\;\ge \Vert\;a_nb_n\Vert\;=|\;a_n|\;\Vert\;b_n\Vert\;\ge |\;a_n|\;\Vert\;b_n^{*}\Vert\;\)
由引理1可知\(\Vert\;b_n^{*}\Vert\;\ge det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}\)、\(\displaystyle det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}>\Vert\;s\Vert\;\)和
\(\Vert\;s\Vert\;\ge |\;a_n|\;\Vert\;b_n^{*}\Vert\;\),得到\(\Vert\;b_n^{*}\Vert\;>|\;a_n|\;\Vert\;b_n^{*}\Vert\;\),\(a_n=0\)
\(s\)可表示成\(b_1,b_2,\ldots,b_{n-1}\)的線性組合,\(s\)落在由\(b_1,b_2,\ldots,b_{n-1}\)所展開的超平面上。
-------------------
\(\displaystyle s=\left[1,\delta \frac{x_0}{X},\ldots,\delta\left(\frac{x_0}{X}\right)^{hk-1}\right]\)是lattice\(\widehat{M}\)的向量元素,
由步驟3結論可知\(\displaystyle det(\widehat{M})^{\frac{1}{n}}2^{-\frac{n-1}{4}}>\Vert\;s\Vert\;\)
由上面引理2可知\(s\)落在由\(b_1,b_2,\ldots,b_{n-1}\)所展開的超平面上。
而這個超平面會和Gram-Schmidt的向量\(b_n^{*}\)正交,得到\(s\cdot b_n^{*}=0\),可得到一個不需要同餘\(N\)的方程式。

LLL化簡
\(B=\left[\matrix{0&160&0&-60&0&-100\cr
-64&-64&-88&80&-72&-51\cr
64&-48&32&4&-180&16\cr
128&-80&-48&16&116&-13\cr
-32&-96&-16&-132&90&-108\cr
-64&-32&248&96&-30&-141}\right]\)
Gram-Schmidt正交化
\(B^{*}=\left[\matrix{\displaystyle 0&160&0&-60&0&-100\cr
-64&-\frac{164}{7}&-88&\frac{907}{14}&-72&-\frac{1069}{14}\cr
\frac{4327744}{55201}&-\frac{213712}{55201}&\frac{2859392}{55201}&-\frac{1388192}{55201}&-\frac{9041940}{55201}&\frac{490976}{55201}\cr
\frac{2396089600}{17933807}&-\frac{673016640}{17933807}&-\frac{1044380280}{17933807}&\frac{154688960}{17933807}&\frac{745216000}{17933807}&-\frac{1169640000}{17933807}\cr
-\frac{2184694400}{45963969}&-\frac{1521655800}{15321323}&\frac{344724800}{15321323}&-\frac{6338718400}{45963969}&\frac{172362400}{45963969}&-\frac{1166905600}{15321323}\cr
-\frac{117600}{17929}&-\frac{627200}{17929}&\frac{3763200}{17929}&\frac{2508800}{17929}&\frac{627200}{17929}&-\frac{2508800}{17929}}\right]\)
取最後一列向量乘上\(\displaystyle \frac{17929}{39200}\)變成整數
\([−3, −16, 96, 64, 16, −64]\)
形成不需要再同餘\(N\)的方程式
\(\displaystyle h(x)=-3-16\left(\frac{x}{2}\right)+96\left(\frac{x}{2}\right)^2+64\left(\frac{x}{2}\right)^3+16\left(\frac{x}{2}\right)^4-64\left(\frac{x}{2}\right)^5\)
 \(=-3-8x+24x^2+8x^3+x^4-2x^5\)
 \(=-(x-3)(2x-1)(x^3+3x^2+5x+1)\)
解方程式得到答案
\(x=3\)


參考資料:
D. Coppersmith. Finding a small root of a univariate modular equation. In Proceedings of Eurocrypt 1996, volume 1070 of Lecture Notes in Computer Science, pages 155–165. Springer, 1996.
https://link.springer.com/chapter/10.1007/3-540-68339-9_14
N. Howgrave-Graham. Finding small roots of univariate modular equations revisited. In Cryptography and Coding– Proc. IMA ’97, volume 1355 of Lecture Notes in Computer Science, pages 131–142. Springer, 1997.
https://link.springer.com/chapter/10.1007/BFb0024458
有二次同餘方程式範例
Finding Small Roots of Polynomial Equations Using Lattice Basis Reduction
https://ntnuopen.ntnu.no/ntnu-xm ... e=1&isAllowed=y
有三次同餘方程式範例
Lattice Basis Reduction:An Introduction to the LLL Algorithm and Its Applications
https://www.routledge.com/Lattic ... /book/9781439807026
有一整章關於Coppersmith方法的介紹



請下載LLL.zip,解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下
要先載入LLL.mac才能使用LLL指令

(%i1) load("LLL.mac");
(%o1) C:/maxima-5.43.2/share/maxima/5.43.2/share/LLL.mac

要先載入eigen.mac才能使用gramschmidt指令
(%i2) load("eigen.mac");
(%o2) C:/maxima-5.43.2/share/maxima/5.43.2/share/matrix/eigen.mac

要先載入diag.mac才能使用diag指令
(%i3) load("diag.mac");
(%o3) C:/maxima-5.43.2/share/maxima/5.43.2/share/contrib/diag.mac

同餘方程式\(p(x)\)
(%i4) px:x^2+14*x+19;
(px) \(x^2+14x+19\)

\(p(x)\equiv 0\pmod{N}\)
(%i5) N:35;
(N) \(35\)

\(p(x)\)的次數\(k\)
(%i6) k:hipow(px,x);
(k) \(2\)

設誤差值\(\epsilon=0.1\)
(%i7) epsilon:0.1;
(epsilon) \(0.1\)

參數\(h\),按照公式應該是\(h=4\),但\(h=3\)也能算出來
(%i9)
h:ceiling(max(7/k,(k+epsilon*k-1)/(epsilon*k^2)));
h:3;

(h) 4
(h) 3

\(\widehat{M}\)的維度\(n=hk\)
(%i10) n:h*k;
(n) 6

參數\(\delta\),按照公式應該是\(\displaystyle \delta=\frac{1}{\sqrt{6}}\),改成\(\delta=1\)方便計算
(%i12)
delta:1/sqrt(h*k);
delta:1;

(delta) \(\displaystyle \frac{1}{\sqrt{6}}\)
(delta) 1

希望能找到\(|\;x|\;<X=\frac{1}{2}N^{1/k}\),\(p(x)\equiv 0\pmod{N}\)
(%i13) X:floor(1/2*N^(1/k));
(X) 2

左上角矩陣對角線元素\(\delta X^{-i}\)
(%i14) Xpower:create_list(delta*X^-(i-1),i,1,h*k);
(Xpower) \(\displaystyle \left[1,\frac{1}{2},\frac{1}{4},\frac{1}{8},\frac{1}{16},\frac{1}{32}\right]\)

左上角矩陣
(%i15) D1:diag(Xpower);
(D1) \(\left[\matrix{\displaystyle 1&0&0&0&0&0\cr
0&\frac{1}{2}&0&0&0&0\cr
0&0&\frac{1}{4}&0&0&0\cr
0&0&0&\frac{1}{8}&0&0\cr
0&0&0&0&\frac{1}{16}&0\cr
0&0&0&0&0&\frac{1}{32}}\right]\)

多項式\(x^u\cdot p(x)^v\)
(%i16) xpxpower:create_list(x^u*px^v,v,1,h-1,u,0,k-1);
(xpxpower) \([x^2+14x+19,x(x^2+14x+19),(x^2+14x+19)^2,x(x^2+14x+19)^2]\)

\(x^1,x^2,\ldots,x^{n-1}\)
(%i17) xpower:create_list(x^i,i,1,n-1);
(xpower) \([x,x^2,x^3,x^4,x^5]\)

取多項式\(x^u\cdot p(x)^v\)係數,形成右上角矩陣(常數項在最後一行)
(%i18) A:augcoefmatrix(xpxpower,xpower);
(A) \(\left[\matrix{14&1&0&0&0&19\cr
19&14&1&0&0&0\cr
532&234&28&1&0&361\cr
361&532&234&28&1&0}\right]\)

將常數項移到第一行
(%i19) A:addcol(col(A,h*k),submatrix(A,h*k));
(A) \(\left[ \matrix{
19&14&1&0&0&0\cr
0&19&14&1&0&0\cr
361&532&234&28&1&0\cr
0&361&532&234&28&1}\right]\)

矩陣\(A\)轉置
(%i20) A:transpose(A);
(A) \(\left[ \matrix{
19&0&361&0\cr
14&19&532&361\cr
1&14&234&532\cr
0&1&28&234\cr
0&0&1&28\cr
0&0&0&1}\right]\)

左下角0矩陣
(%i21) Zero:zeromatrix((h-1)*k,h*k);
(Zero) \(\left[ \matrix{
0&0&0&0&0&0\cr
0&0&0&0&0&0\cr
0&0&0&0&0&0\cr
0&0&0&0&0&0}\right]\)

右下角矩陣元素\(N^v\)
(%i22) Npower:create_list(N^v,v,1,h-1,u,0,k-1);
(Npower) \([35,35,1225,1225]\)

右下角矩陣
(%i23) D2:diag(Npower);
(D2) \(\left[ \matrix{
35&0&0&0\cr
0&35&0&0\cr
0&0&1225&0\cr
0&0&0&1225}\right]\)

4個子矩陣合併成矩陣\(M\)
(%i24) M:addrow(addcol(D1,A),addcol(Zero,D2));
(M) \(\left[ \matrix{\displaystyle
1&0&0&0&0&0&19&0&361&0\cr
0&\frac{1}{2}&0&0&0&0&14&19&532&361\cr
0&0&\frac{1}{4}&0&0&0&1&14&234&532\cr
0&0&0&\frac{1}{8}&0&0&0&1&28&234\cr
0&0&0&0&\frac{1}{16}&0&0&0&1&28\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1\cr
0&0&0&0&0&0&35&0&0&0\cr
0&0&0&0&0&0&0&35&0&0\cr
0&0&0&0&0&0&0&0&1225&0\cr
0&0&0&0&0&0&0&0&0&1225}\right]\)

將矩陣\(M\)複製成另一個矩陣\(\widetilde{M}\),進行矩陣列運算
(%i25) M_tilde:copymatrix(M)$

將右上角化簡為零
(%i27)
for i:k+1 thru n do
  (for j:1 thru i-1 do
     (print("第",j,"列=第",j,"列-",M_tilde[j,i+n-k],"*第",i,"列=",
               M_tilde[j]:M_tilde[j]-M_tilde[j,i+n-k]*M_tilde[ i ])
     )
  )$
M_tilde;

第1列=第1列-19*第3列\(\displaystyle =[1,0,-\frac{19}{4},0,0,0,0,-266,-4085,-10108]\)
第2列=第2列-14*第3列\(\displaystyle =[0,\frac{1}{2},-\frac{7}{2},0,0,0,0,-177,-2744,-7087]\)
第1列=第1列--266*第4列\(\displaystyle =[1,0,-\frac{19}{4},\frac{133}{4},0,0,0,0,3363,52136]\)
第2列=第2列--177*第4列\(\displaystyle =[0,\frac{1}{2},-\frac{7}{2},\frac{177}{8},0,0,0,0,2212,34331]\)
第3列=第3列-14*第4列\(\displaystyle =[0,0,\frac{1}{4},-\frac{7}{4},0,0,1,0,-158,-2744]\)
第1列=第1列-3363*第5列\(\displaystyle =[1,0,-\frac{19}{4},\frac{133}{4},-\frac{3363}{16},0,0,0,0,-42028]\)
第2列=第2列-2212*第5列\(\displaystyle =[0,\frac{1}{2},-\frac{7}{2},\frac{177}{8},-\frac{553}{4},0,0,0,0,-27605]\)
第3列=第3列--158*第5列\(\displaystyle =[0,0,\frac{1}{4},-\frac{7}{4},\frac{79}{8},0,1,0,0,1680]\)
第4列=第4列-28*第5列\(\displaystyle =[0,0,0,\frac{1}{8},-\frac{7}{4},0,0,1,0,-550]\)
第1列=第1列--42028*第6列\(\displaystyle =[1,0,-\frac{19}{4},\frac{133}{4},-\frac{3363}{16},\frac{10507}{8},0,0,0,0]\)
第2列=第2列--27605*第6列\(\displaystyle =[0,\frac{1}{2},-\frac{7}{2},\frac{177}{8},-\frac{553}{4},\frac{27605}{32},0,0,0,0]\)
第3列=第3列-1680*第6列\(\displaystyle =[0,0,\frac{1}{4},-\frac{7}{4},\frac{79}{8},-\frac{105}{2},1,0,0,0]\)
第4列=第4列--550*第6列\(\displaystyle =[0,0,0,\frac{1}{8},-\frac{7}{4},\frac{275}{16},0,1,0,0]\)
第5列=第5列-28*第6列\(\displaystyle =[0,0,0,0,\frac{1}{16},-\frac{7}{8},0,0,1,0]\)
(%o27) \(\left[ \matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}&0&0&0&0\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}&0&0&0&0\cr
0&0&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}&1&0&0&0\cr
0&0&0&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}&0&1&0&0\cr
0&0&0&0&\frac{1}{16}&-\frac{7}{8}&0&0&1&0\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1\cr
0&0&0&0&0&0&35&0&0&0\cr
0&0&0&0&0&0&0&35&0&0\cr
0&0&0&0&0&0&0&0&1225&0\cr
0&0&0&0&0&0&0&0&0&1225}\right]\)

將右下角化簡為零
(%i29)
for i:k+1 thru n do
  (j:i+n-k,
   print("第",j,"列=第",j,"列-",M_tilde[j,j],"*第",i,"列=",
    M_tilde[j]:M_tilde[j]-M_tilde[j,j]*M_tilde[ i ])
  )$
M_tilde;

第7列=第7列-35*第3列\(\displaystyle =[0,0,-\frac{35}{4},\frac{245}{4},-\frac{2765}{8},\frac{3675}{2},0,0,0,0]\)
第8列=第8列-35*第4列\(\displaystyle =[0,0,0,-\frac{35}{8},\frac{245}{4},-\frac{9625}{16},0,0,0,0]\)
第9列=第9列-1225*第5列\(\displaystyle =[0,0,0,0,-\frac{1225}{16},\frac{8575}{8},0,0,0,0]\)
第10列=第10列-1225*第6列\(\displaystyle =[0,0,0,0,0,-\frac{1225}{32},0,0,0,0]\)
(%o29) \(\left[ \matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}&0&0&0&0\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}&0&0&0&0\cr
0&0&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}&1&0&0&0\cr
0&0&0&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}&0&1&0&0\cr
0&0&0&0&\frac{1}{16}&-\frac{7}{8}&0&0&1&0\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1\cr
0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}&0&0&0&0\cr
0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}&0&0&0&0\cr
0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}&0&0&0&0\cr
0&0&0&0&0&-\frac{1225}{32}&0&0&0&0}\right]\)

將對角線元素為1的一整列移到整個矩陣下方
(%i31)
for i:k+1 thru n do
  (j:i+n-k,
   print("第",i,"列和第",j,"列交換"),
   [M_tilde[j],M_tilde[ i ]]:[M_tilde[ i ],M_tilde[j]]
  )$
M_tilde;

第3列和第7列交換
第4列和第8列交換
第5列和第9列交換
第6列和第10列交換
(%o31) \(\left[ \matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}&0&0&0&0\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}&0&0&0&0\cr
0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}&0&0&0&0\cr
0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}&0&0&0&0\cr
0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}&0&0&0&0\cr
0&0&0&0&0&-\frac{1225}{32}&0&0&0&0\cr
0&0&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}&1&0&0&0\cr
0&0&0&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}&0&1&0&0\cr
0&0&0&0&\frac{1}{16}&-\frac{7}{8}&0&0&1&0\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1}\right]\)

得到左上角矩陣\(\widehat{M}\)
(%i32) M_hat:genmatrix(lambda([i,j],M_tilde[i,j]),n,n);
(M_hat) \(\left[ \matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr
0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}\cr
0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr
0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}\cr
0&0&0&0&0&-\frac{1225}{32}}\right]\)

\(\widehat{M}\)乘32倍變成整數
(%i33) M_hat:M_hat*1/delta*X^(n-1);
(M_hat) \(\left[ \matrix{
32&0&-152&1064&-6726&42028\cr
0&16&-112&708&-4424&27605\cr
0&0&-280&1960&-11060&58800\cr
0&0&0&-140&1960&-19250\cr
0&0&0&0&-2450&34300\cr
0&0&0&0&0&-1225}\right]\)

LLL化簡
(%i34) B: LLL(M_hat);
(B) \(\left[ \matrix{
0&160&0&-60&0&-100\cr
-64&-64&-88&80&-72&-51\cr
64&-48&32&4&-180&16\cr
128&-80&-48&16&116&-13\cr
-32&-96&-16&-132&90&-108\cr
-64&-32&248&96&-30&-141}\right]\)

Gram-Schmidt正交化
(%i35) Bstar:apply(matrix,expand(gramschmidt(B)));
(Bstar) \(\left[ \matrix{\displaystyle
0&160&0&-60&0&-100\cr
-64&-\frac{164}{7}&-88&\frac{907}{14}&-72&-\frac{1069}{14}\cr
\frac{4327744}{55201}&-\frac{213712}{55201}&\frac{2859392}{55201}&-\frac{1388192}{55201}&-\frac{9041940}{55201}&\frac{490976}{55201}\cr
\frac{2396089600}{17933807}&-\frac{673016640}{17933807}&-\frac{1044380280}{17933807}&\frac{154688960}{17933807}&\frac{745216000}{17933807}&-\frac{1169640000}{17933807}\cr
-\frac{2184694400}{45963969}&-\frac{1521655800}{15321323}&\frac{344724800}{15321323}&-\frac{6338718400}{45963969}&\frac{172362400}{45963969}&-\frac{1166905600}{15321323}\cr
-\frac{117600}{17929}&-\frac{627200}{17929}&\frac{3763200}{17929}&\frac{2508800}{17929}&\frac{627200}{17929}&-\frac{2508800}{17929}}\right]\)

取最後一個正交向量
(%i36) Bstar_n:Bstar[n];
(Bstar_n) \(\displaystyle \left[-\frac{117600}{17929},-\frac{627200}{17929},\frac{3763200}{17929},\frac{2508800}{17929},\frac{627200}{17929},-\frac{2508800}{17929}\right]\)

取各分數的分母
(%i37) Denom:map('denom,Bstar_n);
(Denom) \([17929,17929,17929,17929,17929,17929]\)

求最大的分母
(%i38) MaxDenom:lmax(%);
(MaxDenom) 17929

正交向量化為整數
(%i39) Bstar_n:Bstar_n*MaxDenom;
(Bstar_n) \([-117600,-627200,3763200,2508800,627200,-2508800]\)

計算最大公因數
(%i40) GCD:lreduce('gcd,Bstar_n);
(GCD) 39200

同除最大公因數,得到化簡的正交向量
(%i41) Bstar_n:Bstar_n/GCD;
(Bstar_n) \([-3,-16,96,64,16,-64]\)

正交向量和\(\displaystyle \left(\frac{x}{X}\right)^i\)相乘
(%i42) hx:sum(Bstar_n[i+1]*(x/X)^i,i,0,n-1);
(hx) \(-2x^5+x^4+8x^3+24x^2-8x-3\)

將\(h(x)\)因式分解
(%i43) factor(hx);
(%o43) \(-(x-3)(2x-1)(x^3+3x^2+5x+1)\)

得到\(h(x)\)的解
(%i44) x:3;
(x) 3

驗證答案
(%i45) ev(mod(px,N),x=3);
(%o45) 0
作者: bugmens    時間: 2021-6-7 19:44

解三次同餘方程式\(p(x)=x^3-4x^2-3x-10\pmod{1131}\)。

參考資料
Finding Small Roots of Polynomial Equations Using Lattice Basis Reduction
https://ntnuopen.ntnu.no/ntnu-xm ... e=1&isAllowed=y



請下載LLL.zip,解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下
要先載入LLL.mac才能使用LLL指令

(%i1) load("LLL.mac");
(%o1) C:/maxima-5.43.2/share/maxima/5.43.2/share/LLL.mac

要先載入eigen.mac才能使用gramschmidt指令
(%i2) load("eigen.mac");
(%o2) C:/maxima-5.43.2/share/maxima/5.43.2/share/matrix/eigen.mac

要先載入diag.mac才能使用diag指令
(%i3) load("diag.mac");
(%o3) C:/maxima-5.43.2/share/maxima/5.43.2/share/contrib/diag.mac

同餘方程式\(p(x)\)
(%i4) px:x^3-4*x^2-3*x-10;
(px) \(x^3-4x^2-3x-10\)

\(p(x)\equiv 0\pmod{N}\)
(%i5) N:1131;
(N) 1131

\(p(x)\)的次數\(k\)
(%i6) k:hipow(px,x);
(k) 3

設誤差值\(epsilon=0.1\)
(%i7) epsilon:0.1;
(epsilon) 0.1

參數h
(%i8) h:ceiling(max(7/k,(k+epsilon*k-1)/(epsilon*k^2)));
(h) 3

\(\widehat{M}\)的維度\(n=hk\)
(%i9) n:h*k;
(n) 9

參數\(\delta\),按照公式應該是\(\displaystyle \delta=\frac{1}{3}\),本範例\(\displaystyle \delta=\frac{1}{9}\)
(%i11)
delta:1/sqrt(h*k);
delta:1/9;

(delta) \(\displaystyle \frac{1}{3}\)
(delta) \(\displaystyle \frac{1}{9}\)

希望能找到\(|\;x|\;<X=\frac{1}{2}N^{1/k}\),\(p(x)\equiv 0\pmod{N}\)
按照公式應該是5,本範例\(X=6\)

(%i13)
X:floor(1/2*N^(1/k));
X:6;

(X) 5
(X) 6


(%i14) Xpower:create_list(delta*X^-(i-1),i,1,h*k);
(Xpower) \(\displaystyle \left[\frac{1}{9},\frac{1}{54},\frac{1}{324},\frac{1}{1944},\frac{1}{11664},\frac{1}{69984},\frac{1}{419904},\frac{1}{2519424},\frac{1}{15116544}\right]\)

左上角矩陣
(%i15) D1:diag(Xpower);
(D1) \(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&0&0&0&0&0&0\cr
0&\frac{1}{54}&0&0&0&0&0&0&0\cr
0&0&\frac{1}{324}&0&0&0&0&0&0\cr
0&0&0&\frac{1}{1944}&0&0&0&0&0\cr
0&0&0&0&\frac{1}{11664}&0&0&0&0\cr
0&0&0&0&0&\frac{1}{69984}&0&0&0\cr
0&0&0&0&0&0&\frac{1}{419904}&0&0\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&0\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}}\right]\)

多項式\(x^u\cdot p(x)^v\)
(%i16) xpxpower:create_list(x^u*px^v,v,1,h-1,u,0,k-1);
(xpxpower) \([x^3-4x^2-3x-10,x(x^3-4x^2-3x-10),x^2(x^3-4x^2-3x-10),(x^3-4x^2-3x-10)^2,x(x^3-4x^2-3x-10)^2,x^2(x^3-4x^2-3x-10)^2]\)

\(x^1,x^2,\ldots,x^{n-1}\)
(%i17) xpower:create_list(x^i,i,1,n-1);
(xpower) \([x,x^2,x^3,x^4,x^5,x^6,x^7,x^8]\)

取多項式\(x^u\cdot(x)^v\)係數,形成右上角矩陣(常數項在最後一行)
(%i8) A:augcoefmatrix(xpxpower,xpower);
(A) \(\left[\matrix{\displaystyle
-3&-4&1&0&0&0&0&0&-10\cr
-10&-3&-4&1&0&0&0&0&0\cr
0&-10&-3&-4&1&0&0&0&0\cr
60&89&4&10&-8&1&0&0&100\cr
100&60&89&4&10&-8&1&0&0\cr
0&100&60&89&4&10&-8&1&0}\right]\)

將常數項移到第一行
(%i19) A:addcol(col(A,h*k),submatrix(A,h*k));
(A) \(\left[\matrix{\displaystyle
-10&-3&-4&1&0&0&0&0&0\cr
0&-10&-3&-4&1&0&0&0&0\cr
0&0&-10&-3&-4&1&0&0&0\cr
100&60&89&4&10&-8&1&0&0\cr
0&100&60&89&4&10&-8&1&0\cr
0&0&100&60&89&4&10&-8&1}\right]\)

矩陣\(A\)轉置
(%i20) A:transpose(A);
(A) \(\left[\matrix{\displaystyle
-10&0&0&100&0&0\cr
-3&-10&0&60&100&0\cr
-4&-3&-10&89&60&100\cr
1&-4&-3&4&89&60\cr
0&1&-4&10&4&89\cr
0&0&1&-8&10&4\cr
0&0&0&1&-8&10\cr
0&0&0&0&1&-8\cr
0&0&0&0&0&1}\right]\)

左下角0矩陣
(%i21) Zero:zeromatrix((h-1)*k,h*k);
(Zero) \(\left[\matrix{\displaystyle
0&0&0&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0}\right]\)

右下角矩陣元素\(N^v\)
(%i22) Npower:create_list(N^v,v,1,h-1,u,0,k-1);
(Npower) \([1131,1131,1131,1279161,1279161,1279161]\)

右下角矩陣
(%i23) D2:diag(Npower);
(D2) \(\left[\matrix{\displaystyle
1131&0&0&0&0&0\cr
0&1131&0&0&0&0\cr
0&0&1131&0&0&0\cr
0&0&0&1279161&0&0\cr
0&0&0&0&1279161&0\cr
0&0&0&0&0&1279161}\right]\)

4個子矩陣合併成矩陣\(M\)
(%i24) M:addrow(addcol(D1,A),addcol(Zero,D2));
(M) \(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&0&0&0&0&0&0&-10&0&0&100&0&0\cr
0&\frac{1}{54}&0&0&0&0&0&0&0&-3&-10&0&60&100&0\cr
0&0&\frac{1}{324}&0&0&0&0&0&0&-4&-3&-10&89&60&100\cr
0&0&0&\frac{1}{1944}&0&0&0&0&0&1&-4&-3&4&89&60\cr
0&0&0&0&\frac{1}{11664}&0&0&0&0&0&1&-4&10&4&89\cr
0&0&0&0&0&\frac{1}{69984}&0&0&0&0&0&1&-8&10&4\cr
0&0&0&0&0&0&\frac{1}{419904}&0&0&0&0&0&1&-8&10\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&0&0&0&0&0&1&-8\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1\cr
0&0&0&0&0&0&0&0&0&1131&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&1131&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&1131&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&1279161&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&1279161&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&0&1279161}\right]\)

將矩陣\(M\)複製成另一個矩陣\(\widetilde{M}\),進行矩陣列運算
(%i25) M_tilde:copymatrix(M)$

將右上角化簡為零
(%i27)
for i:k+1 thru n do
  (for j:1 thru i-1 do
     (print("第",j,"列=第",j,"列-",M_tilde[j,i+n-k],"*第",i,"列=",
               M_tilde[j]:M_tilde[j]-M_tilde[j,i+n-k]*M_tilde[ i ])
     )
  )$
M_tilde;

(%o27)
第1列=第1列--10*第4列\(\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},0,0,0,0,0,0,-40,-30,140,890,600\right]\)
第2列=第2列--3*第4列\(\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},0,0,0,0,0,0,-22,-9,72,367,180\right]\)
第3列=第3列--4*第4列\(\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},0,0,0,0,0,0,-19,-22,105,416,340\right]\)
第1列=第1列--40*第5列\(\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},0,0,0,0,0,0,-190,540,1050,4160\right]\)
第2列=第2列--22*第5列\(\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},0,0,0,0,0,0,-97,292,455,2138\right]\)
第3列=第3列--19*第5列\(\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},0,0,0,0,0,0,-98,295,492,2031\right]\)
第4列=第4列--4*第5列\(\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},0,0,0,0,1,0,-19,44,105,416\right]\)
第1列=第1列--190*第6列\(\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},\frac{95}{34992},0,0,0,0,0,0,-980,2950,4920\right]\)
第2列=第2列--97*第6列\(\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},\frac{97}{69984},0,0,0,0,0,0,-484,1425,2526\right]\)
第3列=第3列--98*第6列\(\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},\frac{49}{34992},0,0,0,0,0,0,-489,1472,2423\right]\)
第4列=第4列--19*第6列\(\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},\frac{19}{69984},0,0,0,1,0,0,-108,295,492\right]\)
第5列=第5列--4*第6列\(\displaystyle =\left[0,0,0,0,\frac{1}{11664},\frac{1}{17496},0,0,0,0,1,0,-22,44,105\right]\)
第1列=第1列--980*第7列\(\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},\frac{95}{34992},\frac{245}{104976},0,0,0,0,0,0,-4890,14720\right]\)
第2列=第2列--484*第7列\(\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},\frac{97}{69984},\frac{121}{104976},0,0,0,0,0,0,-2447,7366\right]\)
第3列=第3列--489*第7列\(\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},\frac{49}{34992},\frac{163}{139968},0,0,0,0,0,0,-2440,7313\right]\)
第4列=第4列--108*第7列\(\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},\frac{19}{69984},\frac{1}{3888},0,0,1,0,0,0,-569,1572\right]\)
第5列=第5列--22*第7列\(\displaystyle =\left[0,0,0,0,\frac{1}{11664},\frac{1}{17496},\frac{11}{209952},0,0,0,1,0,0,-132,325\right]\)
第6列=第6列--8*第7列\(\displaystyle =\left[0,0,0,0,0,\frac{1}{69984},\frac{1}{52488},0,0,0,0,1,0,-54,84\right]\)
第1列=第1列--4890*第8列\(\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},\frac{95}{34992},\frac{245}{104976},\frac{815}{419904},0,0,0,0,0,0,-24400\right]\)
第2列=第2列--2447*第8列\(\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},\frac{97}{69984},\frac{121}{104976},\frac{2447}{2519424},0,0,0,0,0,0,-12210\right]\)
第3列=第3列--2440*第8列\(\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},\frac{49}{34992},\frac{163}{139968},\frac{305}{314928},0,0,0,0,0,0,-12207\right]\)
第4列=第4列--569*第8列\(\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},\frac{19}{69984},\frac{1}{3888},\frac{569}{2519424},0,1,0,0,0,0,-2980\right]\)
第5列=第5列--132*第8列\(\displaystyle =\left[0,0,0,0,\frac{1}{11664},\frac{1}{17496},\frac{11}{209952},\frac{11}{209952},0,0,1,0,0,0,-731\right]\)
第6列=第6列--54*第8列\(\displaystyle =\left[0,0,0,0,0,\frac{1}{69984},\frac{1}{52488},\frac{1}{46656},0,0,0,1,0,0,-348\right]\)
第7列=第7列--8*第8列\(\displaystyle =\left[0,0,0,0,0,0,\frac{1}{419904},\frac{1}{314928},0,0,0,0,1,0,-54\right]\)
第1列=第1列--24400*第9列\(\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},\frac{95}{34992},\frac{245}{104976},\frac{815}{419904},\frac{1525}{944784},0,0,0,0,0,0\right]\)
第2列=第2列--12210*第9列\(\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},\frac{97}{69984},\frac{121}{104976},\frac{2447}{2519424},\frac{2035}{2519424},0,0,0,0,0,0\right]\)
第3列=第3列--12207*第9列\(\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},\frac{49}{34992},\frac{163}{139968},\frac{305}{314928},\frac{4069}{5038848},0,0,0,0,0,0\right]\)
第4列=第4列--2980*第9列\(\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},\frac{19}{69984},\frac{1}{3888},\frac{569}{2519424},\frac{745}{3779136},1,0,0,0,0,0\right]\)
第5列=第5列--731*第9列\(\displaystyle =\left[0,0,0,0,\frac{1}{11664},\frac{1}{17496},\frac{11}{209952},\frac{11}{209952},\frac{731}{15116544},0,1,0,0,0,0\right]\)
第6列=第6列--348*第9列\(\displaystyle =\left[0,0,0,0,0,\frac{1}{69984},\frac{1}{52488},\frac{1}{46656},\frac{29}{1259712},0,0,1,0,0,0\right]\)
第7列=第7列--54*第9列\(\displaystyle =\left[0,0,0,0,0,0,\frac{1}{419904},\frac{1}{314928},\frac{1}{279936},0,0,0,1,0,0\right]\)
第8列=第8列--8*第9列\(\displaystyle =\left[0,0,0,0,0,0,0,\frac{1}{2519424},\frac{1}{1889568},0,0,0,0,1,0\right]\)
\(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}&0&0&0&0&0&0\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}&0&0&0&0&0&0\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}&0&0&0&0&0&0\cr
0&0&0&\frac{1}{1944}&\frac{1}{2916}&\frac{19}{69984}&\frac{1}{3888}&\frac{569}{2519424}&\frac{745}{3779136}&1&0&0&0&0&0\cr
0&0&0&0&\frac{1}{11664}&\frac{1}{17496}&\frac{11}{209952}&\frac{11}{209952}&\frac{731}{15116544}&0&1&0&0&0&0\cr
0&0&0&0&0&\frac{1}{69984}&\frac{1}{52488}&\frac{1}{46656}&\frac{29}{1259712}&0&0&1&0&0&0\cr
0&0&0&0&0&0&\frac{1}{419904}&\frac{1}{314928}&\frac{1}{279936}&0&0&0&1&0&0\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&\frac{1}{1889568}&0&0&0&0&1&0\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1\cr
0&0&0&0&0&0&0&0&0&1131&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&1131&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&1131&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&1279161&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&1279161&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&0&1279161}\right]\)

將右下角化簡為零
(%i29)
for i:k+1 thru n do
  (j:i+n-k,
   print("第",j,"列=第",j,"列-",M_tilde[j,j],"*第",i,"列=",
    M_tilde[j]:M_tilde[j]-M_tilde[j,j]*M_tilde[ i ])
  )$
M_tilde;

(%o29)
第10列=第10列-1131*第4列\(\displaystyle =\left[0,0,0,-\frac{377}{648},-\frac{377}{972},-\frac{7163}{23328},-\frac{377}{1296},-\frac{214513}{839808},-\frac{280865}{1259712},0,0,0,0,0,0\right]\)
第11列=第11列-1131*第5列\(\displaystyle =\left[0,0,0,0,-\frac{377}{3888},-\frac{377}{5832},-\frac{4147}{69984},-\frac{4147}{69984},-\frac{275587}{5038848},0,0,0,0,0,0\right]\)
第12列=第12列-1131*第6列\(\displaystyle =\left[0,0,0,0,0,-\frac{377}{23328},-\frac{377}{17496},-\frac{377}{15552},-\frac{10933}{419904},0,0,0,0,0,0\right]\)
第13列=第13列-1279161*第7列\(\displaystyle =\left[0,0,0,0,0,0,-\frac{142129}{46656},-\frac{142129}{34992},-\frac{142129}{31104},0,0,0,0,0,0\right]\)
第14列=第14列-1279161*第8列\(\displaystyle =\left[0,0,0,0,0,0,0,-\frac{142129}{279936},-\frac{142129}{209952},0,0,0,0,0,0\right]\)
第15列=第15列-1279161*第9列\(\displaystyle =\left[0,0,0,0,0,0,0,0,-\frac{142129}{1679616},0,0,0,0,0,0\right]\)
\(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}&0&0&0&0&0&0\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}&0&0&0&0&0&0\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}&0&0&0&0&0&0\cr
0&0&0&\frac{1}{1944}&\frac{1}{2916}&\frac{19}{69984}&\frac{1}{3888}&\frac{569}{2519424}&\frac{745}{3779136}&1&0&0&0&0&0\cr
0&0&0&0&\frac{1}{11664}&\frac{1}{17496}&\frac{11}{209952}&\frac{11}{209952}&\frac{731}{15116544}&0&1&0&0&0&0\cr
0&0&0&0&0&\frac{1}{69984}&\frac{1}{52488}&\frac{1}{46656}&\frac{29}{1259712}&0&0&1&0&0&0\cr
0&0&0&0&0&0&\frac{1}{419904}&\frac{1}{314928}&\frac{1}{279936}&0&0&0&1&0&0\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&\frac{1}{1889568}&0&0&0&0&1&0\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1\cr
0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}&0&0&0&0&0&0\cr
0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}&0&0&0&0&0&0\cr
0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}&0&0&0&0&0&0\cr
0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&-\frac{142129}{1679616}&0&0&0&0&0&0}\right]\)

將對角線元素為1的一整列移到整個矩陣下方
(%i31)
for i:k+1 thru n do
  (j:i+n-k,
   print("第",i,"列和第",j,"列交換"),
   [M_tilde[j],M_tilde[ i ]]:[M_tilde[ i ],M_tilde[j]]
  )$
M_tilde;

(%o31)
第4列和第10列交換
第5列和第11列交換
第6列和第12列交換
第7列和第13列交換
第8列和第14列交換
第9列和第15列交換
\(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}&0&0&0&0&0&0\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}&0&0&0&0&0&0\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}&0&0&0&0&0&0\cr
0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}&0&0&0&0&0&0\cr
0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}&0&0&0&0&0&0\cr
0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}&0&0&0&0&0&0\cr
0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&-\frac{142129}{1679616}&0&0&0&0&0&0\cr
0&0&0&\frac{1}{1944}&\frac{1}{2916}&\frac{19}{69984}&\frac{1}{3888}&\frac{569}{2519424}&\frac{745}{3779136}&1&0&0&0&0&0\cr
0&0&0&0&\frac{1}{11664}&\frac{1}{17496}&\frac{11}{209952}&\frac{11}{209952}&\frac{731}{15116544}&0&1&0&0&0&0\cr
0&0&0&0&0&\frac{1}{69984}&\frac{1}{52488}&\frac{1}{46656}&\frac{29}{1259712}&0&0&1&0&0&0\cr
0&0&0&0&0&0&\frac{1}{419904}&\frac{1}{314928}&\frac{1}{279936}&0&0&0&1&0&0\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&\frac{1}{1889568}&0&0&0&0&1&0\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1}\right]\)

得到左上角矩陣\(\widehat{M}\)
(%i32) M_hat:genmatrix(lambda([i,j],M_tilde[i,j]),n,n);
(M_hat) \(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}\cr
0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}\cr
0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}\cr
0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}\cr
0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}\cr
0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}\cr
0&0&0&0&0&0&0&0&-\frac{142129}{1679616}}\right]\)

\(\widehat{M}\)變成整數
(%i33) M_hat:M_hat*1/delta*X^(n-1);
(M_hat) \(\left[\matrix{\displaystyle
1679616&0&0&77760&51840&41040&35280&29340&24400\cr
0&279936&0&23328&28512&20952&17424&14682&12210\cr
0&0&46656&31104&24624&21168&17604&14640&12207\cr
0&0&0&-8794656&-5863104&-4641624&-4397328&-3861234&-3370380\cr
0&0&0&0&-1465776&-977184&-895752&-895752&-826761\cr
0&0&0&0&0&-244296&-325728&-366444&-393588\cr
0&0&0&0&0&0&-46049796&-61399728&-69074694\cr
0&0&0&0&0&0&0&-7674966&-10233288\cr
0&0&0&0&0&0&0&0&-1279161}\right]\)

LLL化簡
(%i34) B: LLL(M_hat);
(B) \(\left[\matrix{\displaystyle
0&0&46656&31104&24624&21168&17604&14640&12207\cr
0&279936&-46656&-7776&3888&-216&-180&42&3\cr
0&0&186624&124416&98496&-159624&-255312&-307884&-344760\cr
0&0&-46656&-31104&-24624&223128&308124&351804&-897780\cr
0&0&513216&342144&-1194912&-255744&-50652&-1824&94692\cr
1679616&0&-46656&46656&27216&19872&17676&14700&12193\cr
0&0&-513216&-342144&-270864&2210112&3063636&-4171566&-35880\cr
0&559872&3825792&-6197472&610416&67608&-231696&55866&135297\cr
0&0&-559872&-373248&-4692816&20511144&-17352684&1982268&-265239}\right]\)

Gram-Schmidt正交化
(%i35) Bstar:apply(matrix,expand(gramschmidt(B)));
(Bstar) 矩陣太大不列出來

取最後一個正交向量
(%i36) Bstar_n:Bstar[n];
(Bstar_n) \(\displaystyle \left[-\frac{6714060256800}{194554091},-\frac{24170616924480}{194554091},-\frac{215118490627872}{194554091},-\frac{58009480618752}{194554091},-\frac{870142209281280}{194554091},\frac{4176682604550144}{194554091},-\frac{3132511953412608}{194554091},0,0\right]\)

取各分數的分母
(%i37) Denom:map('denom,Bstar_n);
(Denom) \(\left[194554091,194554091,194554091,194554091,194554091,194554091,194554091,1,1\right]\)

求最大的分母
(%i38) MaxDenom:lmax(%);
(MaxDenom) 194554091

正交向量化為整數
(%i39) Bstar_n:Bstar_n*MaxDenom;
(Bstar_n) \(\left[-6714060256800,-24170616924480,-215118490627872,-58009480618752,-870142209281280,4176682604550144,-3132511953412608,0,0\right]\)

計算最大公因數
(%i40) GCD:lreduce('gcd,Bstar_n);
(GCD) 268562410272

同除最大公因數,得到化簡的正交向量
(%i41) Bstar_n:Bstar_n/GCD;
(Bstar_n) \(\left[-25,-90,-801,-216,-3240,15552,-11664,0,0\right]\)

正交向量和\(\displaystyle \left(\frac{x}{X}\right)^{i}\)相乘
(%i42) hx:sum(Bstar_n[i+1]*(x/X)^i,i,0,n-1);
(hx) \(\displaystyle -\frac{1}{4}x^6+2x^5-\frac{5}{2}x^4-x^3-\frac{89}{4}x^2-15x-25\)

取\(h(x)\)各項係數
(%i43) coef:augcoefmatrix([hx],xpower);
(coef) \(\left[\matrix{\displaystyle -15&-\frac{89}{4}&-1&-\frac{5}{2}&2&-\frac{1}{4}&0&0&-25}\right]\)

取\(h(x)\)係數的分母
(%i44) Denom:map('denom,args(coef)[1]);
(Denom) \([1,4,1,2,1,4,1,1,1]\)

求最大的分母
(%i45) MaxDenom:lmax(Denom);
(MaxDenom) 4

將\(h(x)\)化成整數
(%i46) hx:expand(hx*MaxDenom);
(hx) \(-x^6+8x^5-10x^4-4x^3-89x^2-60x-100\)

將\(h(x)\)因式分解
(%i47) factor(hx);
(%o47) \(-(x-5)^2(x^2+x+2)^2\)

得到\(h(x)\)的解
(%i48) x:5;
(x) 5

驗證答案
(%i49) ev(mod(px,N),x=5);
(%o49) 0
作者: bugmens    時間: 2021-6-19 17:56

Howgrave-Graham論文中回顧Coppersmith方法,但步驟3,4又和Coppersmith有些許不同,本文章就之前範例說明。





方法

範例

步驟1:計算參數\(h\)和\(X\)(和Coppersmith相同)

步驟2:產生矩陣\(M\)(和Coppersmith相同)

步驟3:矩陣\(M\)基本列運算得到\(\widehat{M}\),計算\([r(x)H_1^{-1}]_{sh}\)

因為\(p(x)\)為monic(最高次方項係數為1),在矩陣\(A\)的對角線元素為1,進行基本列運算將右上角化簡為零,右下角化簡為零,再將對角線元素為1的一整列移到整個矩陣下方。
\(\widetilde{M}=H_1M=\left[\matrix{\widehat{M}&│&0_{(hk\times (h-1)k)}\cr ―&┼&――――――\cr A'&│&I_{(h-1)k}}\right]\)
得到左上角矩陣\(\widehat{M}\)
計算矩陣\(H_1^{-1}=M\widetilde{M}^{-1}\)
\(r(x)=[1,x_0,x_0^2,x_0^3,x_0^4,x_0^5,-y_0,-x_0y_0,-y_0^2,-x_0y_0^2]\)
又\(p(x_0)\equiv 0\pmod{N}\),\(p(x_0)=y_0N\),\(\displaystyle y_0=\frac{p(x_0)}{N}\)
\(\displaystyle r(x)=[1,x_0,x_0^2,x_0^3,x_0^4,x_0^5,-\frac{p(x_0)}{N},-\frac{x_0p(x_0)}{N},-\frac{p^2(x_0)}{N},-\frac{x_0p^2(x_0)}{N}]\)
計算\(\displaystyle p(x_0)H_1^{-1}\)
將後面的0刪除\(\displaystyle [p(x_0)H_1^{-1}]_{sh}\)
\(H_1^{-1}=M\widetilde{M}^{-1}=\left[\matrix{
1&&&&&&19&0&361&0\cr
&1&&&&&14&19&532&361\cr
&&&&&&1&14&234&532\cr
&&&&&&&1&28&234\cr
&&&&&&&&1&28\cr
&&&&&&&&&1\cr
&&1&&&&35&&&\cr
&&&1&&&&35&&\cr
&&&&1&&&&1225&\cr
&&&&&1&&&&1225} \right]\)
\(\displaystyle r(x)=(1,x,x^2,x^3,x^4,x^5,-\frac{p(x)}{35},-\frac{xp(x)}{35},-\frac{p^2(x)}{35^2},-\frac{xp^2(x)}{35^2})\)
\(r(x)H_1^{-1}=(1,x,-\frac{p(x)}{35},-\frac{xp(x)}{35},-\frac{p^2(x)}{35^2},-\frac{xp^2(x)}{35^2},\)
     \(19+14x+x^2-p(x),\)
     \(19x+14x^2+x^3-xp(x),\)
     \(361+532x+234x^2+28x^3+x^4-p^2(x),\)
     \(361x+532x^2+234x^3+28x^4+x^5-xp^2(x))\)
\(r(x)H_1^{-1}=(1,x,-\frac{p(x)}{35},-\frac{xp(x)}{35},-\frac{p^2(x)}{35^2},-\frac{xp^2(x)}{35^2},0,0,0,0)\)
\(\left[r(x)H_1^{-1}\right]_{sh}=(1,x,-\frac{p(x)}{35},-\frac{xp(x)}{35},-\frac{p^2(x)}{35^2},-\frac{xp^2(x)}{35^2})\)

步驟4:經LLL化簡和計算矩陣\(H_2^{-1}\)得到不需要同餘\(N\)的方程式

\(B_2=LLL(\widehat{M})\)
計算\(B_2=H_2\widehat{M}\),\(H_2^{-1}=\widehat{M}B_2^{-1}\)
\(r'_{hk}(x)=[r(x)H_1^{-1}]_{sh}\cdot ((H_2^{-1})_{hk})^T\)
解出\(x\)

\(\widehat{M}=\left[\matrix{
32&0&-152&1064&-6726&42028\cr
&16&-112&708&-4424&27605\cr
&&-280&1960&-11060&58800\cr
&&&-140&1960&-19250\cr
&0&&&-2450&34300\cr
&&&&&-1225}\right]\)
\(B=LLL(\widehat{M})=\left[\matrix{0&160&0&-60&0&-100\cr
-64&-64&-88&80&-72&-51\cr
64&-48&32&4&-180&16\cr
128&-80&-48&16&116&-13\cr
-32&-96&-16&-132&90&-108\cr
-64&-32&248&96&-30&-141}\right]\)

\(H_2^{-1}=\widehat{M}B_2^{-1}=\left[\matrix{-166&-125&-9&-111&-73&-70\cr
-109&-82&-6&-73&-48&-46\cr
-231&-171&-7&-157&-104&-98\cr
77&60&8&50&32&32\cr
-138&-109&-18&-88&-56&-57\cr
5&4&1&3&2&2}\right]\)
\(((H_2^{-1})_{6})^T=\left[-70,-46,-98,32,-57,2\right]\)
\(\displaystyle [r(x)H_1^{-1}]_{sh}\cdot ((H_2^{-1})_6)^T=-70\cdot 1-46x+98\frac{p(x)}{35}-32\frac{xp(x)}{35}+57\frac{p^2(x)}{35^2}-2\frac{xp^2(x)}{35^2}\)
\(\displaystyle h(x)=\frac{-1}{1225}(2x^5-x^4-8x^3-24x^2+8x+3)\)
  \(\displaystyle =\frac{-1}{1225}(x-3)(2x-1)(x^3+3x^2+5x+1)\)
解方程式得到答案
\(x=3\)

註:
1.原論文用\(c(x)\),本文章和Coppersmith一致用\(r(x)\)。
2.原論文的\(\widehat{M}\)有行列互換,但本文章沒有行列互換,但不影響計算過程。
原論文
\(\widetilde{M}=\left[\matrix{
-1225&&&&&\cr
34300&-2450&&&&\cr
-19250&1960&-140&&&\cr
58800&-11060&1960&-280&&\cr
27605&-4424&708&-112&16&\cr
42028&-6726&1064&-152&0&32}\right]\),\(H_2^{-1}=\left[\matrix{
-5&4&-2&1&-1&-2\cr
138&-109&56&-18&31&57\cr
-77&60&-32&8&-18&-32\cr
231&-171&104&-7&59&98\cr
109&-82&48&-6&27&46\cr
166&-125&73&-9&41&70}\right]\)
本文章
\(\widetilde{M}=\left[\matrix{
32&0&-152&1064&-6726&42028\cr
&16&-112&708&-4424&27605\cr
&&-280&1960&-11060&58800\cr
&&&-140&1960&-19250\cr
&&&&-2450&34300\cr
&&&&&-1225}\right]\),\(H_2^{-1}=\left[\matrix{
-166&-125&-9&-111&-73&-70\cr
-109&-82&-6&-73&-48&-46\cr
-231&-171&-7&-157&-104&-98\cr
77&60&8&50&32&32\cr
-138&-109&-18&-88&-56&-57\cr
5&4&1&3&2&2}\right]\)


參考資料:
N. Howgrave-Graham. Finding small roots of univariate modular equations revisited. In Cryptography and Coding– Proc. IMA ’97, volume 1355 of Lecture Notes in Computer Science, pages 131–142. Springer, 1997.
https://link.springer.com/chapter/10.1007/BFb0024458



請下載LLL.zip,解壓縮後將LLL.mac放到C:\maxima-5.45.0\share\maxima\5.45.0\share目錄下
要先載入LLL.mac才能使用LLL指令

(%i1) load("LLL.mac");
(%o1) C:/maxima-5.45.0/share/maxima/5.45.0/share/LLL.mac

同餘方程式
(%i2) px:x^2+14*x+19;
(px) \(x^2+14x+19\)

\(p(x)\equiv 0\pmod{N}\)
(%i3) N:35;
(N) 35

\(p(x)\)的次數\(k\)
(%i4) k:hipow(px,x);
(k) 2

設誤差值\(epsilon=0.1\)
(%i5) epsilon:0.1;
(epsilon) 0.1

參數\(h\)
(%i7)
h:ceiling(max(7/k,(k+epsilon*k-1)/(epsilon*k^2)));
h:3;

(h) 4
(h) 3

\(\widehat{M}\)的維度\(n=hk\)
(%i8) n:h*k;
(n) 6

參數\(\delta\),按照公式應該是\(\displaystyle \delta=\frac{1}{\sqrt{6}}\),本範例\(\delta=1\)
(%i10)
delta:1/sqrt(h*k);
delta:1;

(delta) \(\displaystyle \frac{1}{\sqrt{6}}\)
(delta) 1

希望能找到\(|\;x|\;<X=\frac{1}{2}N^{1/k}\),\(p(x)\equiv 0\pmod{N}\)
(%i11) X:floor(1/2*N^(1/k));
(X) 2

產生矩陣\(M\)
(%i14)
kill(genlattice)$
genlattice[i,j]:=(
v:floor((k+j-h*k-1)/k),
u: (j-h*k-1)-k*(v-1),
if i<=h*k and j<=h*k then if i=j then delta*X^(1-i) else 0/*左上角矩陣*/
else if i<=h*k and j>h*k then (coeff(expand(x^u*px^v),x,i-1))/*右上角矩陣*/
else if i>h*k and j<=h*k then 0/*左下角矩陣*/
else if i>h*k and j>h*k then if i=j then N^v else 0)$/*右下角矩陣*/
M:genmatrix(genlattice,2*h*k-k,2*h*k-k);

(M) \(\left[\matrix{\displaystyle
1&0&0&0&0&0&19&0&361&0\cr
0&\frac{1}{2}&0&0&0&0&14&19&532&361\cr
0&0&\frac{1}{4}&0&0&0&1&14&234&532\cr
0&0&0&\frac{1}{8}&0&0&0&1&28&234\cr
0&0&0&0&\frac{1}{16}&0&0&0&1&28\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1\cr
0&0&0&0&0&0&35&0&0&0\cr
0&0&0&0&0&0&0&35&0&0\cr
0&0&0&0&0&0&0&0&1225&0\cr
0&0&0&0&0&0&0&0&0&1225}\right]\)

將矩陣\(M\)複製成另一個矩陣\(\widetilde{M}\)
(%i15) M_tilde:copymatrix(M)$

矩陣\(\widetilde{M}\)進行矩陣列運算
(%i17)
for i:n thru k+1 step -1 do
  (for j:1 thru i-1 do
      (M_tilde:rowop(M_tilde,j,i,M_tilde[j,i+n-k])),/*消掉右上角*/
   j:i+n-k,
   M_tilde:rowop(M_tilde,j,i,M_tilde[j,j]),/*消掉右下角N^v*/
   M_tilde:rowswap(M_tilde,i,j)/*列交換*/
   )$
M_tilde;

(%o17) \(\left[\matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}&0&0&0&0\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}&0&0&0&0\cr
0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}&0&0&0&0\cr
0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}&0&0&0&0\cr
0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}&0&0&0&0\cr
0&0&0&0&0&-\frac{1225}{32}&0&0&0&0\cr
0&0&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}&1&0&0&0\cr
0&0&0&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}&0&1&0&0\cr
0&0&0&0&\frac{1}{16}&-\frac{7}{8}&0&0&1&0\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1}\right]\)

計算矩陣\(H_1^{-1}=M\widetilde{M}^{-1}\)
(%i18) H1_inv:M.invert(M_tilde);
(H1_inv) \(\left[\matrix{\displaystyle
1&0&0&0&0&0&19&0&361&0\cr
0&1&0&0&0&0&14&19&532&361\cr
0&0&0&0&0&0&1&14&234&532\cr
0&0&0&0&0&0&0&1&28&234\cr
0&0&0&0&0&0&0&0&1&28\cr
0&0&0&0&0&0&0&0&0&1\cr
0&0&1&0&0&0&35&0&0&0\cr
0&0&0&1&0&0&0&35&0&0\cr
0&0&0&0&1&0&0&0&1225&0\cr
0&0&0&0&0&1&0&0&0&1225}\right]\)

產生\(r(x)\)
(%i19) rx:create_list(x^i,i,0,h*k-1);
(rx) \(\left[1,x,x^2,x^3,x^4,x^5\right]\)

產生\(r(x)\)
(%i21)
for j:1 thru h*k-k do
  (print("j=",j,
           ",v=floor(","k+j-1"/"k",")=floor(",(k+j-1)/k,")=",v:floor((k+j-1)/k),
            ",u=(j-1)-k(v-1)=(",j,"-1)-",k,"(",v,"-1)","=",u: (j-1)-k*(v-1),
            ",-","x"^"u"*"p(x)"^"v"/"N"^"v","=","-","x"^u*"p(x)"^v/"N"^v),
   rx:append(rx,[-x^u*px^v/N^v])
  )$
rx;

\(\displaystyle j=1,v=floor(\frac{k+j-1}{k})=floor(1)=1,u=(j-1)-k(v-1)=(1-1)-2(1-1)=0,-\frac{p(x)^v x^u}{N^v}=-\frac{p(x)}{N}\)
\(\displaystyle j=2,v=floor(\frac{k+j-1}{k})=floor(\frac{3}{2})=1,u=(j-1)-k(v-1)=(2-1)-2(1-1)=1,-\frac{p(x)^v x^u}{N^v}=-\frac{p(x)x}{N}\)
\(\displaystyle j=3,v=floor(\frac{k+j-1}{k})=floor(2)=2,u=(j-1)-k(v-1)=(3-1)-2(2-1)=0,-\frac{p(x)^v x^u}{N^v}=-\frac{p(x)^2}{N^2}\)
\(\displaystyle j=4,v=floor(\frac{k+j-1}{k})=floor(\frac{5}{2})=2,u=(j-1)-k(v-1)=(4-1)-2(2-1)=1,-\frac{p(x)^v x^u}{N^v}=-\frac{p(x)^2x}{N^2}\)
(%o21) \(\displaystyle \left[1,x,x^2,x^3,x^4,x^5,\frac{-x^2-14x-19}{35},-\frac{x(x^2+14x+19)}{35},-\frac{(x^2+14x+19)^2}{1225},-\frac{x(x^2+14x+19)^2}{1225}\right]\)

計算\(r(x)H_1^{-1}\)
(%i22) rxH1_inv:args(rx.H1_inv)[1];
(rxH1_inv) \(\displaystyle [1,x,\frac{-x^2-14x-19}{35},-\frac{x(x^2+14*x+19)}{35},-\frac{(x^2+14x+19)^2}{1225},-\frac{x(x^2+14x+19)^2}{1225},0,\)
      \(x^3-x(x^2+14x+19)+14x^2+19x,\)
      \(-(x^2+14x+19)^2+x^4+28x^3+234x^2+532x+361,\)
      \(-x(x^2+14x+19)^2+x^5+28x^4+234x^3+532x^2+361x]\)

其中\(r(x)H_1^{-1}\)後面化簡為0
(%i23) rxH1_inv:ratsimp(rxH1_inv);
(rxH1_inv) \(\displaystyle \left[1,x,-\frac{x^2+14x+19}{35},-\frac{x^3+14x^2+19x}{35},-\frac{x^4+28x^3+234x^2+532x+361}{1225},-\frac{x^5+28x^4+234x^3+532x^2+361x}{1225},0,0,0,0\right]\)

縮短\(r(x)H_1^{-1}\)長度
(%i24) rxH1_inv_short:rest(rxH1_inv,-(h*k-k));
(rxH1_inv_short) \(\displaystyle \left[1,x,-\frac{x^2+14x+19}{35},-\frac{x^3+14x^2+19x}{35},-\frac{x^4+28x^3+234x^2+532x+361}{1225},-\frac{x^5+28x^4+234x^3+532x^2+361x}{1225}\right]\)

得到左上角矩陣\(\widehat{M}\)
(%i25) M_hat:genmatrix(lambda([i,j],M_tilde[i,j]),n,n);
(M_hat) \(\left[\matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr
0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}\cr
0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr
0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}\cr
0&0&0&0&0&-\frac{1225}{32}}\right]\)

\(\widehat{M}\)乘32倍變成整數
(%i26) M_hat:M_hat*1/delta*X^(n-1);
(M_hat) \(\left[\matrix{\displaystyle
32&0&-152&1064&-6726&42028\cr
0&16&-112&708&-4424&27605\cr
0&0&-280&1960&-11060&58800\cr
0&0&0&-140&1960&-19250\cr
0&0&0&0&-2450&34300\cr
0&0&0&0&0&-1225}\right]\)

LLL化簡
(%i27) B2: LLL(M_hat);
(B2) \(\left[\matrix{\displaystyle
0&160&0&-60&0&-100\cr
-64&-64&-88&80&-72&-51\cr
64&-48&32&4&-180&16\cr
128&-80&-48&16&116&-13\cr
-32&-96&-16&-132&90&-108\cr
-64&-32&248&96&-30&-141}\right]\)

計算矩陣\(H_2^{-1}=\widehat{M}B_2^{-1}\)
(%i28) H2_inv:M_hat.invert(B2);
(H2_inv) \(\left[\matrix{\displaystyle
-166&-125&-9&-111&-73&-70\cr
-109&-82&-6&-73&-48&-46\cr
-231&-171&-7&-157&-104&-98\cr
77&60&8&50&32&32\cr
-138&-109&-18&-88&-56&-57\cr
5&4&1&3&2&2}\right]\)

取矩陣\(H_2^{-1}\)最後一行
(%i29) H2_inv_lastcolumn:transpose(col(H2_inv,n));
(H2_inv_lastcolumn) \([\matrix{-70&-46&-98&32&-57&2}]\)

將\([r(x)H_1^{-1}]_{sh}\cdot ((H_2^{-1})_{hk})^T\)相乘
(%i30) hx:rxH1_inv_short.H2_inv_lastcolumn;
(hx) \(\displaystyle -\frac{2(x^5+28x^4+234x^3+532x^2+361x)}{1225}+\frac{57(x^4+28x^3+234x^2+532x+361)}{1225}-\frac{32(x^3+14x^2+19x)}{35}+\frac{14(x^2+14x+19)}{5}-46x-70\)

將\(h(x)\)因式分解
(%i31) factor(hx);
(%o31) \(\displaystyle -\frac{(x-3)(2x-1)(x^3+3x^2+5x+1)}{1225}\)

得到\(h(x)\)的解
(%i32) x:3;
(x) 3

驗證答案
(%i33) ev(mod(px,N),x=3);
(%o33) 0
作者: bugmens    時間: 2021-6-19 18:16

解三次同餘方程式\(p(x)=x^3-4x^2-3x-10\pmod{1131}\)。

參考資料
Finding Small Roots of Polynomial Equations Using Lattice Basis Reduction
https://ntnuopen.ntnu.no/ntnu-xm ... e=1&isAllowed=y



請下載LLL.zip,解壓縮後將LLL.mac放到C:\maxima-5.45.0\share\maxima\5.45.0\share目錄下
要先載入LLL.mac才能使用LLL指令

(%i1) load("LLL.mac");
(%o1) C:/maxima-5.45.0/share/maxima/5.45.0/share/LLL.mac

同餘方程式\(p(x)\)
(%i2) px:x^3-4*x^2-3*x-10;
(px) \(x^3-4x^2-3x-10\)

\(p(x)\equiv 0\pmod{N}\)
(%i3) N:1131;
(N) 1131

\(p(x)\)的次數\(k\)
(%i4) k:hipow(px,x);
(k) 3

設誤差值\(\epsilon=0.1\)
(%i5) epsilon:0.1;
(epsilon) 0.1

參數\(h\)
(%i6) h:ceiling(max(7/k,(k+epsilon*k-1)/(epsilon*k^2)));
(h) 3

\(\widehat{M}\)的維度\(n=hk\)
(%i7) n:h*k;
(n) 9

參數\(\delta\),按照公式應該是\(\displaystyle \delta=\frac{1}{3}\),本範例\(\displaystyle \delta=\frac{1}{9}\)
(%i9)
delta:1/sqrt(h*k);
delta:1/9;

(delta) \(\displaystyle \frac{1}{3}\)
(delta) \(\displaystyle \frac{1}{9}\)

希望能找到\(\displaystyle |\;x|\;<X=\frac{1}{2}N^{1/k}\),\(p(x)\equiv 0\pmod{N}\)
按照公式應該是5,本範例\(X=6\)

(%i11)
X:floor(1/2*N^(1/k));
X:6;

(X) 5
(X) 6

產生矩陣\(M\)
(%i14)
kill(genlattice)$
genlattice[i,j]:=(
v:floor((k+j-h*k-1)/k),
u: (j-h*k-1)-k*(v-1),
if i<=h*k and j<=h*k then if i=j then delta*X^(1-i) else 0/*左上角矩陣*/
else if i<=h*k and j>h*k then (coeff(expand(x^u*px^v),x,i-1))/*右上角矩陣*/
else if i>h*k and j<=h*k then 0/*左下角矩陣*/
else if i>h*k and j>h*k then if i=j then N^v else 0)$/*右下角矩陣*/
M:genmatrix(genlattice,2*h*k-k,2*h*k-k);

(M) \(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&0&0&0&0&0&0&-10&0&0&100&0&0\cr
0&\frac{1}{54}&0&0&0&0&0&0&0&-3&-10&0&60&100&0\cr
0&0&\frac{1}{324}&0&0&0&0&0&0&-4&-3&-10&89&60&100\cr
0&0&0&\frac{1}{1944}&0&0&0&0&0&1&-4&-3&4&89&60\cr
0&0&0&0&\frac{1}{11664}&0&0&0&0&0&1&-4&10&4&89\cr
0&0&0&0&0&\frac{1}{69984}&0&0&0&0&0&1&-8&10&4\cr
0&0&0&0&0&0&\frac{1}{419904}&0&0&0&0&0&1&-8&10\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&0&0&0&0&0&1&-8\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1\cr
0&0&0&0&0&0&0&0&0&1131&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&1131&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&1131&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&1279161&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&1279161&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&0&1279161}\right]\)

將矩陣\(M\)複製成另一個矩陣\(\widetilde{M}\)
(%i15) M_tilde:copymatrix(M)$

矩陣\(\widetilde{M}\)進行矩陣列運算
(%i17)
for i:n thru k+1 step -1 do
  (for j:1 thru i-1 do
      (M_tilde:rowop(M_tilde,j,i,M_tilde[j,i+n-k])),/*消掉右上角*/
   j:i+n-k,
   M_tilde:rowop(M_tilde,j,i,M_tilde[j,j]),/*消掉右下角N^v*/
   M_tilde:rowswap(M_tilde,i,j)/*列交換*/
   )$
M_tilde;

(%o17) \(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}&0&0&0&0&0&0\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}&0&0&0&0&0&0\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}&0&0&0&0&0&0\cr
0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}&0&0&0&0&0&0\cr
0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}&0&0&0&0&0&0\cr
0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}&0&0&0&0&0&0\cr
0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&-\frac{142129}{1679616}&0&0&0&0&0&0\cr
0&0&0&\frac{1}{1944}&\frac{1}{2916}&\frac{19}{69984}&\frac{1}{3888}&\frac{569}{2519424}&\frac{745}{3779136}&1&0&0&0&0&0\cr
0&0&0&0&\frac{1}{11664}&\frac{1}{17496}&\frac{11}{209952}&\frac{11}{209952}&\frac{731}{15116544}&0&1&0&0&0&0\cr
0&0&0&0&0&\frac{1}{69984}&\frac{1}{52488}&\frac{1}{46656}&\frac{29}{1259712}&0&0&1&0&0&0\cr
0&0&0&0&0&0&\frac{1}{419904}&\frac{1}{314928}&\frac{1}{279936}&0&0&0&1&0&0\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&\frac{1}{1889568}&0&0&0&0&1&0\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1}\right]\)

計算矩陣\(H_1^{-1}=M\widetilde{M}^{-1}\)
(%i18) H1_inv:M.invert(M_tilde);
(H1_inv) \(\left[\matrix{\displaystyle
1&0&0&0&0&0&0&0&0&-10&0&0&100&0&0\cr
0&1&0&0&0&0&0&0&0&-3&-10&0&60&100&0\cr
0&0&1&0&0&0&0&0&0&-4&-3&-10&89&60&100\cr
0&0&0&0&0&0&0&0&0&1&-4&-3&4&89&60\cr
0&0&0&0&0&0&0&0&0&0&1&-4&10&4&89\cr
0&0&0&0&0&0&0&0&0&0&0&1&-8&10&4\cr
0&0&0&0&0&0&0&0&0&0&0&0&1&-8&10\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&1&-8\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&0&1\cr
0&0&0&1&0&0&0&0&0&1131&0&0&0&0&0\cr
0&0&0&0&1&0&0&0&0&0&1131&0&0&0&0\cr
0&0&0&0&0&1&0&0&0&0&0&1131&0&0&0\cr
0&0&0&0&0&0&1&0&0&0&0&0&1279161&0&0\cr
0&0&0&0&0&0&0&1&0&0&0&0&0&1279161&0\cr
0&0&0&0&0&0&0&0&1&0&0&0&0&0&1279161}\right]\)

產生\(r(x)\)
(%i19) rx:create_list(x^i,i,0,h*k-1);
(rx) \([1,x,x^2,x^3,x^4,x^5,x^6,x^7,x^8]\)

產生\(r(x)\)
(%i21)
for j:1 thru h*k-k do
  (print("j=",j,
           ",v=floor(","k+j-1"/"k",")=floor(",(k+j-1)/k,")=",v:floor((k+j-1)/k),
            ",u=(j-1)-k(v-1)=(",j,"-1)-",k,"(",v,"-1)","=",u: (j-1)-k*(v-1),
            ",-","x"^"u"*"p(x)"^"v"/"N"^"v","=","-","x"^u*"p(x)"^v/"N"^v),
   rx:append(rx,[-x^u*px^v/N^v])
  )$
rx;

\(\displaystyle j=1,v=floor(\frac{k+j-1}{k})=floor(1)=1,u=(j-1)-k(v-1)=(1-1)-3(1-1)=0,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)}{N}\)
\(\displaystyle j=2,v=floor(\frac{k+j-1}{k})=floor(4/3)=1,u=(j-1)-k(v-1)=(2-1)-3(1-1)=1,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)x}{N}\)
\(\displaystyle j=3,v=floor(\frac{k+j-1}{k})=floor(5/3)=1,u=(j-1)-k(v-1)=(3-1)-3(1-1)=2,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)x^2}{N}\)
\(\displaystyle j=4,v=floor(\frac{k+j-1}{k})=floor(2)=2,u=(j-1)-k(v-1)=(4-1)-3(2-1)=0,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)^2}{N^2}\)
\(\displaystyle j=5,v=floor(\frac{k+j-1}{k})=floor(7/3)=2,u=(j-1)-k(v-1)=(5-1)-3(2-1)=1,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)^2x}{N^2}\)
\(\displaystyle j=6,v=floor(\frac{k+j-1}{k})=floor(8/3)=2,u=(j-1)-k(v-1)=(6-1)-3(2-1)=2,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)^2*x^2}{N^2}\)
(%o21) \(\displaystyle [1,x,x^2,x^3,x^4,x^5,x^6,x^7,x^8,\frac{-x^3+4x^2+3x+10}{1131},-\frac{x(x^3-4x^2-3x-10)}{1131},-\frac{x^2(x^3-4x^2-3x-10)}{1131},\)
     \(\displaystyle -\frac{(x^3-4x^2-3x-10)^2}{1279161},-\frac{x(x^3-4x^2-3x-10)^2}{1279161},-\frac{x^2(x^3-4x^2-3x-10)^2}{1279161}]\)

計算\(r(x)H_1^{-1}\)
(%i22) rxH1_inv:args(rx.H1_inv)[1];
(rxH1_inv) \(\displaystyle [1,x,x^2,\frac{-x^3+4x^2+3x+10}{1131},-\frac{x(x^3-4x^2-3x-10)}{1131},-\frac{x^2(x^3-4x^2-3x-10)}{1131},-\frac{(x^3-4x^2-3x-10)^2}{1279161},-\frac{x(x^3-4x^2-3x-10)^2}{1279161},-\frac{x^2(x^3-4x^2-3x-10)^2}{1279161},0,\)
     \(x^4-x(x^3-4x^2-3x-10)-4x^3-3x^2-10x,\)
     \(x^5-4x^4-x^2(x^3-4x^2-3x-10)-3x^3-10x^2,\)
     \(-(x^3-4x^2-3x-10)^2+x^6-8x^5+10x^4+4x^3+89x^2+60x+100,\)
     \(-x(x^3-4x^2-3x-10)^2+x^7-8x^6+10x^5+4x^4+89x^3+60x^2+100x,\)
     \(-x^2(x^3-4x^2-3x-10)^2+x^8-8x^7+10x^6+4x^5+89x^4+60x^3+100x^2]\)

其中\(r(x)H_1^{-1}\)後面化簡為0
(%i23) rxH1_inv:ratsimp(rxH1_inv);
(rxH1_inv) \(\displaystyle \left[1,x,x^2,\frac{-x^3+4x^2+3x+10}{1131},-\frac{x(x^3-4x^2-3x-10)}{1131},-\frac{x^2(x^3-4x^2-3x-10)}{1131},-\frac{(x^3-4x^2-3x-10)^2}{1279161},-\frac{x(x^3-4x^2-3x-10)^2}{1279161},-\frac{x^2(x^3-4x^2-3x-10)^2}{1279161},0,0,0,0,0,0\right]\)

縮短\(r(x)H)_1^{-1}\)長度
(%i24) rxH1_inv_short:rest(rxH1_inv,-(h*k-k));
(rxH1_inv_short) \(\displaystyle \left[1,x,x^2,\frac{-x^3+4x^2+3x+10}{1131},-\frac{x(x^3-4x^2-3x-10)}{1131},-\frac{x^2(x^3-4x^2-3x-10)}{1131},-\frac{(x^3-4x^2-3x-10)^2}{1279161},-\frac{x(x^3-4x^2-3x-10)^2}{1279161},-\frac{x^2(x^3-4x^2-3x-10)^2}{1279161}\right]\)

得到左上角矩陣\(\widehat{M}\)
(%i25) M_hat:genmatrix(lambda([i,j],M_tilde[i,j]),n,n);
(M_hat) \(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}\cr
0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}\cr
0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}\cr
0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}\cr
0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}\cr
0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}\cr
0&0&0&0&0&0&0&0&-\frac{142129}{1679616}}\right]\)

\(\widehat{M}\)乘1679616變成整數
(%i26) M_hat:M_hat*1/delta*X^(n-1);
(M_hat) \(\left[\matrix{\displaystyle
1679616&0&0&77760&51840&41040&35280&29340&24400\cr
0&279936&0&23328&28512&20952&17424&14682&12210\cr
0&0&46656&31104&24624&21168&17604&14640&12207\cr
0&0&0&-8794656&-5863104&-4641624&-4397328&-3861234&-3370380\cr
0&0&0&0&-1465776&-977184&-895752&-895752&-826761\cr
0&0&0&0&0&-244296&-325728&-366444&-393588\cr
0&0&0&0&0&0&-46049796&-61399728&-69074694\cr
0&0&0&0&0&0&0&-7674966&-10233288\cr
0&0&0&0&0&0&0&0&-1279161}\right]\)

LLL化簡
(%i27) B2: LLL(M_hat);
(B2) \(\left[\matrix{\displaystyle
0&0&46656&31104&24624&21168&17604&14640&12207\cr
0&279936&-46656&-7776&3888&-216&-180&42&3\cr
0&0&186624&124416&98496&-159624&-255312&-307884&-344760\cr
0&0&-46656&-31104&-24624&223128&308124&351804&-897780\cr
0&0&513216&342144&-1194912&-255744&-50652&-1824&94692\cr
1679616&0&-46656&46656&27216&19872&17676&14700&12193\cr
0&0&-513216&-342144&-270864&2210112&3063636&-4171566&-35880\cr
0&559872&3825792&-6197472&610416&67608&-231696&55866&135297\cr
0&0&-559872&-373248&-4692816&20511144&-17352684&1982268&-265239}\right]\)

計算矩陣\(H_2^{-1}=\widehat{M}B_2^{-1}\)
(%i28) H2_inv:M_hat.invert(B2);
(H2_inv) \(\left[\matrix{\displaystyle
1&0&0&0&0&1&0&0&0\cr
1&1&0&0&0&0&0&0&0\cr
1&0&0&0&0&0&0&0&0\cr
-141&-2&6&0&3&0&0&1&0\cr
-19&0&2&0&1&0&0&0&0\cr
-4&0&1&0&0&0&0&0&0\cr
-477&0&145&14&-3&0&4&0&1\cr
-44&0&15&5&0&0&1&0&0\cr
-3&0&1&1&0&0&0&0&0}\right]\)

取矩陣\(H_2^{-1}\)最後一行
(%i29) H2_inv_lastcolumn:transpose(col(H2_inv,n));
(H2_inv_lastcolumn) \([\matrix{0&0&0&0&0&0&1&0&0}]\)

將\([r(x)H_1^{-1}]_{sh}\cdot ((H_2^{-1})_{hk})^T\)相乘
(%i30) hx:rxH1_inv_short.H2_inv_lastcolumn;
(hx) \(\displaystyle -\frac{x^6-8x^5+10x^4+4x^3+89x^2+60x+100}{1279161}\)

將\(h(x)\)因式分解
(%i31) factor(hx);
(%o31) \(\displaystyle -\frac{(x-5)^2(x^2+x+2)^2}{1279161}\)

得到\(h(x)\)的解
(%i32) x:5;
(x) 5

驗證答案
(%i33) ev(mod(px,N),x=5);
(%o33) 0
作者: bugmens    時間: 2021-6-29 10:42

當初Coppersmith的方法比較麻煩,Howgrave-Graham提供改良的方法,方法如下。







方法

範例

問題敘述

設同餘方程式為\(p(x)=x^k+a_{k-1}x^{k-1}+\ldots+a_1 x+a_0\equiv 0 \pmod{N}\)
且\(p(x)\)為monic(最高次方項係數為1)且不可分解。
利用LLL方法可以找出比邊界\(X\)還小的解\(x_0\)(\(\displaystyle |\;x_0|\;<X\))
使得\(p(x_0)\equiv 0 \pmod{N}\)
設同餘方程式為\(p(x)=x^2+14x+19\equiv 0\pmod{35}\)
且\(p(x)\)為monic(最高次方項係數為1)且不可分解。
利用LLL方法可以找出比邊界\(X\)還小的解
使得\(p(x_0)\equiv 0 \pmod{35}\)

步驟1:計算參數\(h\)和\(X\)

\(h\ge 2\)
\(\displaystyle X=\lceil\;2^{-\frac{1}{2}}(hk)^{-\frac{1}{hk-1}}N^{\frac{h-1}{hk-1}}\rceil\;-1\)
\(h=3\)
\(k=2\)
\(X=\lceil\;2^{-\frac{1}{2}}\cdot 6^{-\frac{1}{5}}\cdot 35^{\frac{2}{5}}\rceil\;-1=\lceil\;2.0487\rceil\;-1=3-1=2\)

步驟2:產生矩陣\(M\)

定義三角\((hk)\times(hk)\)矩陣\(M=(m_{i,j})\),\(m_{i,j}=e_{i,j}X^{j-1}\)
\(e_{i,j}\)是\(q_{u,v}(x)=N^{(h-1-v)}x^u(p(x))^v\)的\(\displaystyle x^{j-1}\)項係數
其中\(\displaystyle v=\lfloor\;\frac{i-1}{k}\rfloor\;\)和\(u=(i-1)-kv\)
注意到對所有\(u,v\ge 0\),\(q_{u,v}(x_0)\equiv 0\pmod{N^{h-1}}\)
-----------------------
以\(h=3,k=2\)為例計算\(det(M)\)
\(M=\left[\matrix{N^2&&&&&\cr
0&N^2X^1&&&&\cr
*&*&NX^2&&&\cr
0&*&*&NX^3&&\cr
*&*&*&*&X^4&\cr
0&*&*&*&*&X^5}\right]\)
*代表非零數字
因為\(M\)為下三角矩陣,行列式值為對角線元素相乘
\(det(M)=(N^2\cdot N^2X^1)\cdot (NX^2\cdot NX^3)\cdot(X^4\cdot X^5)\)
   \(=X^{0+1+2+3+4+5}N^{2(2+1+0)}\)
   \(=X^{15}N^6\)
-----------------------
有上面的經驗改計算\(det(M)\)的一般式
維度\((hk)\times(hk)\)矩陣\(M\)的對角線元素為
\(\displaystyle [(N^{h-1},N^{h-1}X^1,\ldots,N^{h-1}X^{k-1}),\)有\(k\)個
\(\displaystyle (N^{h-2}X^k,N^{h-2},X^{k+1},\ldots,N^{h-2}X^{2k-1}),\)有\(k\)個

\(\displaystyle (X^{hk-k},\ldots,X^{hk-1})]\)有\(k\)個
因為\(M\)為下三角矩陣,行列式值為對角線元素相乘
\(det(M)=X^{0+1+\ldots+(hk-1)}N^{k[(h-1)+(h-2)+\ldots+0]}\)
   \(=X^{\frac{hk(hk-1)}{2}}N^{\frac{hk(h-1)}{2}}\)
\(i=1\),\(\displaystyle v=\lfloor\;\frac{1-1}{2}\rfloor\;=0\),\(u=(1-1)-2\cdot 0=0\)
\(q_{0,0}(x)=N^{3-1-0}x^0(x^2+14x+19)^0=1225\)
\(i=2\),\(\displaystyle v=\lfloor\;\frac{2-1}{2}\rfloor\;=0\),\(u=(2-1)-2\cdot 0=1\)
\(q_{1,0}(x)=N^{3-1-0}x^1(x^2+14x+19)^0=1225x\)
\(i=3\),\(\displaystyle v=\lfloor\;\frac{3-1}{2}\rfloor\;=1\),\(u=(3-1)-2\cdot 1=0\)
\(q_{0,1}(x)=N^{3-1-1}x^0(x^2+14x+19)^1=665+490x+35x^2\)
\(i=4\),\(\displaystyle v=\lfloor\;\frac{4-1}{2}\rfloor\;=1\),\(u=(4-1)-2\cdot 1=1\)
\(q_{1,1}(x)=N^{3-1-1}x^1(x^2+14x+19)^1=665x+490x^2+35x^3\)
\(i=5\),\(\displaystyle v=\lfloor\;\frac{5-1}{2}\rfloor\;=2\),\(u=(5-1)-2\cdot 2=0\)
\(q_{0,2}(x)=N^{3-1-2}x^0(x^2+14x+19)^2=361+532x+234x^2+28x^3+x^4\)
\(i=6\),\(\displaystyle v=\lfloor\;\frac{6-1}{2}\rfloor\;=2\),\(u=(6-1)-2\cdot 2=1\)
\(q_{1,2}(x)=N^{3-1-2}x^1(x^2+14x+19)^2=361x+532x^2+234x^3+28x^4+x^5\)
\(m_{i,j}=e_{i,j}X^{j-1}\),\(x^{j-1}\)次方係數乘上\(2^{j-1}\)
     常數項 1次方  2次方  3次方  4次方  5次方
\(M=\matrix{q_{0,0}(x)\cr q_{1,0}(x)\cr q_{0,1}(x)\cr q_{1,1}(x)\cr q_{0,2}(x)\cr q_{1,2}(x)}\left[\matrix{1225&&&&0&\cr
0&1225\times 2&&&&\cr
665&490\times 2&35\times 2^2&&&\cr
0&665\times 2&490\times 2^2&35\times 2^3&&\cr
361&532\times 2&234 \times 2^2&28\times 2^3&2^4&\cr
0&361\times 2&532\times 2^2&234\times 2^3&28\times 2^4&2^5} \right]\)
\(det(M)=2^{15}35^6\)

步驟3:經LLL化簡後的短向量產生不需要同餘\(N^{h-1}\)的方程式

矩陣\(M\)經LLL化簡為\(B\)
\(B=LLL(M)\)
lattice經LLL化簡後第一行\(b_1\)為整個lattice中較短向量
所形成的方程式不需要再同餘\(N\)
-------------------
設\(B\)是矩陣\(M\)經LLL化簡後的矩陣,矩陣\(B\)的第一列短向量\(b_1\)
從\(\displaystyle det(M)=X^{\frac{hk(hk-1)}{2}}N^{\frac{hk(h-1)}{2}}\)和引理\(\Vert\;b_1\Vert\;\le 2^{(n-1)/4}\cdot (det(L))^{1/n}\)
得知\(\Vert\;b_1\Vert\;\le 2^{\frac{hk-1}{4}}X^{\frac{hk-1}{2}}N^{\frac{h-1}{2}}\)
設整數向量\(c\),長度為\(n\),\((c\in Z^n)\)
\(b_1=cM\),其中\(\displaystyle b_{1,j}=\sum_{i=1}^{hk}c_im_{i,j}=\sum_{i=1}^{hk}c_ie_{i,j}X^{j-1}\)
\([b_{1,1},b_{1,2},\ldots,b_{1,hk}]=[c_1,c_2,\ldots,c_{hk}]\left[\matrix{m_{1,1}&m_{1,2}&\ldots&m_{1,hk}\cr
m_{2,1}&m_{2,2}&\ldots&m_{2,hk}\cr
\vdots&\vdots&&\vdots\cr
m_{hk,1}&m_{hk,2}&\ldots&m_{hk,hk}}\right]\)
\([b_{1,1},b_{1,2},\ldots,b_{1,hk}]=[c_1,c_2,\ldots,c_{hk}]\left[\matrix{e_{1,1}&e_{1,2}X&\ldots&e_{1,hk}X^{hk-1}\cr
e_{2,1}&e_{2,2}X&\ldots&e_{2,hk}X^{hk-1}\cr
\vdots&\vdots&&\vdots\cr
e_{hk,1}&e_{hk,2}X&\ldots&e_{hk,hk}X^{hk-1}}\right]\)
設向量長度\(\displaystyle \Vert\;b_1\Vert\;_2=\sqrt{\sum_{j=1}^{hk} b_{1j}^2}\),\(\displaystyle \Vert\;b_1\Vert\;_1=\sum_{j=1}^{hk} |\;b_{1j}|\;\)
https://en.wikipedia.org/wiki/Norm_(mathematics)
\(\displaystyle \Vert\;b_1\Vert\;_2\ge \frac{1}{\sqrt{hk}}\Vert\;b_1\Vert\;_1\)
   \(\displaystyle =\frac{1}{\sqrt{hk}}\left(\Bigg|\sum_{i=1}^{hk}c_i m_{i,1}\Bigg|+\Bigg|\sum_{i=1}^{hk}c_i m_{i,2}\Bigg|+\ldots+\Bigg|\sum_{i=1}^{hk}c_i m_{i,hk}\Bigg|\right)\)
   \(\displaystyle =\frac{1}{\sqrt{hk}}\left(\Bigg|\sum_{i=1}^{hk}c_i e_{i,1}\Bigg|+\Bigg|\left(\sum_{i=1}^{hk}c_i e_{i,2}\right)X\Bigg|+\ldots+\Bigg|\left(\sum_{i=1}^{hk}c_i e_{i,hk}\right)X^{hk-1}\Bigg|\right)\)
   \(\displaystyle \ge \frac{1}{\sqrt{hk}}|\;r(x)|\;\)對所有\(|\;x|\;\le X\)
其中\(\displaystyle r(x)=\sum_{i}^{hk}c_ie_{i,1}+\left(\sum_{i=1}^{hk}c_i e_{i,2}\right)x+\ldots+\left(\sum_{i=1}^{hk}c_i e_{i,hk}\right)x^{hk-1}\)
從\(\displaystyle \frac{1}{\sqrt{hk}}|\;r(x)|\;\le \Vert\;b_1\Vert\;\),\(\Vert\;b_1\Vert\;\le 2^{\frac{hk-1}{4}}X^{\frac{hk-1}{2}}N^{\frac{h-1}{2}}\)
得到\(\displaystyle |\;r(x)|\;\le \left(2^{\frac{hk-1}{4}}\sqrt{hk}\right)X^{\frac{hk-1}{2}}X^{\frac{h-1}{2}}\)
選擇\(\displaystyle X=\lceil\;\left(2^{-\frac{1}{2}}(hk)^{-\frac{1}{hk-1}}\right)N^{\frac{h-1}{hk-1}}\rceil\;-1\),\(\displaystyle X^{\frac{hk-1}{2}}<2^{-\frac{hk-1}{4}}(hk)^{-\frac{1}{2}}N^{\frac{h-1}{2}}\)
\(\displaystyle |\;r(x)|\;\le\left(2^{\frac{hk-1}{4}}\sqrt{hk}\right)\left(2^{-\frac{hk-1}{4}}(hk)^{-\frac{1}{2}}N^{\frac{h-1}{2}}\right)N^{\frac{h-1}{2}}=N^{h-1}\)
原本要解同餘方程式\(r(x)\equiv 0\pmod{N^{h-1}}\),對所有\(|\;x|\;<X\),\(|\;r(x)|\;<N^{h-1}\)
變成解一般方程式\(r(x)=0\)
LLL化簡
\(B=LLL(M)=\left[\matrix{3&8\times 2&-24\times 2^2&-8 \times 2^3&-1\times 2^4&2\times 2^5\cr
49&50\times 2&0&20\times 2^3&0&2\times 2^5\cr
115&-83\times 2&4\times 2^2&13\times 2^3&6\times 2^4&2\times 2^5\cr
61&16\times 2&37\times 2^2&-16\times 2^3&3\times 2^4&4\times 2^5\cr
21&-37\times 2&-14\times 2^2&2\times 2^3&14\times 2^4&-4\times 2^5\cr
-201&4\times 2&33\times 2^2&-4\times 2^3&-3\times 2^4&1\times 2^5} \right]\)
取第一列向量形成不需要再同餘\(N^{h-1}\)的方程式
\(\displaystyle r(x)=3+8\times 2\left(\frac{x}{2}\right)-24\times 2^2\left(\frac{x}{2}\right)^2-8\times 2^3\left(\frac{x}{2}\right)^3-1\times 2^4\left(\frac{x}{2}\right)^4+2\times 2^5\left(\frac{x}{2}\right)^5\)
  \(=3+8x-24x^2-8x^3-x^4+2x^5\)
  \(=(x-3)(2x-1)(x^3+3x^2+5x+1)\)
解方程式得到答案
\(x=3\)
-------------------
\(b_1=[\matrix{3&16&-96&-64&-16&64}]\)
\(c=[\matrix{70&46&-98&32&-57&2}]\)
\((m_{i,j})=\left[\matrix{1225&&&&&\cr
0&2450&&&&\cr
665&980&140&&&\cr
0&1330&1960&280&&\cr
361&1064&936&224&16&\cr
0&722&2128&1872&448&32}\right]\)
\((e_{i,j}X^{j-1})=\left[\matrix{1225&&&&&\cr
0&1225\times 2&&&&\cr
665&490\times 2&35\times 2^2&&&\cr
0&665\times 2&490\times 2^2&35\times 2^3&&\cr
361&532\times 2&234\times 2^2&28\times 2^3&2^4&\cr
0&361\times 2&532\times 2^2&234\times 2^3&28\times 2^4& 2^5}\right]\)


引理1:
假設lattice \(L\)經LLL化簡後向量\(b_1,b_2,\ldots,b_n\),則\(\Vert\;b_1 \Vert\;\le 2^{(n-1)/4}\cdot(det(L))^{1/n}\)。
[證明]
設\(b_i\)是LLL化簡後的向量,符合以下兩個條件
(1)(size-reduced)對\(1\le j<i\le n\),\(\displaystyle |\;\mu_{i,j}|\;\le \frac{1}{2}\)
(2)(Lovász condition)對\(i=2,3,\ldots,n\),\(\displaystyle \frac{3}{4}\Vert\;b_{i-1}^2\Vert\;\le \Vert\;b_i^*\Vert\;^2+\mu_{i,i-1}^2 \Vert\;b_{i-1}^*\Vert\;^2\)
https://en.wikipedia.org/wiki/Le ... reduction_algorithm
將(2)式移項\(\displaystyle (\frac{3}{4}-\mu_{i,i-1}^2) \Vert\;b_{i-1}^2\Vert\;^2\le \Vert\;b_i^*\Vert\;^2\)
將(1)式平方\(\mu_{i,i-1}^2\le \frac{1}{4}\)代入上式,得到對\(1<i\le n\),\(\displaystyle \frac{1}{2}\Vert\;b_{i-1}^*\Vert\;^2\le \Vert\;b_i^*\Vert\;^2\),\(\displaystyle \Vert\;b_{i-1}^*\Vert\;^2\le 2^{i-(i-1)} \Vert\;b_i^*\Vert\;^2\)
由數學歸納法得知,對\(1\le j\le i\le n\),\(\Vert\;b_j^*\Vert\;^2\le 2^{i-j}\cdot \Vert\;b_i^*\Vert\;^2\)
由Gram-Schmidt正交化可知\(\displaystyle b_i^*=b_i-\sum_{j=1}^{i-1}\mu_{ij}b_j^*\),\(\displaystyle b_i=b_i^*+\sum_{j=1}^{i-1}\mu_{ij}b_j^*\)
\(\displaystyle \Vert\;b_i\Vert\;^2=\Vert\;b_i^*\Vert\;^2+2\sum_{j=1}^{i-1}\mu_{ij}b_i^*\cdot b_j^*+\sum_{j=1}^{i-1}\mu_{ij}^2\Vert\;b_j^*\Vert\;^2\)
因為Gram-Schmidt正交化,\(b_i^*\cdot b_j^*=0\)代入上式
\(\displaystyle \Vert\;b_i\Vert\;^2=\Vert\;b_i^*\Vert\;^2+\sum_{j=1}^{i-1}\mu_{ij}^2\Vert\;b_j^*\Vert\;^2\)
  \(\displaystyle \le \Vert\;b_i^*\Vert\;^2+\sum_{j=1}^{i-1}\frac{1}{4}2^{i-j}\Vert\;b_i^*\Vert\;^2\)
  \(\displaystyle =(1+\frac{1}{4}(2^i-2))\cdot \Vert\;b_i^*\Vert\;^2\)
  \(\le 2^{i-1}\cdot \Vert\;b_i^*\Vert\;^2\)
對\(1\le j\le i\le n\),\(\Vert\;b_j\Vert\;^2\le 2^{j-1}\cdot \Vert\;b_j^*\Vert\;^2\le 2^{i-1}\cdot \Vert\;b_i^*\Vert\;^2\)
\(\Vert\;b_1\Vert\;^2\le 2^{n-1}\Vert\;b_n^*\Vert\;^2\)
\(\Vert\;b_1\Vert\;^2\le 2^{n-2}\Vert\;b_{n-1}^*\Vert\;^2\)

\(\Vert\;b_1\Vert\;^2\le 2^{0}\Vert\;b_1^*\Vert\;^2\)
將上面各式相乘\(\displaystyle \Vert\;b_1\Vert\;^{2n}\le 2^{0+1+\ldots+(n-2)+(n-1)}\prod_{i=1}^n \Vert\;b_i^*\Vert\;^2\)
\(\displaystyle \Vert\;b_1\Vert\;^{2n}\le 2^{\frac{n(n-1)}{2}}\cdot det(L)^2\)
\(\displaystyle \Vert\;b_1\Vert\;\le 2^{\frac{n-1}{4}}\cdot det(L)^{\frac{1}{n}}\)



參考資料:
N. Howgrave-Graham. Finding small roots of univariate modular equations revisited. In Cryptography and Coding– Proc. IMA ’97, volume 1355 of Lecture Notes in Computer Science, pages 131–142. Springer, 1997.
https://link.springer.com/chapter/10.1007/BFb0024458



請下載LLL.zip,解壓縮後將LLL.mac放到C:\maxima-5.45.0\share\maxima\5.45.0\share目錄下
要先載入LLL.mac才能使用LLL指令

(%i1) load("LLL.mac");
(%o1) C:/maxima-5.45.0/share/maxima/5.45.0/share/LLL.mac

同餘方程式
(%i2) px:x^2+14*x+19;
(px) \(x^2+14x+19\)

\(p(x)\equiv 0\pmod{N}\)
(%i3) N:35;
(N) 35

\(p(x)\)的次數\(k\)
(%i4) k:hipow(px,x);
(k) 2

參數\(h\ge 2\)
(%i5) h:3;
(h) 3

希望能找到\(|\;x|\;<X\),\(p(x)\equiv 0\pmod{N}\)
(%i6) X:ceiling(2^(-1/2)*(h*k)^(-1/(h*k-1))*N^((h-1)/(h*k-1)))-1;
(X) 2

產生\(q_{u,v}(x)\)方程組
(%i7)
q_uv:create_list((v:floor((i-1)/k),
                             u: (i-1)-k*v,
                             N^(h-1-v)*x^u*px^v),i,1,h*k);

(q_uv) \([1225,1225x,35(x^2+14x+19),35x(x^2+14x+19),(x^2+14x+19)^2,x(x^2+14x+19)^2]\)

用\(Xx\)取代原本的\(x\)
(%i8) q_uv:ev(q_uv,x=x*X);
(q_uv) \([1225,2450x,35(4x^2+28x+19),70x(4x^2+28x+19),(4x^2+28x+19)^2,2x(4x^2+28x+19)^2]\)

\(x^1,x^2,\ldots,x^{hk-1}\)
(%i9) xpower:create_list(x^i,i,1,h*k-1);
(xpower) \([x,x^2,x^3,x^4,x^5]\)

取多項式\(q_{u,v}(x)\)係數(常數項在最後一行)
(%i10) M:augcoefmatrix(q_uv,xpower);
(M) \(\left[\matrix{0&0&0&0&0&1225\cr
2450&0&0&0&0&0\cr
980&140&0&0&0&665\cr
1330&1960&280&0&0&0\cr
1064&936&224&16&0&361\cr
722&2128&1872&448&32&0}\right]\)

將常數項移到第一行
(%i11) M:addcol(col(M,h*k),submatrix(M,h*k));
(M) \(\left[\matrix{1225&0&0&0&0&0\cr
0&2450&0&0&0&0\cr
665&980&140&0&0&0\cr
0&1330&1960&280&0&0\cr
361&1064&936&224&16&0\cr
0&722&2128&1872&448&32}\right]\)

LLL化簡
(%i12) B: LLL(M);
(B) \(\left[\matrix{3&16&-96&-64&-16&64\cr
49&100&0&160&0&64\cr
115&-166&16&104&96&64\cr
61&32&148&-128&48&128\cr
21&-74&-56&16&224&-128\cr
-201&8&132&-32&-48&32}\right]\)

第一列短向量\(b_1\)
(%i13) B[1];
(%o13) \([3,16,-96,-64,-16,64]\)

產生的方程式不需要再同餘\(N^{h-1}\)
(%i14) rx:sum(B[1][i+1]*(x/X)^i,i,0,h*k-1);
(rx) \(2x^5-x^4-8x^3-24x^2+8x+3\)

將\(r(x)\)因式分解
(%i15) factor(rx);
(%o15) \((x-3)(2x-1)(x^3+3x^2+5x+1)\)

得到\(r(x)\)的解
(%i16) x:3;
(x) 3

驗證答案
(%i17) ev(mod(px,N),x=3);
(%o17) 0

--------------------------------
解三次同餘方程式\(p(x)=x^3-4x^2-3x-10\pmod{1131}\)。

參考資料
Finding Small Roots of Polynomial Equations Using Lattice Basis Reduction
https://ntnuopen.ntnu.no/ntnu-xm ... e=1&isAllowed=y



請下載LLL.zip,解壓縮後將LLL.mac放到C:\maxima-5.45.0\share\maxima\5.45.0\share目錄下
要先載入LLL.mac才能使用LLL指令

(%i1) load("LLL.mac");
(%o1) C:/maxima-5.45.0/share/maxima/5.45.0/share/LLL.mac

同餘方程式
(%i2) px:x^3-4*x^2-3*x-10;
(px) \(x^3-4x^2-3x-10\)

\(p(x)\equiv 0\pmod{N}\)
(%i3) N:1131;
(N) 1131

\(p(x)\)的次數\(k\)
(%i4) k:hipow(px,x);
(k) 3

參數\(h\ge 2\)
(%i5) h:3;
(h) 3

希望能找到\(|\;x|\;<X\),\(p(x)\equiv 0\pmod{N}\)
按照公式應該是3,本範例\(X=6\)

(%i7)
X:ceiling(2^(-1/2)*(h*k)^(-1/(h*k-1))*N^((h-1)/(h*k-1)))-1;
X:6;

(X) 3
(X) 6

產生\(q_{u,v}(x)\)方程組
(%i8)
q_uv:create_list((v:floor((i-1)/k),
                             u: (i-1)-k*v,
                             N^(h-1-v)*x^u*px^v),i,1,h*k);

(q_uv) \([1279161,1279161x,1279161x^2,1131(x^3-4x^2-3x-10),1131x(x^3-4x^2-3x-10),1131x^2(x^3-4x^2-3x-10),\)
    \((x^3-4x^2-3x-10)^2,x(x^3-4x^2-3x-10)^2,x^2(x^3-4x^2-3x-10)^2]\)

用\(Xx\)取代原本的\(x\)
(%i8) q_uv:ev(q_uv,x=x*X);
(q_uv) \([1279161,7674966x,46049796x^2,1131(216x^3-144x^2-18x-10),6786x(216x^3-144x^2-18x-10),\)
   \(40716x^2(216x^3-144x^2-18x-10),(216x^3-144x^2-18x-10)^2,6x(216x^3-144x^2-18x-10)^2,36x^2(216x^3-144x^2-18x-10)^2]\)

\(x^1,x^2,\ldots,x^{hk-1}\)
(%i9) xpower:create_list(x^i,i,1,h*k-1);
(xpower) \([x,x^2,x^3,x^4,x^5,x^6,x^7,x^8]\)

取多項式\(q_{u,v}(x)\)係數(常數項在最後一行)
(%i11) M:augcoefmatrix(q_uv,xpower);
(M) \(\left[\matrix{0&0&0&0&0&0&0&0&1279161\cr
7674966&0&0&0&0&0&0&0&0\cr
0&46049796&0&0&0&0&0&0&0\cr
-20358&-162864&244296&0&0&0&0&0&-11310\cr
-67860&-122148&-977184&1465776&0&0&0&0&0\cr
0&-407160&-732888&-5863104&8794656&0&0&0&0\cr
360&3204&864&12960&-62208&46656&0&0&100\cr
600&2160&19224&5184&77760&-373248&279936&0&0\cr
0&3600&12960&115344&31104&466560&-2239488&1679616&0}\right]\)

將常數項移到第一行
(%i12) M:addcol(col(M,h*k),submatrix(M,h*k));
(M) \(\left[\matrix{1279161&0&0&0&0&0&0&0&0\cr
0&7674966&0&0&0&0&0&0&0\cr
0&0&46049796&0&0&0&0&0&0\cr
-11310&-20358&-162864&244296&0&0&0&0&0\cr
0&-67860&-122148&-977184&1465776&0&0&0&0\cr
0&0&-407160&-732888&-5863104&8794656&0&0&0\cr
100&360&3204&864&12960&-62208&46656&0&0\cr
0&600&2160&19224&5184&77760&-373248&279936&0\cr
0&0&3600&12960&115344&31104&466560&-2239488&1679616}\right]\)

LLL化簡
(%i12) B: LLL(M);
(M) \(\left[\matrix{
100&360&3204&864&12960&-62208&46656&0&0\cr
-11310&-20358&-162864&244296&0&0&0&0&0\cr
400&2040&14976&22680&57024&-171072&-186624&279936&0\cr
1279161&0&0&0&0&0&0&0&0\cr
-22920&-109656&-457488&-491184&1426896&186624&-139968&0&0\cr
1400&8040&59256&121176&322704&-451008&-746496&-839808&1679616\cr
-53360&-196668&-1128060&-794880&-859248&972000&1632960&1959552&1679616\cr
-22620&7634250&-325728&488592&0&0&0&0&0\cr
-267849&3713268&20770668&14244552&11153376&9020160&7231680&5598720&5038848}\right]\)

第一列短向量\(b_1\)
(%i14) B[1];
(%o14) \([100,360,3204,864,12960,-62208,46656,0,0]\)

產生的方程式不需要再同餘\(N^{h-1}\)
(%i15) rx:sum(B[1][i+1]*(x/X)^i,i,0,h*k-1);
(rx) \(x^6-8x^5+10x^4+4x^3+89x^2+60x+100\)

將\(r(x)\)因式分解
(%i16) factor(rx);
(%o16) \((x-5)^2(x^2+x+2)^2\)

得到\(r(x)\)的解
(%i17) x:5;
(x) 5

驗證答案
(%i18) ev(mod(px,N),x=5);
(%o18) 0
作者: bugmens    時間: 2021-7-11 21:42

將Coppersmith和Howgrave-Graham方法寫成副程式,放入LLL.zip,提供將來範例直接使用。

111.3.6補充
發現ceiling指令在處理超大浮點數會出現錯誤,改用bigfloat numbers。

修正前修正後
h:3$
k:3$
N:10^150$
X:ceiling(2^(-1/2)*(h*k)^(-1/(h*k-1))*N^((h-1)/(h*k-1)))-1;
16990442448471225139289591175253590015錯誤
h:3$
k:3$
N:10^150$
fpprec:100$/*設定小數點以下100為有效位數*/
X:ceiling(bfloat(2^(-1/2)*(h*k)^(-1/(h*k-1))*N^((h-1)/(h*k-1))))-1;
16990442448471225207917914988908164235正確




請下載LLL.zip,解壓縮後將LLL.mac放到C:\maxima-5.45.0\share\maxima\5.45.0\share目錄下
要先載入LLL.mac才能使用Coppersmith_Howgrave指令

(%i1) load("LLL.mac");
(%o1) C:/maxima-5.45.0/share/maxima/5.45.0/share/LLL.mac

Coppersmith_Howgrave方法副程式
(%i2)
Coppersmith_Howgrave(px,N,h):=block
([ak,inv_ak,k,X,q_uv,M,B,i,rx,x],
px:expand(px),/*先expand()確保coeff()取得到係數,例子3(x^2+x+1),x^2係數為0*/
if (ak:coeff(px,x,hipow(px,x)))#1 then
  (print("p(x)不是monic多項式,同乘",ak^"-1","≡",inv_ak:inv_mod(ak,N),"mod(",N,")"),
   print("p(x)變成monic多項式,",inv_ak,"(",px,")=",px:polymod(inv_ak*px,N),"(mod",N,")")
  ),
if h<2 then (print("參數h要≥2"),return([])),
fpprec:100,/*設定小數點以下100為有效位數*/
print("參數h=",h),
print("p(x)最高次方k=",k:hipow(px,x)),
print("X=ceiling(",2^(-1/2),"(hk)"^"-1/(hk-1)","N"^"(h-1)/(hk-1)",")=ceiling(",
        2^(-1/2),h*k,""^("-1"/(h*k-1)),N^((h-1)/(h*k-1)),")=",X:ceiling(bfloat(2^(-1/2)*(h*k)^(-1/(h*k-1))*N^((h-1)/(h*k-1))))-1),
print("q_uv=N"^"h-1-v","x"^"u","p(x)"^"v","=",q_uv:create_list((v:floor((i-1)/k),u: (i-1)-k*v,N^(h-1-v)*x^u*px^v),i,1,h*k)),
print("用",X,"x取代x,得到q_uv=",q_uv:ev(q_uv,x=x*X)),
M:augcoefmatrix(q_uv,create_list(x^i,i,1,h*k-1)),
print("產生矩陣M=",M:addcol(col(M,h*k),submatrix(M,h*k))),
print("LLL化簡B=",B: LLL(M)),
print("產生不需要同餘N"^(h-1),"的方程式"),
printList:["r(x)=",B[1][1]],
for i:2 thru h*k do
  (if B[1][ i ]>=0 then printList:append(printList,["+"]),
   printList:append(printList,[B[1][ i ],"(",x/X,")"^(i-1)])
  ),
apply(print,printList),/*再用apply(print,)將全部內容印在同一行*/
print("r(x)=",rx:sum(B[1][i+1]*(x/X)^i,i,0,h*k-1),"=",factor(rx)),
print("整數解為",x:sublist(solve(rx,x),lambda([x],integerp(rhs(x))))),
return(x)
)$


二次同餘方程式
(%i5)
px:x^2+14*x+19;
N:35;
h:3;

(px) \(x^2+14x+19\)
(N) 35
(h) 3


(%i6) solution:Coppersmith_Howgrave(px,N,h);
參數\(h=3\)
\(p(x)\)最高次方\(k=2\)
\(\displaystyle X=ceiling(\frac{1}{\sqrt{2}}(hk)^{-1/(hk-1)}N^{(h-1)/(hk-1)})=ceiling(\frac{1}{\sqrt{2}}6^{-1/5}35^{2/5})=2\)
\(q_{uv}=N^{h-1-v}x^{u}p(x)^{v}=[1225,1225x,35(x^2+14x+19),35x(x^2+14x+19),(x^2+14x+19)^2,x(x^2+14x+19)^2]\)
用\(2x\)取代\(x\),得到\(q_{uv}=[1225,2450x,35(4x^2+28x+19),70x(4x^2+28x+19),(4x^2+28x+19)^2,2x(4x^2+28x+19)^2]\)
產生矩陣\(M=\left[\matrix{1225&0&0&0&0&0\cr
0&2450&0&0&0&0\cr
665&980&140&0&0&0\cr
0&1330&1960&280&0&0\cr
361&1064&936&224&16&0\cr
0&722&2128&1872&448&32}\right]\)
LLL化簡\(B=\left[\matrix{3&16&-96&-64&-16&64\cr
49&100&0&160&0&64\cr
115&-166&16&104&96&64\cr
61&32&148&-128&48&128\cr
21&-74&-56&16&224&-128\cr
-201&8&132&-32&-48&32}\right]\)
產生不需要同餘\(N^2\)的方程式
\(\displaystyle r(x)= 3 + 16\left(\frac{x}{2}\right)-96\left(\frac{x}{2}\right)^2 -64\left(\frac{x}{2}\right)^3-16\left(\frac{x}{2}\right)^4 + 64\left(\frac{x}{2}\right)^5 \)
\(r(x)=2x^5-x^4-8x^3-24x^2+8x+3=(x-3)(2x-1)(x^3+3x^2+5x+1)\)
整數解為\([x=3]\)
(solution) \([x=3]\)

驗證答案
(%i7) ev(mod(px,N),solution);
(%o7) 0

三次同餘方程式
(%i10)
px:x^3-4*x^2-3*x-10;
N:1131;
h:3;

(px) \(x^3-4x^2-3x-10\)
(N) 1131
(h) 3


(%i11) solution:Coppersmith_Howgrave(px,N,h);
參數\(h=3\)
\(p(x)\)最高次方\(k=3\)
\(\displaystyle X=ceiling(\frac{1}{\sqrt{2}}(hk)^{-1/(hk-1)} N^{(h-1)/(hk-1)})=ceiling(\frac{1}{\sqrt{2}} 9 ^{-1/8} 1131^{1/4})=3\)
\(q_{uv}=N^{h-1-v} x^u p(x)^v =[1279161,1279161x,1279161x^2,1131(x^3-4x^2-3x-10),\)
\(1131x(x^3-4x^2-3x-10),1131x^2(x^3-4x^2-3x-10),(x^3-4x^2-3x-10)^2,x(x^3-4x^2-3x-10)^2,x^2(x^3-4x^2-3x-10)^2]\)
用\(3x\)取代\(x\)得到\(q_{uv}=1279161,3837483x,11512449x^2,1131(27x^3-36x^2-9x-10),\)
\(3393x(27x^3-36x^2-9x-10),10179x^2(27x^3-36x^2-9x-10),(27x^3-36x^2-9x-10)^2,3x(27x^3-36x^2-9x-10)^2,9x^2(27x^3-36x^2-9x-10)^2]\)
產生矩陣\(M=\left[\matrix{1279161&0&0&0&0&0&0&0&0\cr
0&3837483&0&0&0&0&0&0&0\cr
0&0&11512449&0&0&0&0&0&0\cr
-11310&-10179&-40716&30537&0&0&0&0&0\cr
0&-33930&-30537&-122148&91611&0&0&0&0\cr
0&0&-101790&-91611&-366444&274833&0&0&0\cr
100&180&801&108&810&-1944&729&0&0\cr
0&300&540&2403&324&2430&-5832&2187&0\cr
0&0&900&1620&7209&972&7290&-17496&6561}\right]\)
LLL化簡\(B=\left[\matrix{100&180&801&108&810&-1944&729&0&0\cr
100&480&1341&2511&1134&486&-5103&2187&0\cr
0&300&1440&4023&7533&3402&1458&-15309&6561\cr
-10710&-9099&-35910&31185&4860&-11664&4374&0&0\cr
-1020&-3108&-13203&-21114&-43335&-39609&-37908&-15309&39366\cr
-10410&-40689&-60804&-76221&100845&-2916&-28431&13122&0\cr
1542&18561&31473&86157&29808&100602&181521&269001&426465\cr
1222511&-52875&-208521&136539&-9963&-13608&26973&4374&-6561\cr
-225150&3376488&-1106784&-423009&379647&-50787&-80190&54675&59049}\right]\)
產生不需要同餘\(N^2\)的方程式
\(\displaystyle r(x)=100 + 180\left(\frac{x}{3}\right)+801\left(\frac{x}{3}\right)^2+108\left(\frac{x}{3}\right)^3+810\left(\frac{x}{3}\right)^4-1944\left(\frac{x}{3}\right)^5+729\left(\frac{x}{3}\right)^6+0\left(\frac{x}{3}\right)^7+0\left(\frac{x}{3}\right)^8\)
\(r(x)=x^6-8x^5+10x^4+4x^3+89x^2+60x+100=(x-5)^2(x^2+x+2)^2\)
整數解為\([x=5]\)
(solution) \([x=5]\)

驗證答案
(%i12) ev(mod(px,N),solution);
(%o12) 0
作者: bugmens    時間: 2022-2-22 23:51

1-1.刻板訊息(Stereotyped Messages)

銀行要傳送底下的訊息給客戶
Your pin no is ****,其中****為四位數密碼
將明文按英文字母轉換成數字(空白\(=00,A=01,B=02,...,Z=26\),不分大小寫)
設明文\(M=B+x\),其中\(B=25152118001609140014150009190000\),密碼\(0\le x <10000\)
採用RSA方案將明文加密,其中公鑰\(e=3\),\(N=54957464841358314276864542898551\)
得到密文\(C\equiv M^e \equiv (B+x)^3\equiv 37393323096087665763922106857101 \pmod{N}\)要如何找出密碼\(x\)呢?

參考資料:
Cryptanalytic Attacks on RSA,https://books.google.com.tw/book ... e&q&f=false


請下載LLL.zip,解壓縮後將LLL.mac放到C:\maxima-5.45.1\share\maxima\5.45.1\share目錄下
要先載入LLL.mac才能使用Coppersmith_Howgrave指令

(%i1) load("LLL.mac");
(%o1) C:/maxima-5.45.1/share/maxima/5.45.1/share/LLL.mac

明文訊息
(%i2) m:"Your pin no is";
(m) Your pin no is

這個範例不區分大小寫,統一轉成大寫字母
(%i3) m:supcase(m);
(m) YOUR PIN NO IS

明文訊息轉成list
(%i4) mlist:charlist(m);
(mlist) [Y,O,U,R, ,P,I,N, ,N,O, ,I,S]

明文轉成數字B
(%i5) B:0;
(B) 0

將明文訊息按照字母順序轉換成數字(空白=00,A=01,B=02,...,Z=26)
(%i7)
for i:1 thru length(mlist) do
  (if mlist[ i ]=" " then
     (B:B*100+0)/*空白就補上00*/
   else/*其他就乘100倍再加上英文字母的順序*/
     (B:B*100+cint(mlist[ i ])-cint("A")+1)
  )$
B;

(%o7) 2515211800160914001415000919

最後四位數為密碼x
(%i8) B:B*10000;
(B) 25152118001609140014150009190000

公鑰e
(%i9) e:3;
(e) 3

公鑰N
(%i10) N:54957464841358314276864542898551;
(N) 54957464841358314276864542898551

密文C
(%i11) C:37393323096087665763922106857101;
(C) 37393323096087665763922106857101

明文M,其中x為四位數密碼
(%i12) M:B+x;
(M) \(x+25152118001609140014150009190000\)

產生方程式p(x)≡(B+x)^e-C(mod N)
(%i13) px:M^e-C;
(px) \((x+25152118001609140014150009190000)^3-37393323096087665763922106857101\)

方程式p(x)同餘N
(%i14) px:polymod(px,N);
(px) \(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263\)

參數h
(%i15) h:3;
(h) 3

呼叫Coppersmith_Howgrave副程式,找符合p(x)≡0(mod N)的較小的解x
(%i16) x:Coppersmith_Howgrave(px,N,h);
參數\(h=3\)
\(p(x)\)最高次方\(k=3\)
\(\displaystyle X=ceiling(\frac{1}{\sqrt{2}}(hk)^{-1/(hk-1)}N^{(h-1)/(hk-1)})\)
\(=ceiling(\frac{1}{\sqrt{2}}9^{-1/8}54957464841358314276864542898551^{1/4})=46260610\)
\(q_{uv}=N^{h-1-v}x^u p(x)^v=\)
\([3020322941789135243826751301254310584993059920451586964677899601,\)
\(3020322941789135243826751301254310584993059920451586964677899601x,\)
\(3020322941789135243826751301254310584993059920451586964677899601x^2,\)
\(54957464841358314276864542898551(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263),\)
\(54957464841358314276864542898551x(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263),\)
\(54957464841358314276864542898551x^2(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263),\)
\((x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263)^2,\)
\(x(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263)^2,\)
\(x^2(x^3+20498889163469105765585484671449x^2-23112443404493616937655279863053x+18283973072868139826273442498263)^2]\)

用\(46260610x\)取代\(x\),得到\(q_{uv}=\)
\([3020322941789135243826751301254310584993059920451586964677899601,\)
\(139721981684159887751924249514318172791235797686641888454048089061016610x,\)
\(6463624103118063744935544456324562407407970654820642611436221569296955598732100x^2,\)
\(54957464841358314276864542898551(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263),\)
\(2542365847614788847019462641858137376110x(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263),\)
\(117611394953827177084317023684568968482648027100x^2(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263),\)
\((98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263)^2,\)
\(46260610x(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263)^2,\)
\(2140044037572100x^2(98999742604948264981000x^3+43868525531133392517784211693380792380148972900x^2-1069195730482351460642265216185548242330x+18283973072868139826273442498263)^2]\)

產生矩陣\(M=\left[\matrix{
3020322941789135243826751301254310584993059920451586964677899601&0&0&0&0&0&0&0&0\cr
0&139721981684159887751924249514318172791235797686641888454048089061016610&0&0&0&0&0&0&0\cr
0&0&6463624103118063744935544456324562407407970654820642611436221569296955598732100&0&0&0&0&0&0\cr
1004840807312492934121310085993087816338401741664749320802716913&-58760286766514250464246726367461673333231803685743085020341021553863830&2410902949519492989179980080581154246553453535301351223201730247704151548267900&5440774873514967046498526949032608069078072148942531000&0&0&0&0&0\cr
0&46484548699168383753141618577192698167382430994473719077419374052696930&-2718286709593876800168836752261861160016036509902723416322838065104888632736300&111529841095570952570189278315533349949653158149697041409558194314245150155317497419000&251693564521475219700920220763687359166473755234092339003910000&0&0&0&0\cr
0&0&2150403578398235925134420691768266304768993361087260873490057469495932126927300&-125749601340705593040658491150052576997649458730371025900378445822971862132447207143000&5159438482284180564178023830336345244014424384431456450801421899475512335726582174276365590000&11643497827837801763248586973862843084330167466119804398647668985100000&0&0&0\cr
334303671329367207597382428251924280469672863044332310758017169&-39098291891529790146672600165213743993545305783624348258638047456145580&2747361389197032065525895040706053126300958522505044634704406065907531371974300&-93808080400887705413187047147355847439306195234682022660264660430139194466387149708000&1924447532275702298105139918003157179495823605879799776741463766795883123756267581643242950000&8685945472081614468358429342848175207711673102374196684328376029800000&9800949035846008678895673107522190930361000000&0&0\cr
0&15465091760936037937451545534215250888338153144877269738375436628413090&-1808710832860221925357063953928888577525241908186990361297033844530242779603800&127094613754702113540787875379036848315089384835782092878652994296582604861668022323000&-4339619022274109793914334845135441389609242568335483524297665952941101520923694041653401880000&89026116756068676488745616742176033049356292460399124349923926144875298793670429650041221245199500000&401817135965233455091086640042055722495618701836422786877008115447926178000000&453397880977148227551007964314572140974967380210000000&0\cr
0&0&715424578566875285969650341855573377397564850755440873231788107446732875384900&-83672066441721911002392246317762282218349981070294168177721176838614194432567346318000&5879474360006910140686106995638225815533507147028029443643143494486432216289728330155597030000&-200753423138003906273451417680221051302571222849166152478959848559286650429857849820251779543946800000&4118402467066958176262030365319276016243382196556464335893334277056879696127458214572993419947888441695000000&18588305818204638424921273531195923376638043474361038338830390395571488229248580000000&20974462546710273066928434544050339130507985738616528100000000}\right]\)

LLL化簡\(B=\left[\matrix{
1346829011992131838415424923205840084705445702496636688958&-45179677717016066583753308148255943279532835707102039947418400&-57317453167676354735698331555650210546427932428564618523281700&55022492206313287028619713807534065142711418176206799219594000&-9126018929197534844882170642391266050994818115932677074230000&-74312694674165829957248058752411116787238498594388701682800000&-19823407733951640707057856074266278764703362315244543316000000&138583699736138999822205248506077392755142831146437181570000000&20974462546710273066928434544050339130507985738616528100000000\cr
-5902801572552400483890393706301403464838435984190741057521&198017000397961977217885428384176729067567197716265205355728090&42767563064370999055058464552273491314630668309914422404759500&-118669599523559088891420124095064243299234055073696904508477000&5351963749137648019221242354483616465414282780748646299580000&-112004086186351949887374756082813158190757018854244406606700000&-81397469992098637889082971258651279103671999211513531483000000&-10896835906406582990864300928074561497704329125231160360000000&0\cr
3508846630479685748619833227116965930963020713923238512016&-117708907048737798457372393976462193778029056413142461742828970&-19527888444159534716576393306673687254846408168280511459649900&27139572631435639962886919071578980327487934016822772654740000&152842267767879348291763951826981942119544813261287552570070000&-27976405711844657161410593106590342431253966526607082103400000&113524558112017051054823008390937950572260639715265074131000000&-73696712976382536265834206929658681977733154502070358350000000&-20974462546710273066928434544050339130507985738616528100000000\cr
-698639478405741507601710852229901400525255812179741745660&23434582306738882194913520923528306099741489318995435888835520&77832343453161261306864164010036521096392268014746035430400000&-19810469901945597112216075834712042329629980808126434227417000&11981172299793958495319504252438495583021639688484388874570000&123052851048114992637170087912139575579626631163057082528500000&-77828623800639953659282136255768504523687584641815030167000000&45046935686004396852036235081258646064208160740318079740000000&83897850186841092267713738176201356522031942954466112400000000\cr
2608388682960311335109469583103966794580680761470012241110&-87504293274733197882640504831875268439796045643230655421800670&67355084330066865588347641681926665747584588920990302572315700&49518826646218754489406268633116221438926982129998391470769000&-76798282830980653021742983335907095096227676638334916897480000&8588117181290281381087324090049898257206127303677712526400000&128047976903282825900283462166286459364396690101948932088000000&88906907910860169021868087433507208597965866101930374390000000&-41948925093420546133856869088100678261015971477233056200000000\cr
-1995198218937024623232349557084188775094976064244671057536&66932114210862830110104110182574512142599015426308136347603390&-7269506494572805968382600910891268087690791621484198916104800&8746942221093256881071752182172494956975331200299995572349000&135289672986284673880862945002578814813571416764191759148860000&57336532483012033414667813522314757646899794385904686577900000&98003299188098351389493461699129078727854830331097773587000000&76794339087563318362316609668062911023749796992816963810000000&-20974462546710273066928434544050339130507985738616528100000000\cr
1080486934579740147709503727342917433192987867804798211748&-36248047630075260993070370343206373336745272044257160933612290&50432291648410244801921487663386649765799516063041448619617700&-110728984816423069966245765896893991877601482453715569174801000&47751944909992951034160485499982734778235628595949271138960000&92499399504781570519595347939458299088542884224606869328000000&-23368916165677269442994314666846991564283577282956230451000000&47762871511471852576044187070952438440777872791839177960000000&-83897850186841092267713738176201356522031942954466112400000000\cr
-1351209723281976538802605297703889071606362629555587092791&45325239305457343576462953756357480589591441740795953594944820&104141687489491357694257317408495876883875779940487417687370100&56013394445295195456052555118633049318801173303376655543288000&43928806144132011144005796648574152800734722604776425309230000&-52583333463842986422341946819648968524622281916459256843100000&-190189161265649279450477135329996455520381986431990693226000000&28230740167810844364671917022661043622253814284451493460000000&-41948925093420546133856869088100678261015971477233056200000000\cr
3020322941789135243826751301254310584993059920451586964677899601&0&0&0&0&0&0&0&0}\right]\)

產生不需要同餘\(N^2\)的方程式
\(r(x)= 1346829011992131838415424923205840084705445702496636688958\)
\(\displaystyle -45179677717016066583753308148255943279532835707102039947418400\left(\frac{x}{46260610}\right)\)
\(\displaystyle -57317453167676354735698331555650210546427932428564618523281700\left(\frac{x}{46260610}\right)^2\)
\(\displaystyle +55022492206313287028619713807534065142711418176206799219594000\left(\frac{x}{46260610}\right)^3\)
\(\displaystyle -9126018929197534844882170642391266050994818115932677074230000\left(\frac{x}{46260610}\right)^4\)
\(\displaystyle -74312694674165829957248058752411116787238498594388701682800000\left(\frac{x}{46260610}\right)^5\)
\(\displaystyle -19823407733951640707057856074266278764703362315244543316000000\left(\frac{x}{46260610}\right)^6\)
\(\displaystyle +138583699736138999822205248506077392755142831146437181570000000\left(\frac{x}{46260610}\right)^7\)
\(\displaystyle +20974462546710273066928434544050339130507985738616528100000000\left(\frac{x}{46260610}\right)^8 \)

\(r(x)= x^8+305655817x^7-2022600838087156x^6-350756908723576394560428x^5\)
\(-1992672579437965292192928201903x^4+555784194569846483233547842537557231074x^3\)
\(-26783305465388245970449493154965416028246066377x^2\)
\(-976633851499495285162761756670652273706136510242775440x\)
\(+1346829011992131838415424923205840084705445702496636688958\)

\(=(x-1379)(x^7+305657196x^6-2022179336813872x^5-350759697308881860889916x^4\)
\(-1993156277060554240279095396067x^3+555781446007340416729250497665006054681x^2\)
\(-26782539042774201848014823518529135984896661278x-976670784620835270787110169112284325384659682738677802)\)
整數解為\([x=1379]\)
(x) \([x=1379]\)

驗算答案
(%i17) mod((B+rhs(x[1]))^e-C,N);
(%o17) 0
作者: bugmens    時間: 2022-3-8 14:53

1-2.刻板訊息(Stereotyped Messages)
當大部分訊息是固定的或刻板的,假設明文\(m\)包含兩個部分。
(1)已知部分\(B=2^kb\),例如"October 19, 1995.The secret key for the day is"的ASCII值。
(2)未知部分\(x\),例如"Squeamish Ossifrage",\(x\)小於\(\displaystyle N^{\frac{1}{3}}\)。

假設RSA加密方案採用公鑰\(e=3\),密文\(C=M^3=(B+x)^3\pmod{N}\),若已知\(B,C,N\),產生多項式\(p(x)=(B+x)^3-C\),找出\(x_0\)滿足\(p(x_0)=(B+x_0)^3-C \equiv 0\pmod{N}\),\(\displaystyle |\;x_0|\;<N^{\frac{1}{3}}\)

參考資料:
Coppersmith, D. Small Solutions to Polynomial Equations, and Low Exponent RSA Vulnerabilities. J. Cryptology 10, 233–260 (1997).
https://link.springer.com/article/10.1007/s001459900030
https://www.di.ens.fr/~fouque/ens-rennes/coppersmith.pdf

顯示數字的全部位數會造成版面凌亂,將太長的數字縮短顯示
功能表選取,編輯/設定/Worksheet/Maximum displayed number of digits調整為60



請下載LLL.zip,解壓縮後將LLL.mac放到C:\maxima-5.45.1\share\maxima\5.45.1\share目錄下
要先載入LLL.mac才能使用Coppersmith_Howgrave指令

(%i1) load("LLL.mac");
(%o1) C:/maxima-5.45.1/share/maxima/5.45.1/share/LLL.mac

明文訊息
(%i2) m:"October 19,1995.The secret key for the day is";
(m) \(October 19,1995.The secret key for the day is\)

明文訊息轉成list
(%i3) mlist:charlist(m);
(mlist) \([O,c,t,o,b,e,r, ,1,9,,,1,9,9,5,.,T,h,e, ,s,e,c,r,e,t, ,k,e,y, ,f,o,r, ,t,h,e, ,d,a,y, ,i,s]\)

明文轉成數字B
(%i4) B:0;
(B) \(0\)

將明文訊息按照ASCII轉換成數字
(%i6)
for i:1 thru length(mlist) do
  (B:B*1000+cint(mlist[ i ])
  )$
B;

(%o6) \(79099116111098101114[94 digits]32100097121032105115\)

密碼x長度19(通常要猜測很多次,為了簡化過程設為已知)
(%i7) length:19;
(length) \(19\)

最後19位000為密碼x
(%i8) B:B*1000^length;
(B) \(79099116111098101114[151 digits]00000000000000000000\)

公鑰e
(%i9) e:3;
(e) \(3\)

使用RSA-230作為此次的公鑰N,因為密碼x小於上界X
https://en.wikipedia.org/wiki/RSA_numbers#RSA-230

(%i10)
N:17969491597941066732916128449573246156367561808012600070888918835531726460341490933493372247868650755230855864199929221814436684722874052065257937495694348389263171152522525654410980819170611742509702440718010364831638288518852689;
(N) \(17969491597941066732[190 digits]64831638288518852689\)

密文C
(%i11)
C:3601065602437181695470302568875441014033597674933932563017313054187328842620219291572818766268178751411814560562534443426266396400495371407624162345901468773333852250822392143444872355448117811583996009775475129299419544905929790;
(C) \(36010656024371816954[189 digits]29299419544905929790\)

明文M,其中x為19位密碼
(%i12) M:B+x;
(M) \(x+79099116111098101114[151 digits]00000000000000000000\)

產生方程式p(x)≡(B+x)^e-C(mod N)
(%i13) px:M^e-C;
(px) \((x+79099116111098101114[151 digits]00000000000000000000)^3\)
   \(-36010656024371816954[189 digits]29299419544905929790\)

方程式p(x)同餘N
(%i14) px:polymod(px,N);
(px) \(x^3\)
   \(+23729734833329430334[152 digits]00000000000000000000x^2\)
   \(+57518597415676200644[189 digits]30736530413029557356x\)
   \(-78610106704918417037[189 digits]64951518554580927445\)

參數h
(%i15) h:3;
(h) \(3\)

呼叫Coppersmith_Howgrave副程式,找符合p(x)≡0(mod N)的較小的解x
執行時間需1965秒(32分鐘)

(%i18)
showtime:true$
x:Coppersmith_Howgrave(px,N,h);
showtime:false$

Evaluation took 0.0000 seconds (0.0000 elapsed) using 0 bytes.
參數\(h=3\)
\(p(x)\)最高次方\(k=3\)
\(\displaystyle X=ceiling(\frac{1}{\sqrt{2}} {{(hk)}^{-1/(hk-1)}} {{N}^{(h-1)/(hk-1)}} )\)
\(\displaystyle =ceiling(\frac{1}{\sqrt{2}} 9^{\frac{-1}{8}} 17969491597941066732[190 digits]64831638288518852689^{\frac{1}{4}})\)
\(=1106212689453879191977235208036134814768946283886104135857\)

\(q_{uv}=N^{h−1−v}x^u p(x)^v=\)
\([32290262828847459190[419digits]60277520976882530721,\)
\(32290262828847459190[419digits]60277520976882530721x,\)
\(32290262828847459190[419digits]60277520976882530721x^2,\)
\(17969491597941066732[190digits]64831638288518852689(x^3+23729734833329430334[152digits]00000000000000000000x^2+57518597415676200644[189digits]30736530413029557356x−78610106704918417037[189digits]64951518554580927445),\)
\(17969491597941066732[190digits]64831638288518852689x(x^3+23729734833329430334[152digits]00000000000000000000x^2+57518597415676200644[189digits]30736530413029557356x−78610106704918417037[189digits]64951518554580927445),\)
\(17969491597941066732[190digits]64831638288518852689x^2(x^3+23729734833329430334[152digits]00000000000000000000x^2+57518597415676200644[189digits]30736530413029557356x−78610106704918417037[189digits]64951518554580927445),\)
\((x^3+23729734833329430334[152digits]00000000000000000000x^2+57518597415676200644[189digits]30736530413029557356x−78610106704918417037[189digits]64951518554580927445)^2,\)
\(x(x^3+23729734833329430334[152digits]00000000000000000000x^2+57518597415676200644[189digits]30736530413029557356x−78610106704918417037[189digits]64951518554580927445)^2,\)
\(x^2(x^3+23729734833329430334[152digits]00000000000000000000x^2+57518597415676200644[189digits]30736530413029557356x−78610106704918417037[189digits]64951518554580927445)^2]\)

用\(1106212689453879191977235208036134814768946283886104135857x\)取代\(x\),得到\(q_{uv}=\)
\([32290262828847459190[419digits]60277520976882530721,\)
\(35719898487071973003[476digits]68945401330960162897x,\)
\(39513804972403437655[533digits]07174654938138697729x^2,\)
\(17969491597941066732[190digits]64831638288518852689(13536796742957524728[132digits]22453052799644267793x^3+29038231098365304034[266digits]00000000000000000000x^2+63627802340810115187[246digits]11462962337597714092x−78610106704918417037[189digits]64951518554580927445),\)
\(19878079628677272620[247digits]72697393439425769473x(13536796742957524728[132digits]22453052799644267793x^3+29038231098365304034[266digits]00000000000000000000x^2+63627802340810115187[246digits]11462962337597714092x−78610106704918417037[189digits]64951518554580927445),\)
\(21989383927217453979[304digits]76931392169955293361x^2(13536796742957524728[132digits]22453052799644267793x^3+29038231098365304034[266digits]00000000000000000000x^2+63627802340810115187[246digits]11462962337597714092x−78610106704918417037[189digits]64951518554580927445),\)
\((13536796742957524728[132digits]22453052799644267793x^3+29038231098365304034[266digits]00000000000000000000x2+63627802340810115187[246digits]11462962337597714092x−78610106704918417037[189digits]64951518554580927445)^2,\)
\(1106212689453879191977235208036134814768946283886104135857x(13536796742957524728[132digits]22453052799644267793x^3+29038231098365304034[266digits]00000000000000000000x^2+63627802340810115187[246digits]11462962337597714092x−78610106704918417037[189digits]64951518554580927445)^2,\)
\(12237065143087845640[75digits]14878644880713124449x^2(13536796742957524728[132digits]22453052799644267793x^3+29038231098365304034[266digits]00000000000000000000x^2+63627802340810115187[246digits]11462962337597714092x−78610106704918417037[189digits]64951518554580927445)^2]\)

產生矩陣
\(M=\left[\matrix{32290262828847459190[419 digits]60277520976882530721 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0\cr
0 & 35719898487071973003[476 digits]68945401330960162897 & 0 & 0 & 0 & 0 & 0 & 0 & 0\cr
0 & 0 & 39513804972403437655[533 digits]07174654938138697729 & 0 & 0 & 0 & 0 & 0 & 0\cr
-14125836519472822098[419 digits]94489721632952149605 & 11433592595586423031[476 digits]00952654252887393388 & 52180224974114632454[495 digits]00000000000000000000 & 24324935533561123862[361 digits]49738464971834145377 & 0 & 0 & 0 & 0 & 0\cr
0 & -15626179606991854661[476 digits]60211676569108886485 & 12647985215283616321[533 digits]86656469202955513516 & 57722427004923821310[552 digits]00000000000000000000 & 26908552357372882659[418 digits]46542924612696483089 & 0 & 0 & 0 & 0\cr
0 & 0 & -17285878168939820519[533 digits]81089654330431192645 & 13991361741171790418[590 digits]88089882508863743212 & 63853281218922005140[609 digits]00000000000000000000 & 29766582072559977503[475 digits]49821745201359022273 & 0 & 0 & 0\cr
61795488761586594662[418 digits]61228105756354228025 & -10003576662821081972[476 digits]14874260906612109880 & 40484972307212011736[532 digits]19137568143775384464 & 36952776573071059484[552 digits]95736854560233442230 & 84321886532206985153[571 digits]51737087375795677912 & 78616926430719870707[437 digits]00000000000000000000 & 18324486606014544982[303 digits]47263486203097090849 & 0 & 0\cr
0 & 68358953819071673294[475 digits]53451685880956792425 & -11066083444337370707[533 digits]78657042708931967160 & 44784990098426820113[589 digits]33285895980663125648 & 40877630355685238072[609 digits]16675173406681041110 & 93277940880617523876[628 digits]85134090008262090584 & 86967041623524387424[494 digits]00000000000000000000 & 20270779611300936552[360 digits]36453950823767472593 & 0\cr
0 & 0 & 75619542152448801923[532 digits]51332599109148483225 & -12241441928681489685[590 digits]25369415714902456120 & 49541724343946082466[646 digits]63054918145653160336 & 45219353414264099481[666 digits]97424893201642081270 & 10318524184826785550[686 digits]19237039307576470488 & 96204045008206368850[551 digits]00000000000000000000 & 22423793631144068882[417 digits]59771418125196067201}\right]\)

\(LLL\)化簡
\(B=\left[\matrix{-35743980059088545200[416 digits]80722642160047905681 & 46922824634222774487[417 digits]96446709945328871477 & 16364540563595223391[417 digits]91327750786549963386 & -97207301925654907852[417 digits]53799084107614558498 & -68006717288291680917[417 digits]14045799605521273218 & -22083850301737135483[417 digits]51281936303530818568 & 80777391656482090011[417 digits]81364384503413938164 & -18875467394270883798[417 digits]16922840533503730786 & 0\cr
-53855497698579115104[416 digits]22440422365250280904 & 74325972788911786534[417 digits]02667487696764782596 & -42360213040583351016[417 digits]52953633850159392540 & 93207789824932536615[417 digits]17899116640251965907 & 26743295137275436286[417 digits]30025365712179588699 & -19280506252185172185[417 digits]53869638507983632983 & -49522216738980310653[416 digits]09740058127199728661 & -54329652874359117291[417 digits]64740529713402819815 & 22423793631144068882[417 digits]59771418125196067201\cr
59886248145072283776[415 digits]00597316332236055074 & -13315128391293646051[417 digits]79917797014472050911 & 62558879042844919377[417 digits]09791573964335271861 & 11609344509786149688[418 digits]01042210268547527184 & -27368204832572340597[417 digits]17047835340290094121 & 17836124237718092338[417 digits]01896389102994872252 & -41032209045239051117[417 digits]16172892730225165900 & -59903924262576322974[417 digits]02209538630728871520 & -67271380893432206647[417 digits]79314254375588201603\cr
18422321777782777023[416 digits]59447344137439501243 & -21083022289790045344[417 digits]50420523383747574118 & -36876219378162584256[417 digits]55085598948970130728 & -12380026876101576575[418 digits]54404726405388353366 & 88756932911925724699[417 digits]97537235101170684352 & -14639498730317377843[418 digits]26252864402197471613 & -24797076405414559994[417 digits]60370312150796367236 & -16040594956631378629[418 digits]88876469069441734095 & 22423793631144068882[417 digits]59771418125196067201\cr
-59740829062319787233[416 digits]40688909484194485472 & 69491369706263632269[417 digits]58027265444373884189 & 12960931735222433006[418 digits]05407821747361781036 & 39543384198825880926[417 digits]32633257986499319708 & 14710427912295166891[418 digits]99414848522999747063 & -49840365686044385742[417 digits]35018273347131338824 & 20876577478866948183[417 digits]89058142685532409209 & 74627815624516244194[417 digits]75977705134307053965 & -44847587262288137765[417 digits]19542836250392134402\cr
-68384734181486838572[416 digits]00732056093284927437 & 91066074648706805896[417 digits]03099971016027027675 & -56710682936040096478[416 digits]32559138585047288553 & 72297457020480686195[417 digits]84446444836328742693 & -60533976691011414274[417 digits]31378847662774021892 & -12596396540470275328[418 digits]52090571729875618447 & -10880938062066902538[418 digits]67272557702486748080 & 21211756224520192677[418 digits]36650827112909148313 & 0\cr
-81250564085878561445[416 digits]34678304314010262958 & 10619954225570864725[418 digits]68561477549839159629 & 29714549780697273433[417 digits]69298528953401160635 & -43469171935032168882[417 digits]37163962147628359366 & -10442288961713937897[418 digits]86086266267518395545 & 49860675747404052367[416 digits]60024965193505807977 & -13253357916405795479[418 digits]68461980318400142027 & 13768422266804784107[417 digits]71514595120672325344 & 15696655541800848217[418 digits]18399926876372470407\cr
12609739358642155334[417 digits]57802314032806547340 & -17383608959896020481[418 digits]78499216381863868700 & 81673208107847127971[417 digits]29200832824127271546 & -20653954414963469692[417 digits]04471381311357994334 & -31161557914274171485[417 digits]97962853192070185042 & -84798118358121590160[417 digits]88845627108413875920 & 41678440330915146980[417 digits]79753567469752741441 & -85952558727161375791[417 digits]14248221183260863210 & 15696655541800848217[418 digits]18399926876372470407\cr
32200663351089791530[419 digits]57114456451584344136 & 12124879742313456102[418 digits]99114197642093654073 & -25995672476988127625[417 digits]61625883063609429154 & -39995121007223712365[416 digits]35899967467362592591 & -41263422151016244631[417 digits]84020433893341684519 & -41364356553922307668[417 digits]05151574811514451551 & 75825169982584058945[417 digits]71624326376214209503 & -73205120268630001090[417 digits]81663370246906550601 & 22423793631144068882[417 digits]59771418125196067201}\right]\)

產生不需要同餘\(N^2\)的方程式\(r(x)=\)
\(-35743980059088545200[416 digits]80722642160047905681\)
\(\displaystyle +46922824634222774487[417 digits]96446709945328871477( \frac{x}{1106212689453879191977235208036134814768946283886104135857})\)
\(\displaystyle +16364540563595223391[417 digits]91327750786549963386( \frac{x}{1106212689453879191977235208036134814768946283886104135857})^2\)
\(\displaystyle -97207301925654907852[417 digits]53799084107614558498( \frac{x}{1106212689453879191977235208036134814768946283886104135857})^3\)
\(\displaystyle -68006717288291680917[417 digits]14045799605521273218( \frac{x}{1106212689453879191977235208036134814768946283886104135857})^4\)
\(\displaystyle -22083850301737135483[417 digits]51281936303530818568( \frac{x}{1106212689453879191977235208036134814768946283886104135857})^5\)
\(\displaystyle +80777391656482090011[417 digits]81364384503413938164( \frac{x}{1106212689453879191977235208036134814768946283886104135857})^6\)
\(\displaystyle -18875467394270883798[417 digits]16922840533503730786( \frac{x}{1106212689453879191977235208036134814768946283886104135857})^7\)
\(\displaystyle +0(\frac{x}{1106212689453879191977235208036134814768946283886104135857})^8\)

\(r(x)=\)
\(-931166326910674526718530634530395511188484760951215019202x^7\)
\(+44081667002866521292[75 digits]22469878202438872436x^6\)
\(-13331579738644988581[132 digits]48018398665104447624x^5\)
\(-45414785555369089229[189 digits]85106015860347068418x^4\)
\(-71809678294997445547[246 digits]13523136087532093186x^3\)
\(+13372929188694233984[303 digits]93165215585922633914x^2\)
\(+42417543282194563777[360 digits]26324257495544510661x\)
\(-35743980059088545200[416 digits]80722642160047905681\)

\(= -(x-83113117101097109105115104032079115115105102114097103101)\)
\((931166326910674526718530634530395511188484760951215019202x^6\)
\(-43307745643175267650[75 digits]26182397092150127034x^5\)
\(+97321380036192344236[131 digits]32115288696559115190x^4\)
\(+46223653880907932101[189 digits]89490665635112272608x^3\)
\(+75651470252841928353[246 digits]55691765552926250594x^2\)
\(-70852996826996182688[302 digits]24287941312942141920x\)
\(-43006424624419143341[360 digits]20196969789558604581)\)

整數解為\([x=83113117101097109105115104032079115115105102114097103101]\)
Evaluation took 1965.2180 seconds (1977.6340 elapsed) using 132237.506 MB.}
(x) \([x=83113117101097109105115104032079115115105102114097103101]\)

將密碼x從個位數開始每3位數分隔出一個數字
(%i19) makelist(mod(floor(rhs(x[1])/1000^i),1000),i,length-1,0,-1);
(%o19) \([83,113,117,101,97,109,105,115,104,32,79,115,115,105,102,114,97,103,101]\)

每一個數字轉換成ASCII表示法
(%i20) makelist(ascii(i),i,%);
(%o20) \([S,q,u,e,a,m,i,s,h, ,O,s,s,i,f,r,a,g,e]\)

將list組合成字串,得到密碼
(%i21) simplode(%);
(%o21) \(Squeamish\) \(Ossifrage\)
作者: bugmens    時間: 2022-3-17 09:42

2-1.兩個訊息有仿射關係
兩個訊息\(m_1\)和\(m_2=\alpha m_1+\beta\)有仿射關係(affine relation)
經由RSA加密,公鑰\(e=3\),得到密文\(\cases{c_1=m_1^3 \pmod{N} \cr c_2=m_2^3 \pmod{N}}\)
若已知\(c_1,c_2,\alpha,\beta,N\)就可以回復明文
\(\displaystyle \frac{\beta(c_2+2\alpha^3 c_1-\beta^3)}{\alpha(c_2-\alpha^3 c_1+2\beta^3)}=\frac{3\alpha^3\beta m_1^3+3\alpha^2 \beta^2 m_1^2+3\alpha \beta^3 m_1}{3 \alpha^3 \beta m_1^2+3\alpha^2 \beta^2 m_1+3 \alpha \beta^3}=m_1 \pmod{N}\)
上面的式子可以從\(m_1^3-c_1,(\alpha m_1+\beta)^3-c_2\)計算歐幾里得演算法得到最大公因式。
若\(\alpha=\beta=1\),則
\(\displaystyle \frac{(m+1)^3+2m^3-1}{(m+1)^3-m^3+2}=\frac{3m^3+3m^2+3m}{3m^2+3m+3}=m \pmod{N}\)


同樣RSA加密,換公鑰\(e=5\),得到密文\(\cases{c_1=m^5 \pmod{N}\cr c_2=(m+1)^5\pmod{N}}\)
\(P(m)=c_2^3-3c_1c_2^2+3c_1^2c_2-c_1^3+37c_2^2+176c_1c_2+37c_1^2+73c_2-73c_1+14\)
\(mP(m)=2c_2^3-1c_1c_2^2-4c_1^2c_2+3c_1^3+14c_2^2-88c_1c_2-51c_1^2-9c_2+64c_1-7\)
\(\displaystyle m=\frac{mP(m)}{P(m)}\)
令\(z\)為未知的訊息\(m\),則\(z\)滿足這兩個方程式\(\cases{z^5-c_1\equiv 0\pmod{N}\cr (z+1)^5-c_2\equiv 0\pmod{N}}\)
應用歐幾里得演算法找到最大公因式\(gcd(z^5-c_1,(z+1)^5-c_2)\in Z/N[z]\),得到線性多項式\(z-m\)。

參考資料:
Coppersmith D., Franklin M., Patarin J., Reiter M. (1996) Low-Exponent RSA with Related Messages. In: Maurer U. (eds) Advances in Cryptology — EUROCRYPT ’96. EUROCRYPT 1996. Lecture Notes in Computer Science, vol 1070. Springer, Berlin, Heidelberg.
https://link.springer.com/chapter/10.1007%2F3-540-68339-9_1
https://link.springer.com/content/pdf/10.1007/3-540-68339-9_1.pdf

顯示數字的全部位數會造成版面凌亂,將太長的數字縮短顯示
功能表選取,編輯/設定/Worksheet/Maximum displayed number of digits調整為80


多項式輾轉相除法副程式
(%i1)
GCD(fx1,fx2,var):=block([temp],
fx1:expand(fx1),
fx2:expand(fx2),
while hipow(fx2,var)#1 do
  (temp:fx2,
   print(fx1,"除以",fx2,"餘式",fx2:remainder(fx1,fx2,var)),
   fx1:temp
  ),
fx2
)$


根據密文c1,c2產生方程式
(%i3)
fx1:m1^3-c1;
fx2: (alpha*m1+beta)^3-c2;

(fx1) \(m_1^3-c_1\)
(fx2) \((\alpha m_1+\beta)^3-c_2\)

計算fx1和fx2輾轉相除法得到最大公因式
(%i4) GCD:GCD(fx1,fx2,m1);
\(m_1^3-c_1\)除以\(\alpha^3m_1^3+3\alpha^2\beta m_1^2+3\alpha\beta^2m_1-c_2+\beta^3\)餘式\(\displaystyle -\frac{3\alpha^2\beta m_1^2+3\alpha\beta^2m_1-c_2+\alpha^3c_1+\beta^3}{\alpha^3}\)
\(\alpha^3m_1^3+3\alpha^2\beta m_1^2+3\alpha\beta^2m_1-c_2+\beta^3\)除以\(\displaystyle -\frac{3\alpha^2\beta m_1^2+3\alpha\beta^2m_1-c_2+\alpha^3c_1+\beta^3}{\alpha^3}\)餘式\(\displaystyle\frac{(\alpha c_2-\alpha^4c_1+2\alpha\beta^3)m1-\beta c_2-2\alpha^3\beta c_1+\beta^4}{3\beta}\)
(GCD) \(\displaystyle\frac{(\alpha c_2-\alpha^4c_1+2\alpha\beta^3)m1-\beta c_2-2\alpha^3\beta c_1+\beta^4}{3\beta}\)

從最大公因式,解方程式得m1
(%i5) m1:solve(GCD,m1)[1];
(m1) \(\displaystyle m_1=\frac{\beta c_2+2 \alpha^3 \beta c_1-\beta^4}{\alpha c_2-\alpha^4 c_1+2 \alpha \beta^3}\)

範例取自Cryptanalytic Attacks on RSA
(%i10)
alpha:3;
beta:5;
N:7790302288510159542362475654705578362485767620973983941084402222135728725117099985850483876481319443405109322651368151685741199347755868542740942256445000879127232585749337061853958340278434058208881085485078737;
c1:132057584044937409231208389323398996878812486949811558724214983072091380989054308161277959733824865068687594213139826622055543700074552293693503940351187203266740911056806170880679978462212228231292575333924006;
c2:3565554769213310049242626511731772915727937147644912090997362096862084038123081043744658925329430451812652081858712220905928591327874274888835176225741122966452992998335410453929161733393892204730002674838955287;

(alpha) \(3\)
(beta) \(5\)
(N) \(77903022885101595423624756[159 digits]78434058208881085485078737\)
(c1) \(13205758404493740923120838[158 digits]62212228231292575333924006\)
(c2) \(35655547692133100492426265[159 digits]93892204730002674838955287\)

將\(\alpha,\beta,c_1,c_2\)代入
(%i11) m1:ev(m1,[alpha=alpha,beta=beta,c1=c1,c2=c2]);
(m1) \(\displaystyle m_1=\frac{\beta c_2+2 \alpha^3 \beta c_1-\beta^4}{\alpha c_2-\alpha^4 c_1+2 \alpha \beta^3}=\frac{16978832234349095472583935[158 digits]61164325860631773696362722}{51843405275386826203986806[103 digits]08706305166524791817361975}\)

明文m1,m2
(%i13)
m1:ratsimp(rhs(m1)),modulus:N;
m2:alpha*m1+beta;

warning: assigning 77903022885101595423624756[159 digits]78434058208881085485078737, a non-prime, to 'modulus'
(m1) \(200805001301070903002315180419000118050019172105011309190800151919090618010705\)
(m2) \(602415003903212709006945541257000354150057516315033927572400455757271854032120\)

驗算
(%i15)
is(power_mod(m1,3,N)=c1);
is(power_mod(m2,3,N)=c2);

(%o14) \(true\)
(%o15) \(true\)

清除m1,m2,alpha,beta,N,c1,c2設定
(%i16) kill(m1,m2,alpha,beta,N,c1,c2);
(%o16) \(done\)

根據密文c1,c2產生方程式
(%i18)
fx1:m1^5-c1;
fx2: (m1+1)^5-c2;

(fx1) \(m_1^5-c_1\)
(fx2) \((m_1+1)^5-c_2\)

計算fx1和fx2輾轉相除法得到最大公因式
(%i19) GCD:GCD(fx1,fx2,m1)
\(m_1^5-c_1\)除以\(m_1^5+5m_1^4+10m_1^3+10m_1^2+5m_1-c_2+1\)餘式\(-5m_1^4-10m_1^3-10m_1^2-5m_1+c_2-c_1-1\)
\(m_1^5+5m_1^4+10m_1^3+10m_1^2+5m_1-c_2+1\)除以\(-5m_1^4-10m_1^3-10m_1^2-5m_1+c_2-c_1-1\)餘式\(\displaystyle \frac{10m_1^3+15m_1^2+(c_2-c_1+9)m_1-2c_2-3c_1+2}{5}\)
\(-5m_1^4-10m_1^3-10m_1^2-5m_1+c_2-c_1-1\)除以\(\displaystyle \frac{10m_1^3+15m_1^2+(c_2-c_1+9)m_1-2c_2-3c_1+2}{5}\)餘式\(\displaystyle \frac{(2c_2-2c_1-7)m_1^2+(-3c_2-7c_1-7)m_1+2c_2-7c_1-2}{4}\)
\(\displaystyle \frac{10m_1^3+15m_1^2+(c_2-c_1+9)m_1-2c_2-3c_1+2}{5}\)除以\(\displaystyle \frac{(2c_2-2c_1-7)m_1^2+(-3c_2-7c_1-7)m_1+2c_2-7c_1-2}{4}\)餘式\(\displaystyle \frac{4c_2^3+(148-12c_1)c_2^2+(12c_1^2+704c_1+292)c_2-4c_1^3+148c_1^2-292c_1+56)m_1-8c_2^3+(4c_1-56)c_2^2+(16c_1^2+352c_1+36)c_2-12c_1^3+204c_1^2-256c_1+28}{20c_2^2+(-40c_1-140)c_2+20c_1^2+140c_1+245}\)
(GCD) \(\displaystyle \frac{4c_2^3+(148-12c_1)c_2^2+(12c_1^2+704c_1+292)c_2-4c_1^3+148c_1^2-292c_1+56)m_1-8c_2^3+(4c_1-56)c_2^2+(16c_1^2+352c_1+36)c_2-12c_1^3+204c_1^2-256c_1+28}{20c_2^2+(-40c_1-140)c_2+20c_1^2+140c_1+245}\)

從最大公因式,解方程式得m1
(%i20) m1:solve(GCD,m1)[1];
(m1) \(\displaystyle m_1=\frac{2c_2^3+(14-c_1)c_2^2+(-4c_1^2-88c_1-9)c_2+3c_1^3-51c_1^2+64c_1-7}{c_2^3+(37-3c_1)c_2^2+(3c_1^2+176c_1+73)c_2-c_1^3+37c_1^2-73c_1+14}\)

範例取自Cryptanalytic Attacks on RSA
(%i23)
c1:18796237015415790;
c2:7290180156009373;
N:35480779745861123;

(c1) \(18796237015415790\)
(c2) \(7290180156009373\)
(N) \(35480779745861123\)

將c1,c2代入
(%i24) m1:ev(m1,[c1=c1,c2=c2]);
(m1) \(\displaystyle m_1=\frac{2c_2^3+(14-c_1)c_2^2+(-4c_1^2-88c_1-9)c_2+3c_1^3-51c_1^2+64c_1-7}{c_2^3+(37-3c_1)c_2^2+(3c_1^2+176c_1+73)c_2-c_1^3+37c_1^2-73c_1+14}=-\frac{43297460062121981374915003596042374969361963498}{7019720390981513672602639591832073102833439091}\)

將分數m_1同餘N
(%i25) m1:ratsimp(rhs(m1)),modulus:N;
warning: assigning 35480779745861123, a non-prime, to 'modulus'
(m1) \(-16036924398274761\)

明文m1,m2
(%i27)
m1:mod(m1,N);
m2:m1+1;

(m1) \(19443855347586362\)
(m2) \(19443855347586363\)

驗算
(%i29)
is(power_mod(m1,5,N)=c1);
is(power_mod(m2,5,N)=c2);

(%o28) \(true\)
(%o29) \(true\)
作者: bugmens    時間: 2022-8-23 18:10

2-2.兩個訊息有仿射關係
上一篇文章提到兩個訊息\(m_1\)和\(m_2=\alpha m_1+\beta\)有仿射關係的話就可以回復明文,但實務上兩個訊息的\(\alpha\)和\(\beta\)值不易得知。

改成明文\(M\)向左平移\(k\)位元,各加上隨機補綴值\(T_1\)和\(T_2\)(假設\(T_1<T_2\))後\(e=3\)次方同餘\(N\)得到密文\(c_1,c_2\)
\(c_1\equiv m_1^3=(2^kM+T_1)^3\pmod{N}\)
\(c_1\equiv m_2^3=(2^kM+T_2)^3\pmod{N}\)
若2個補綴值\(T_1\)和\(T_2\)很接近,設\(t\)為兩個補綴值的差,且\(t<N^{\frac{1}{9}}\)
\(t=T_2-T_1\),\(t=(2^kM+T_2)-(2^kM+T_1)\),\(t=m_2-m_1\),\(m_2=m_1+t\)
得到兩個同餘方程式,
\(\cases{c_1\equiv m_1^3\pmod{N}\cr c_2\equiv m_2^3\pmod{N}}\),\(\cases{m_1^3-c1\equiv 0\pmod{N}\cr (m_1+t)^3-c_2\equiv 0\pmod{N}}\)
利用Resultant消去共同變數\(m_1\),得到\(t\)的9次方程式。
\(Res_{m_1}(m_1^3-c_1,(m_1+t)^3-c_2)=t^9+(3c_1-3c_2)t^6+(3c_1^2+21c_1c_2+3c_2^2)t^3+(c_1-c_2)^3\equiv 0\pmod{N}\)
因為\(t<N^{\frac{1}{9}}\),可利用Coppersmith-Howgrave方法求得\(t\)較小的解。
再利用上一篇輾轉相除法求得\(m_1=2^kM+T_1\)的解,再將後面\(k\)位元刪除得到明文\(M\)。
\(\displaystyle m_1\equiv \frac{t(c_2+2c_1-t^3)}{c_2-c_1+2t^3}=\frac{t((m_1+t)^3+2m_1^3-t^3)}{(m_1+t)^3-m_1^3+2t^3}=\frac{t(3m_1^3+3m_1^2t+3m_1t^2)}{3m_1^2t+3m_1t^2+3t^3}\pmod{N}\)

本篇文章先介紹要如何計算Resultant(結式)。

參考資料:
D. Coppersmith. Finding a small root of a univariate modular equation. In Proceedings of Eurocrypt 1996, volume 1070 of Lecture Notes in Computer Science, pages 155–165. Springer, 1996.
https://link.springer.com/chapter/10.1007/3-540-68339-9_14
https://isc.tamu.edu/resources/preprints/1996/1996-02.pdf
https://canvas.mit.edu/courses/7 ... load?download_frd=1


公式

範例

設\(f(x)=a_nx^n+a_{n-1}x^{n-1}+\ldots+a_0\)和
\(g(x)=b_mx^m+b_{m-1}x^{m-1}+\ldots+b_0\)
是次數為\(n\)和\(m\)的多項式
設\(f(x)\)和\(g(x)\)的Sylvester矩陣為
\(Syl(f,g)=\left[\matrix{a_n&a_{n-1}&\ldots&\ldots&a_0&0&0\cr
0&a_n&a_{n-1}&\ldots&a_1&a_0&0\cr
0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr
0&0&0&a_n&a_{n-1}&\ldots&a_0\cr
b_m&b_{m-1}&\ldots&\ldots&b_0&0&0\cr
0&b_m&b_{m-1}&\ldots&b_1&b_0&0\cr
0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr
0&0&0&b_m&b_{m-1}&\ldots&b_0}\right] \matrix{ \cr   \cr f(x)取m列\cr  \cr  \cr \cr g(x)取n列\cr }\)
則\(f(x)\)和\(g(x)\)的Resultant為Sylvester矩陣的行列式值
\(Res(f,g)=det(Syl(f,g))\)
\(Res(f,g)=\left|\matrix{a_n&a_{n-1}&\ldots&\ldots&a_0&0&0\cr
0&a_n&a_{n-1}&\ldots&a_1&a_0&0\cr
0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr
0&0&0&a_n&a_{n-1}&\ldots&a_0\cr
b_m&b_{m-1}&\ldots&\ldots&b_0&0&0\cr
0&b_m&b_{m-1}&\ldots&b_1&b_0&0\cr
0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr
0&0&0&b_m&b_{m-1}&\ldots&b_0}\right|\)
\(f(x)=1x^3+2x^2+3x+4\)
\(g(x)=5x^2+6x+7\)
\(f(x)\)和\(g(x)\)的Sylvester矩陣為
\(Syl(f,g)=\left[\ \matrix{1&2 &3 &4 &0\cr 0 &1&2 &3 &4 \cr 5&6&7&0&0 \cr 0&5&6&7&0 \cr 0&0&5&6&7} \right] \matrix{f(x)取2列\cr \cr   \cr g(x)取3列 \cr }\)
\(f(x)\)和\(g(x)\)的Resultant為
\(Res(f,g)= \left|\ \matrix{1&2 &3 &4 &0\cr 0 &1&2 &3 &4 \cr 5&6&7&0&0 \cr 0&5&6&7&0 \cr 0&0&5&6&7} \right|=832 \)
超過3階行列式不能用交叉相乘方式計算,而降階方式計算量又太大,實務上可採用PA=LU分解,再個別計算矩陣\(P,L,U\)的行列式值,\(det(P)\cdot det(A)=det(L)\cdot det(U)\),進而得到矩陣\(A\)的行列式值。
參考資料:https://ccjou.wordpress.com/2012/04/13/palu-%E5%88%86%E8%A7%A3/
\(P=\left[ \matrix{1&0&0&0&0\cr 0&1&0&0&0\cr 0&0&0&1&0\cr 0&0&1&0&0\cr 0&0&0&0&1}\right]\),\(det(P)=-1\)
\(L=\left[ \matrix{\displaystyle 1&0&0&0&0\cr 0&1&0&0&0\cr 0&5&1&0&0\cr 5&-4&0&1&0\cr 0&0&-\frac{5}{4}&\frac{1}{2}&1}\right]\),\(det(L)=1\cdot 1\cdot 1\cdot 1\cdot 1=1\)
\(U=\left[ \matrix{1&2&3&4&0\cr 0&1&2&3&4\cr 0&0&-4&-8&-20\cr 0&0&0&-8&16\cr 0&0&0&0&-26}\right]\),\(det(U)=1\cdot 1\cdot (-4)\cdot(-8)\cdot(-26)=-832\)
\(\displaystyle Res(f,g)=\frac{det(L)\cdot det(U)}{det(P)}=\frac{1\cdot (-832)}{-1}=832\)
判斷是否有共同根
若\(Res(f,g)=0\),則\(f,g\)有共同根
[證明]
設\(x=x_0\)是\(f(x)=0,g(x)=0\)的共同根,則\(f(x_0)=g(x_0)=0\)
\(\left[\matrix{a_n&a_{n-1}&\ldots&\ldots&a_0&0&0\cr
0&a_n&a_{n-1}&\ldots&a_1&a_0&0\cr
0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr
0&0&0&a_n&a_{n-1}&\ldots&a_0\cr
b_m&b_{m-1}&\ldots&\ldots&b_0&0&0\cr
0&b_m&b_{m-1}&\ldots&b_1&b_0&0\cr
0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr
0&0&0&b_m&b_{m-1}&\ldots&b_0}\right]
\left[\matrix{x_0^{n+m-1}\cr x_0^{n+m-2}\cr \vdots \cr x_0^n \cr x_0^{n-1}\cr \vdots \cr x_0 \cr 1}\right]=\left[\matrix{f(x_0)x_0^{m-1}\cr f(x_0)x_0^{m-2}\cr \vdots \cr f(x_0)x_0 \cr f(x_0)\cr g(x_0)x_0^{n-1} \cr g(x_0)x_0^{n-2}\cr \vdots \cr g(x_0)x_0 \cr g(x_0)} \right]=0\)
\(Syl(f,g)x=0\)是齊次方程組
若\(x\)有非0解,則\(Syl(f,g)\)的行列式值要為0,得到
\(Res(f,g)=\left|\matrix{a_n&a_{n-1}&\ldots&\ldots&a_0&0&0\cr
0&a_n&a_{n-1}&\ldots&a_1&a_0&0\cr
0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr
0&0&0&a_n&a_{n-1}&\ldots&a_0\cr
b_m&b_{m-1}&\ldots&\ldots&b_0&0&0\cr
0&b_m&b_{m-1}&\ldots&b_1&b_0&0\cr
0&0&\ddots&\ddots&\ddots&\ddots&\vdots\cr
0&0&0&b_m&b_{m-1}&\ldots&b_0}\right|=0\)
\(f(x)=(x^2-1)(x^2+x+2)=x^4+x^3+x^2-x-2\)
\(g(x)=(x^2-1)(x^3+x^2+x-1)=x^5+x^4-2x^2-x+1\)有共同根
設\(x=x_0\)是\(f(x)=0,g(x)=0\)的共同根,則\(f(x_0)=g(x_0)=0\)
\(\left[\matrix{1&1&1&-1&-2&0&0&0&0\cr
0&1&1&1&-1&-2&0&0&0\cr
0&0&1&1&1&-1&-2&0&0\cr
0&0&0&1&1&1&-1&-2&0\cr
0&0&0&0&1&1&1&-1&-2\cr
1&1&0&-2&-1&1&0&0&0\cr
0&1&1&0&-2&-1&1&0&0\cr
0&0&1&1&0&-2&-1&1&0\cr
0&0&0&1&1&0&-2&-1&1}\right]
\left[\matrix{x_0^8\cr x_0^7\cr x_0^6\cr x_0^5\cr x_0^4\cr x_0^3\cr x_0^2\cr x_0^1\cr 1} \right]=
\left[\matrix{f(x_0)\cdot x_0^4\cr f(x_0)\cdot x_0^3\cr f(x_0)\cdot x_0^2\cr f(x_0)\cdot x_0\cr f(x_0)\cr g(x_0)\cdot x_0^3\cr g(x_0)\cdot x_0^2\cr g(x_0)\cdot x_0\cr g(x_0)} \right]=0\)
\(Syl(f,g)x=0\)是齊次方程組
若\(x\)有非0解,則\(Syl(f,g)\)的行列式值要為0,得到
\(Res(f,g)=\left|\ \matrix{1&1&1&-1&-2&0&0&0&0\cr
0&1&1&1&-1&-2&0&0&0\cr
0&0&1&1&1&-1&-2&0&0\cr
0&0&0&1&1&1&-1&-2&0\cr
0&0&0&0&1&1&1&-1&-2\cr
1&1&0&-2&-1&1&0&0&0\cr
0&1&1&0&-2&-1&1&0&0\cr
0&0&1&1&0&-2&-1&1&0\cr
0&0&0&1&1&0&-2&-1&1}\right|=0\)
兩變數方項式消除共同變數
\(f(x,y)=0,g(x,y)=0\)為兩變數方程式,已知\(f(x)\)和\(g(x)\)有共同根,可利用Resultant消除共同變數
設\(f(x,y)=x^2y^2-25x^2+9=0\)
\(g(x,y)=4x+y=0\)
若要消去\(x\)變數,先以\(x\)為變數降冪排列
\(f(x,y)=(y^2-25)x^2+0x+9\),\(g(x,y)=4x+y\)
計算\(f(x,y)\)和\(g(x,y)\)的Resultant
\(Res_x(f,g)=\left|\ \matrix{y^2-25&0&9 \cr 4&y&0 \cr 0&4&y} \right|\ =y^4-25y^2+144=0\)
解得\(y=\pm 3,\pm 4\),代回\(g(x,y)=0\)
得\(\displaystyle (x,y)=(1,-4),(-1,4),(\frac{3}{4},-3),(-\frac{3}{4},3)\)

若要消去\(y\)變數,先以\(y\)為變數降冪排列
\(f(x,y)=x^2y^2+0y+(-25x^2+9),g(x,y)=y+4x\)
計算\(f(x,y)\)和\(g(x,y)\)的Resultant
\(Res_y(f,g)=\left|\ \matrix{x^2&0&-25x^2+9 \cr 1&4x&0 \cr 0&1&4x} \right|\ =16x^4-25x^2+9=0 \)
解得\(\displaystyle x=\pm \frac{3}{4},\pm 1\),代回\(g(x,y)=0\)
得\(\displaystyle (x,y)=(1,-4),(-1,4),(\frac{3}{4},-3),(-\frac{3}{4},3)\)
範例出處
http://buzzard.ups.edu/courses/2 ... ts-ups-434-2016.pdf


取多項式P的x的各項係數
(%i1)
coeffs(P,x):=block (local(l),l:[],
  for i from hipow(P,x) step -1 thru 0 do l:cons(coeff(P,x,i),l),
  reverse(l));

(%o1) coeffs(P,x):=block(local(l),l:[],for i from hipow(P,x) step -1 thru 0 do l:cons(coeff(P,x,i),l),reverse(l))

計算多項式P和Q的Sylvester矩陣
副程式出處http://www.lpthe.jussieu.fr/~talon/subresultant.mac

(%i2)
result(P,Q,x):=block(local(mat,len1,len2,ll1,ll2),
  len1:hipow(P,x)+1,
  len2:hipow(Q,x)+1,   /* assume len1 >= len2 */
  mat:zeromatrix(len1+len2-2,len1+len2-2),
  ll1:coeffs(P,x),
  ll2:coeffs(Q,x),
  for i from 1 thru len2-1 do (
    for j from i thru i+len1-1 do (
      mat[i,j]:ll1[j-i+1])),
  for i from len2 thru len2+len1-2 do (
    for j from i-len2+1 thru i do (
       mat[i,j]:ll2[j-i+len2])),
  mat)$


第2個例子
(%i5)
f:x^3+2*x^2+3*x+4;
g:5*x^2+6*x+7;
result(f,g,x);

(f) \(x^3+2x^2+3x+4\)
(g) \(5x^2+6x+7\)
(%o5) \(\left[\matrix{1&2&3&4&0\cr
0&1&2&3&4\cr
5&6&7&0&0\cr
0&5&6&7&0\cr
0&0&5&6&7}\right]\)

計算LU分解
(%i6) [P,L,U]:get_lu_factors(lu_factor(%,generalring));
(%o6) \([\left[\matrix{1&0&0&0&0\cr 0&1&0&0&0\cr 0&0&0&1&0\cr 0&0&1&0&0\cr 0&0&0&0&1} \right],\left[\matrix{\displaystyle 1&0&0&0&0\cr 0&1&0&0&0\cr 0&5&1&0&0\cr 5&-4&0&1&0\cr 0&0&-\frac{5}{4}&\frac{1}{2}&1} \right],\left[\matrix{1&2&3&4&0\cr 0&1&2&3&4\cr 0&0&-4&-8&-20\cr 0&0&0&-8&16\cr 0&0&0&0&-26} \right]]\)

計算矩陣P,L,U的行列式值
(%i9)
detP:determinant(P);
detL:determinant(L);
detU:determinant(U);

(detP) \(-1\)
(detL) 1
(detU) \(-832\)

計算行列式值
(%i10) detL*detU/detP;
(%o10) 832

第3個例子
(%i14)
f:x^4+x^3+x^2-x-2;
g:x^5+x^4-2x^2-x+1;
result(f,g,x);
determinant(%);

(f) \(x^4+x^3+x^2-x-2\)
(g) \(x^5+x^4-2*x^2-x+1\)
(%o13) \(\left[\matrix{1&1&1&-1&-2&0&0&0&0\cr
0&1&1&1&-1&-2&0&0&0\cr
0&0&1&1&1&-1&-2&0&0\cr
0&0&0&1&1&1&-1&-2&0\cr
0&0&0&0&1&1&1&-1&-2\cr
1&1&0&-2&-1&1&0&0&0\cr
0&1&1&0&-2&-1&1&0&0\cr
0&0&1&1&0&-2&-1&1&0\cr
0&0&0&1&1&0&-2&-1&1}\right]\)
(%o14) \(0\)

第4個例子
(%i16)
f:x^2*y^2-25*x^2+9;
g:4*x+y;

(f) \(x^2y^2-25x^2+9\)
(g) \(y+4x\)

消掉共同變數x
(%i19)
result(f,g,x);
determinant(%);
ratsimp(%);

(%o17) \(\left[\matrix{y^2-25&0&9\cr 4&y&0\cr 0&4&y}\right]\)
(%o18) \(y^2(y^2-25)+144\)
(%o19) \(y^4-25y^2+144\)

先解出y
(%i20) solve(%,y);
(%o20) \([y=-4,y=4,y=-3,y=3]\)

將y代回g(x,y)=0求x
(%i21) map(lambda([y],[solve(ev(g,y),x)[1],y]),%);
(%o21) \(\displaystyle [[x=1,y=-4],[x=-1,y=4],[x=\frac{3}{4},y=-3],[x=-\frac{3}{4},y=3]]\)

消掉共同變數y
(%i23)
result(f,g,y);
determinant(%);

(%o22) \(\left[\matrix{x^2&0&9-25x^2\cr 1&4x&0\cr 0&1&4x}\right]\)
(%o23) \(16x^4-25x^2+9\)

先解出x
(%i24) solve(%,x);
(%o24)  \(\displaystyle [x=-1,x=1,x=-\frac{3}{4},x=\frac{3}{4}]\)

將x代回g(x,y)=0求y
(%i25) map(lambda([x],[x,solve(ev(g,x),y)[1]]),%);
(%o25) \(\displaystyle [[x=-1,y=4],[x=1,y=-4],[x=-\frac{3}{4},y=3],[x=\frac{3}{4},y=-3]]\)

第1個例子
(%i30)
f:m1^3-c1;
g: (m1+t)^3-c2;
result(f,expand(g),m1);
determinant(%);
ratsimp(%);

(f) \(m1^3-c1\)
(g) \((t+m1)^3-c2\)
(%o28) \(\left[\matrix{1&0&0&-c1&0&0\cr 0&1&0&0&-c1&0\cr 0&0&1&0&0&-c1\cr 1&3t&3t^2&t^3-c2&0&0\cr 0&1&3t&3t^2&t^3-c2&0\cr 0&0&1&3t&3t^2&t^3-c2}\right]\)
(%o29) \((t^3-c2)^3+c1((t^3-c2)^2+c1(10t^3-c2)-9t^3(t^3-c2))+c1((t^3-c2)^2-c1(8t^3+c2)+c1(t^3-c2+c1))+c1(3t^2(9t^4-3t(t^3-c2))-(t^3-c2)(8t^3+c2))\)
(%o30) \(t^9+(3c1-3c2)t^6+(3c2^2+21c1c2+3c1^2)t^3-c2^3+3c1c2^2-3c1^2c2+c1^3\)

也可以使用maxima內建指令計算resultant
(%i31) resultant(f,g,m1);
(%o31) \(t^9+c1(3t^6+21c2t^3+3c2^2)-3c2t^6+c1^2(3t^3-3c2)+3c2^2t^3-c2^3+c1^3\)

整理成t的多項式
(%i32) ratsimp(%);
(%o32) \(t^9+(3c1-3c2)t^6+(3c2^2+21c1c2+3c1^2)t^3-c2^3+3c1c2^2-3c1^2c2+c1^3\)
作者: bugmens    時間: 2022-9-3 19:37

2-3.兩個訊息有仿射關係
設明文\(M\)乘\(10^5\)倍,各加上隨機補綴值\(T_1\)和\(T_2\)(假設\(0\le T_1,T_2<10^5,T_1<T_2\))後\(e=3\)次方同餘\(N\)得到密文\(c_1,c_2\)。
\(c1=1881676371789154860897069000\)
\(c2=1881678004162711039676405223\)
\(N=54957464841358314276864542898551\)
若2個補綴值\(T_1\)和\(T_2\)很接近,設\(t\)為兩個補綴值的差,\(t\)未知但足夠小(\(t<N^{\frac{1}{9}}\))。
將密文\(c_1,c_2\),公鑰\(N\)代入9次同餘方程式
\(t^9+(3c_1-3c_2)t^6+(3c_1^2+21c_1c_2+3c_2^2)t^3+(c_1-c_2)^3\equiv 0\pmod{N}\)

雖然論文說能找到比\(N^{\frac{1}{9}}=3362\)還小的解,但以Coppersmith_Howgrave()副程式精算的上界\(X\)卻小很多。
\(\displaystyle X=ceiling(\frac{1}{\sqrt{2}}(hk)^{-1/(hk-1)}N^{(h-1)/(hk-1)})\)
設\(h=3\),9次方程式\(k=9\),計算出\(X=172\)
而且會產生\(27 \times 27\)的超大矩陣,導致LLL化簡的時間大幅增加還無法求得較小的解。

換另一個作法,令\(t^3=x\),先解3次同餘方程式,不僅Coppersmith_Howgrave()副程式精算的上界\(X\)提高很多。
\(x^3+(3c_1-3c_2)x^2+(3c_1^2+21c_1c_2+3c_2^2)x+(c_1-c_2)^3\equiv 0\pmod{N}\)
設\(h=3\),3次方程式\(k=3\),計算出\(X=46260610\)
而且產生\(9\times 9\)較小的矩陣,LLL化簡的時間變得更短了

所得到的較小\(x\)的解,再解一次3次同餘方程式,得到兩個補綴值的差\(t\)。
\(t^3-x\equiv 0\pmod{N}\)

再將密文\(c_1,c_2\),補綴值的差\(t\),公鑰\(N\)代入以下公式得到有補綴值的\(m_1\),再將後5位補綴值刪除得到明文\(M\)。
\(\displaystyle m_1\equiv \frac{t(c_2+2c_1-t^3)}{c_2-c_1+2t^3}\pmod{N}\)


請下載LLL.zip,解壓縮後將LLL.mac放到C:\maxima-5.46.0\share\maxima\5.46.0\share目錄下
要先載入LLL.mac才能使用Coppersmith_Howgrave指令

(%i1) load("LLL.mac");
(%o1) C:/maxima-5.46.0/share/maxima/5.46.0/share/LLL.mac

已知密文\(c_1,c_2\),公鑰\(N\)
(%i4)
c1:1881676371789154860897069000;
c2:1881678004162711039676405223;
N:54957464841358314276864542898551;

(c1) 1881676371789154860897069000
(c2) 1881678004162711039676405223
(N) 54957464841358314276864542898551

9次同餘方程式
(%i5) fx:x^9+(3*c1-3*c2)*x^6+(3*c1^2+21*c1*c2+3*c2^2)*x^3+(c1-c2)^3;
(fx) \(x^9-4897120668536338008669x^6+95599144073213399280057649148373498671072396308207166187x^3\)
\(-4349693466736349905369332025355097289037604766707550608234921567\)

同餘方程式係數同餘N,讓係數變小
(%i6) fx:polymod(fx,N);
(fx) \(x^9-4897120668536338008669x^6-1516451737447758219766669752498x^3-21000738238808374545647388458802\)

參數h
(%i7) h:3;
(h) 3

利用Coppersmith_Howgrave方法解9次同餘方程式,執行時間需2262秒(37分鐘)
但執行結果無法求得較小的整數解,故省略執行過程

(%i10)
showtime:true$
Coppersmith_Howgrave(fx,N,h);
showtime:false$

...
整數解為[]
Evaluation took 2262.6870 seconds (2264.0150 elapsed) using 420496.373 MB.
(%o9) []

令t^3=x,化簡成3次同餘方程式
(%i11) fx:x^3+(3*c1-3*c2)*x^2+(3*c1^2+21*c1*c2+3*c2^2)*x+(c1-c2)^3;
(fx) \(x^3-4897120668536338008669x^2+95599144073213399280057649148373498671072396308207166187x\)
\(-4349693466736349905369332025355097289037604766707550608234921567\)

同餘方程式係數同餘N,讓係數變小
(%i12) fx:polymod(fx,N);
(fx) \(x^3-4897120668536338008669x^2-1516451737447758219766669752498x-21000738238808374545647388458802\)

利用Coppersmith_Howgrave方法解3次同餘方程式,執行時間需43秒
(%i15)
showtime:true$
X:Coppersmith_Howgrave(fx,N,h);
showtime:false$

Evaluation took 0.0000 seconds (0.0000 elapsed) using 0 bytes.
參數\(h=3\)
\(p(x)\)最高次方\(k=3\)
\(\displaystyle X=ceiling(\frac{1}{\sqrt{2}}(hk)^{-1/(hk-1)}N^{(h-1)/(hk-1)})=ceiling(\frac{1}{\sqrt{2}}9^{-1/8}54957464841358314276864542898551^{1/4})=46260610\)
\(q_uv=N^{h-1-v} x^u p(x)^v =\) \([3020322941789135243826751301254310584993059920451586964677899601,\)
\(3020322941789135243826751301254310584993059920451586964677899601x,\)
\(3020322941789135243826751301254310584993059920451586964677899601x^2,\)
\(54957464841358314276864542898551(x^3-4897120668536338008669x^2-1516451737447758219766669752498x-21000738238808374545647388458802),\)
\(54957464841358314276864542898551x(x^3-4897120668536338008669x^2-1516451737447758219766669752498x-21000738238808374545647388458802),\)
\(54957464841358314276864542898551x^2(x^3-4897120668536338008669x^2-1516451737447758219766669752498x-21000738238808374545647388458802),\)
\((x^3-4897120668536338008669x^2-1516451737447758219766669752498x-21000738238808374545647388458802)^2,\)
\(x(x^3-4897120668536338008669x^2-1516451737447758219766669752498x-21000738238808374545647388458802)^2,\)
\(x^2(x^3-4897120668536338008669x^2-1516451737447758219766669752498x-21000738238808374545647388458802)^2]\)
用\(46260610x\)取代\(x\),得到\(q_{uv}=\) \([3020322941789135243826751301254310584993059920451586964677899601,\)
\(139721981684159887751924249514318172791235797686641888454048089061016610x,\)
\(6463624103118063744935544456324562407407970654820642611436221569296955598732100x^2,\)
\(54957464841358314276864542898551(98999742604948264981000x^3-10480053887972286407738186731512534900x^2-70151982409893138378920200419106503780x-21000738238808374545647388458802),\)
\(2542365847614788847019462641858137376110x(98999742604948264981000x^3-10480053887972286407738186731512534900x^2-70151982409893138378920200419106503780x-21000738238808374545647388458802),\)
\(117611394953827177084317023684568968482648027100x^2(98999742604948264981000x^3-10480053887972286407738186731512534900x^2-70151982409893138378920200419106503780x-21000738238808374545647388458802),\)
\((98999742604948264981000x^3-10480053887972286407738186731512534900x^2-70151982409893138378920200419106503780x-21000738238808374545647388458802)^(2),\)
\(46260610x(98999742604948264981000x^3-10480053887972286407738186731512534900x^2-70151982409893138378920200419106503780x-21000738238808374545647388458802)^(2),\)
\(2140044037572100x^2(98999742604948264981000x^3-10480053887972286407738186731512534900x^2-70151982409893138378920200419106503780x-21000738238808374545647388458802)^(2)]\)
產生矩陣\(M=\left[ \matrix{
3020322941789135243826751301254310584993059920451586964677899601&0&0&0&0&0&0&0&0\cr
0&139721981684159887751924249514318172791235797686641888454048089061016610&0&0&0&0&0&0&0\cr
0&0&6463624103118063744935544456324562407407970654820642611436221569296955598732100&0&0&0&0&0&0\cr
-1154147333401880370164435877744830779893335235336308145728995902&-3855375106843289059874469643405077531431008453876682145059536838022780&-575957193083777435966023818707724430220694882620408968134835546929900&5440774873514967046498526949032608069078072148942531000&0&0&0&0&0\cr
0&-53391559673044361070832604010361296224641422921151169969392245114020220&-178352004221385726316119489130401363701292623991492180806562660444404996695800&-26644131085943325292024201127948743853911779893898517315388054650660801239000&251693564521475219700920220763687359166473755234092339003910000&0&0&0&0\cr
0&0&-2469926119326432700196969469407759883742609255600435024997766588244094929534200&-8250672510003878744676740400060736629653654574347063094341880675381046234195692438000&-1232573756955700653437467678941596939415709824077480689105413794852905568404895790000&11643497827837801763248586973862843084330167466119804398647668985100000&0&0&0\cr
441031006574948269107459443949256719868815747806770028851275204&2946486839047310595109751478204161934049771268347937188112057574543120&4921301076215693158799367543245210199690179969531456795727185981205628668000&1470393112007528062187159841915196407503917007629683675986668119372838320000&109831529494789146606929429768530109268611975609482301299443587987461650000&-2075045274790487347904810593080778841186998131216420673800000&9800949035846008678895673107522190930361000000&0&0\cr
0&20402363393071117647355229427353424907730536471147343664377590214914440&136306278531300406989240120330126235607922189234249266563748531753485202503200&227662389779394457098885610164724803415889536400306605558985017074020917615167480000&68021282301266572748895948454500554080939778162323820958185619069740318114575200000&5080873551661937743415985648044361658132643844999773042316053040888648280606500000&-95992860189425566911358759970378608468403657618931662386599018000000&453397880977148227551007964314572140974967380210000000&0\cr
0&0&943825776005139675748417799999320121820808332782523517793742593671973092208400&6305611591687860920570511402945041036226201306511803963291610965520595093771558952000&10531801025252553016013278646442369888149133646495387760188037870704622801637392876962800000&3146706012238795427973303402033752877122263511053778975056451231393819657574298642872000000&235044309832747753792446979829777477365827565182434950799096426463863811536307859965000000&-4440688268007542274915272165073296358699518927682926250318126398080980000000&20974462546710273066928434544050339130507985738616528100000000}\right]\)
LLL化簡\(B=\left[ \matrix{
53771676921999198037128719975410481845009948321580737058118762&50209380384868519769271355772363021078882998018525986723096380&107113429339000465042631199484653568414097906566121374434204800&2566158289017059510580947933126354061025546078929008772549000&-39201258910319328503256252507864134476510009966583646884840000&-82244768124108488515911014612606850013994967332618611133000000&-103326720791445976823937028600478023227439055205294880233000000&37553747697339884108136344819118362708215810289041024760000000&-41948925093420546133856869088100678261015971477233056200000000\cr
145771311156080366680612542702670552709050420859148668552121201&-102701813735090026820390486307494510321459974199722868939788630&55690597658188982675500688460805070018767816245101070397610800&-3690675191418901829302352712732398605405813417421315444807000&-34161730786036250811133667107244245173497899683329768637600000&105158149470961723712865498187081390865505368625840232003900000&-83943991120073620894214705274131521444270306664078709465000000&-94290002110963796909267598874077903051034921264274818610000000&0\cr
22520257569452314079351935267514264370266330796992552972684997&-98310513164562058062910678303618723610419189844159039543246600&-59216755675973590492737933555662165421890387526607433485560200&210122354709341487106669358644005820317705567891681532969573000&-13547462576968605065539206672838828517502007656710102017580000&23570869821207231876579884845247791136173699754579501358900000&-40641684543556222622266012007342445503983888770262907798000000&-86958932882212997194203757223689795368058144049335172070000000&41948925093420546133856869088100678261015971477233056200000000\cr
169015127177354263666121860022442922657381338158956682760146316&-44086339219025359808922118654836582121338928607019431900103130&-55743427083965516899322695992901696889154913782390199199450100&-99213756448548832412671199081590293096668700399267187647555000&-13681783036472695133702522618982681148717527439219162384970000&-15336537742431604945023054843850719026627918786732999429600000&64672345006900325309865538762091565046333246270689577751000000&-71951332896677550420724086465591699219582263948746051800000000&62923387640130819200785303632151017391523957215849584300000000\cr
-111109391058117478677425543043666767886469428988351808979162264&68706199548070844584789292006960471026818898889658819004932390&114242801459017508543027293838247104016630443508968997031447000&-70229925147280191228538106815486527561582710206602914483698000&-108177296750967223863314840883237590333571940265343423758290000&21114534120011920453814163485385935919207972703328940545600000&-34780235497393011659779194620008032778904564753918395174000000&44536869417475438776116536835516252809621296087125152680000000&83897850186841092267713738176201356522031942954466112400000000\cr
32124330345979841767629832716536687416322338071176926036776624&27164161165425888332075134727974947827481095848187898522695730&-79639511287230298148663766719580830450559479484044659434682900&-51041393060884297450399678845972688262211525661235763838740000&-120857089745132822141399493042839109949450984516626943707450000&220466029767922832433728342036436413650585457627045150329700000&-42081776027182400361358030886271577560506458471894525675000000&58148929768074224345419762221788597120206147540057861770000000&-41948925093420546133856869088100678261015971477233056200000000\cr
-118279971490860306266688062364858934470851326591670377750842105&186394623214470748860705331927751369982342478110034345905919190&-5844542338433954468770696410970613047578620794759879329291700&-31690810413815853326709322936928777204830797244545090618294000&36631940618043663684819094023611438217838817287345595588310000&14670122074875238001436616319545787277339265229080644956400000&-87941416624880050595555558070529584290459598827529416836000000&-58985200396438287348022673963584538334771708074420956690000000&62923387640130819200785303632151017391523957215849584300000000\cr
-67402575181872320450341662740231249645051561595949203267092646&81687875727598274014317606405009186128237310267665643776123970&-60606071715445114152730683837370692931748434259046928181917500&118448345919188327186093480437680808892299725583302023014092000&5659950991122719764062671142382391292964286805841933824120000&61863373560034972019278274616457949997753618484681115789000000&87493980444210846078712251695585839215963143393159467086000000&-110345238655812995600366365368792036283900354142468092020000000&-125846775280261638401570607264302034783047914431699168600000000\cr
391536656683468813127560730295755766606487863741754115343991921&447549940911495565399271813369673072505177321547345359598698170&345431307115038022995995779076001023195500573892855741305309800&330776015310331719481270882134135987680304349298242517737362000&334129783160230133456909028931418304394164386380225530980110000&298169048606388347296126093056185837124427112397441890970200000&317606145581069503748397520803157118676806368270962392206000000&313838224166290677083070069124989059103490292778965585030000000&440463713480915734405497125425057121740667700510947090100000000}\right]\)
產生不需要同餘\(N^2\)的方程式
\(r(x)=53771676921999198037128719975410481845009948321580737058118762 \)
\(\displaystyle +50209380384868519769271355772363021078882998018525986723096380 ( \frac{x}{46260610} ) \)
\(\displaystyle +107113429339000465042631199484653568414097906566121374434204800 ( \frac{x}{46260610} )^2 \)
\(\displaystyle +2566158289017059510580947933126354061025546078929008772549000 (\frac{x}{46260610})^3 \)
\(\displaystyle -39201258910319328503256252507864134476510009966583646884840000 (\frac{x}{46260610})^4 \)
\(\displaystyle -82244768124108488515911014612606850013994967332618611133000000 (\frac{x}{46260610})^5 \)
\(\displaystyle -103326720791445976823937028600478023227439055205294880233000000 (\frac{x}{46260610})^6 \)
\(\displaystyle +37553747697339884108136344819118362708215810289041024760000000 (\frac{x}{46260610})^7 \)
\(\displaystyle -41948925093420546133856869088100678261015971477233056200000000 (\frac{x}{46260610})^8 \)

\(r(x)= -2x^8+82827356x^7-10542521995935153x^6-388196401064276818832330x^5-8559622143684325599618510860324x^4\)
\(+25920858191087824461843813370140390129x^3+50051974379238314010577044980314319102425126688x^2+1085359237261863165428889843267588150672526756965072158x+53771676921999198037128719975410481845009948321580737058118762\)
\( = -(x-45499293)(2x^7+8171230x^6+10914307183875543x^5+884789661515435025323429x^4+48816926196345927839271626696021x^3\)
\(+2195214770175831075654032836258741023024x^2+49828745646919485619110961668243162515263595344x+1181813460749801058164326201187576295856068539825019634) \)
整數解為\([x=45499293]\)
Evaluation took 43.1100 seconds (43.1220 elapsed) using 5541.766 MB.
(X) \([x=45499293]\)

再解一次3次同餘方程式
(%i16) fx:x^3-rhs(X[1]);
(fx) \(x^3-45499293\)

利用Coppersmith_Howgrave方法解3次同餘方程式,執行時間需0.328秒
(%i19)
showtime:true$
X:Coppersmith_Howgrave(fx,N,h);
showtime:false$

Evaluation took 0.0000 seconds (0.0000 elapsed) using 0 bytes.
參數\(h=3\)
p(x)最高次方\(k=3\)
\(\displaystyle X=ceiling(\frac{1}{\sqrt{2}}(hk)^{-1/(hk-1)}N^{(h-1)/(hk-1)})=ceiling(\frac{1}{\sqrt{2}}9^{-1/8}54957464841358314276864542898551^{1/4})=46260610\)
\(q_{uv}=N^{h-1-v} x^u p(x)^v =\)
\([3020322941789135243826751301254310584993059920451586964677899601,\)
\(3020322941789135243826751301254310584993059920451586964677899601x,\)
\(3020322941789135243826751301254310584993059920451586964677899601x^2,\)
\(54957464841358314276864542898551(x^3-45499293),\)
\(54957464841358314276864542898551x(x^3-45499293),\)
\(54957464841358314276864542898551x^2(x^3-45499293),\)
\((x^3-45499293)^2,\)
\(x(x^3-45499293)^2,\)
\(x^2(x^3-45499293)^2]\)
用\(46260610x\)取代\(x\),得到\(q_uv=\)
\([3020322941789135243826751301254310584993059920451586964677899601,\)
\(139721981684159887751924249514318172791235797686641888454048089061016610x,\)
\(6463624103118063744935544456324562407407970654820642611436221569296955598732100x^2,\)
\(54957464841358314276864542898551(98999742604948264981000x^3-45499293),\)
\(2542365847614788847019462641858137376110x(98999742604948264981000x^3-45499293),\)
\(117611394953827177084317023684568968482648027100x^2(98999742604948264981000x^3-45499293),\)
\((98999742604948264981000x^3-45499293)^2,\)
\(46260610x(98999742604948264981000x^3-45499293)^2,\)
\(2140044037572100x^2(98999742604948264981000x^3-45499293)^2] \)
產生矩陣\(M=\left[ \matrix{
3020322941789135243826751301254310584993059920451586964677899601&0&0&0&0&0&0&0&0\cr
0&139721981684159887751924249514318172791235797686641888454048089061016610&0&0&0&0&0&0&0\cr
0&0&6463624103118063744935544456324562407407970654820642611436221569296955598732100&0&0&0&0&0&0\cr
-2500525795354160459269142958652241224443&0&0&5440774873514967046498526949032608069078072148942531000&0&0&0&0&0\cr
0&-115675848613818628883670707444457456909880090230&0&0&251693564521475219700920220763687359166473755234092339003910000&0&0&0&0\cr
0&0&-5351235319142904201522225965512143075699768000894840300&0&0&11643497827837801763248586973862843084330167466119804398647668985100000&0&0&0\cr
2070185663499849&0&0&-9008836591414248716424316866000&0&0&9800949035846008678895673107522190930361000000&0&0\cr
0&95768051606757749647890&0&0&-416754276109143908313505917054448260000&0&0&453397880977148227551007964314572140974967380210000000&0\cr
0&0&4430288485840093620938676612900&0&0&-19279307032917423776366854961548179721038600000&0&0&20974462546710273066928434544050339130507985738616528100000000}\right]\)
LLL化簡\(B=\left[ \matrix{
2070185663499849&0&0&-9008836591414248716424316866000&0&0&9800949035846008678895673107522190930361000000&0&0\cr
0&95768051606757749647890&0&0&-416754276109143908313505917054448260000&0&0&453397880977148227551007964314572140974967380210000000&0\cr
-2500525795354160459269142958652241224443&0&0&5440774873514967046498526949032608069078072148942531000&0&0&0&0&0\cr
0&0&4430288485840093620938676612900&0&0&-19279307032917423776366854961548179721038600000&0&0&20974462546710273066928434544050339130507985738616528100000000\cr
0&-115675848613818628883670707444457456909880090230&0&0&251693564521475219700920220763687359166473755234092339003910000&0&0&0&0\cr
3020322941789135243826751301254310584993059920451586964677899601&0&0&0&0&0&0&0&0\cr
0&0&-5351235319142904201522225965512143075699768000894840300&0&0&11643497827837801763248586973862843084330167466119804398647668985100000&0&0&0\cr
0&139721981684159887751924249514318172791235797686641888454048089061016610&0&0&0&0&0&0&0\cr
0&0&6463624103118063744935544456324562407407970654820642611436221569296955598732100&0&0&0&0&0&0}\right]\)
產生不需要同餘\(N^2\)的方程式
\(\displaystyle r(x)= 2070185663499849 + 0 ( \frac{x}{46260610} ) + 0 (\frac{x}{46260610})^2 \)
\(\displaystyle -9008836591414248716424316866000 (\frac{x}{46260610})^3 + 0 (\frac{x}{46260610})^4 + 0 (\frac{x}{46260610})^5\)
\(\displaystyle +9800949035846008678895673107522190930361000000 (\frac{x}{46260610})^6 + 0 (\frac{x}{46260610})^7 + 0 (\frac{x}{46260610})^8 \)
\(r(x)=x^6-90998586x^3+2070185663499849=(x-357)^2(x^2+357x+127449)^2 \)
整數解為\( [x=357] \)
Evaluation took 0.3280 seconds (0.3280 elapsed) using 88.429 MB.
(X) \([x=357]\)

從密文\(c_1,c_2\),兩個補綴值的差\(t=T_2-T_1\)求得加上補綴值得明文\(m_1\)
(%i20) m1:t*(c2+2*c1-t^3)/(c2-c1+2*t^3);
(m1) \(\displaystyle \frac{t(5645030747741020761470543223-t^3)}{2t^3+1632373556178779336223}\)

將\(t\)值帶入\(m_1\)公式
(%i21) ev(m1,t=rhs(X[1]));
(%o21) \(1234567890\)

將後5位補綴值刪除,得到明文M
(%i22) M:floor(%/10^5);
(M) \(12345\)




歡迎光臨 Math Pro 數學補給站 (https://math.pro/db/) 論壇程式使用 Discuz! 6.1.0