Board logo

標題: 用Maxima學密碼學-Lattice Reduction應用2-找出同餘方程式較小的解 [打印本頁]

作者: bugmens    時間: 2021-4-15 10:20     標題: 用Maxima學密碼學-Lattice Reduction應用2-找出同餘方程式較小的解









方法

範例

問題敘述

設同餘方程式為\(f(x)=a_d x^d+a_{d-1}x^{d-1}+\ldots+a_1 x+a_0\equiv 0 \pmod{N}\)
利用LLL方法可以找出比邊界\(X\)還小的解\(x_0\)(\( |\;x_0|\;<X=N^{\displaystyle \frac{2}{d(d+1)}}\))
使得\(f(x_0)\equiv 0 \pmod{N}\)
設同餘方程式為\(f(x)=1131x^3+14531x^2+116024x+57592\equiv 0 \pmod{123107}\)
\(\displaystyle d=3,X=N^{\frac{2}{3\cdot 4}}=7.0531\)
利用LLL方法可以找出比邊界\(X=7\)還小的解
使得\(f(x_0)\equiv 0 \pmod{123107}\)

步驟1.產生lattice證明向量線性組合方程式的解和原方程式相同。

將\(f(x)\)各項係數取lattice如下
\(B=\matrix{\matrix{常數項&1次方&2次方&\ldots&d-1次方&d次方&} \cr \left[\matrix{a_0&a_1X&a_2X^2&\ldots&a_{d-1}X^{d-1}&a_dX^d&\frac{1}{d+1} \cr N&0&0&0&0&0&0\cr
0&NX&0&0&0&0&0\cr
0&0&NX^2&0&0&0&0\cr
&&&\ddots&&&\cr
0&0&0&0&NX^{d-1}&0&0\cr
0&0&0&0&0&NX^d&0}\right]}\)
該lattice的向量線性組合為
\(\matrix{\matrix{s\cr -s_0 \cr -s_1 \cr -s_2 \cr \vdots \cr -s_{d-1}\cr -s_d}&\left[\matrix{a_0&a_1X&a_2X^2&\ldots&a_{d-1}X^{d-1}&a_dX^d&\frac{1}{d+1} \cr N&0&0&0&0&0&0\cr
0&NX&0&0&0&0&0\cr
0&0&NX^2&0&0&0&0\cr
&&&\ddots&&&\cr
0&0&0&0&NX^{d-1}&0&0\cr
0&0&0&0&0&NX^d&0}\right]}\)
\(=\left[\matrix{sa_0&sa_1X&sa_2X^2&\ldots&sa_{d-1}X^{d-1}&sa_dX^d&\frac{s}{d+1}\cr
-s_0N&0&0&0&0&0&0\cr
0&-s_1NX&0&0&0&0&0\cr
0&0&-s_2NX^2&0&0&0&0\cr
0&0&0&\ddots&0&0&0\cr
0&0&0&0&-s_{d-1}NX^{d-1}&0&0\cr
0&0&0&0&0&-s_dNX^d&0}\right]\)
\(=[(sa_0-s_0N),(sa_1-s_1N)X,\ldots,(sa_{d-1}-s_{d-1}N)X^{d-1},(sa_d-s_dN)X^d,\frac{s}{d+1}]\)

將向量線性組合前\(d+1\)個分量除以\(X^i\)為係數的方程式
\(h(x)=(sa_0-s_0N)+(sa_1-s_1N)x+\ldots+(sa_{d-1}-s_{d-1}N)x^{d-1}+(sa_d-s_dN)x^d\)
 \(=s(a_0+a_1x+\ldots+a_{d-1}x^{d-1}+a_d x^d)-N(s_0+s_1x^1+\ldots+s_{d-1}x^{d-1}+s_dx^d)\)
 \(=sf(x)-N(s_0+s_1x^1+\ldots+s_{d-1}x^{d-1}+s_dx^d)\)
得到\(h(x)\equiv sf(x)\pmod{N}\)
若\(x=x_0\)是\(h(x)\equiv 0 \pmod{N}\)的解,那\(x=x_0\)也會是\(f(x)\equiv 0 \pmod{N}\)的解。
\(B=\left[\matrix{57592&116024\cdot 7^1&14531\cdot 7^2&1131\cdot 7^3& \frac{1}{4}\cr
123107&0&0&0&0\cr
0&123107\cdot 7^1&0&0&0\cr
0&0&123107\cdot 7^2&0&0\cr
0&0&0&123107\cdot 7^3&0}\right]\)

  \(\left[\matrix{57592&812168&712019&387933&\frac{1}{4}\cr
123107&0&0&0&0\cr
0&861749&0&0&0\cr
0&0&6032243&0&0\cr
0&0&0&42225701&0}
\right]\)

步驟2.經LLL化簡得到短向量所形成的方程式不需再同餘\(N\)。

lattice經LLL化簡後第一行為整個lattice中較短向量
取前\(d+1\)個分量\((c_0,c_1X,\ldots,c_{d-1}X^{d-1},c_dX^d)\)將每個分量除以\(X^i\)得到係數\(c_i\)
將係數\(c_i\)組成新方程式\(\displaystyle h(x)=\sum_{i=0}^d c_ix^i\)
若每個係數\(\displaystyle |\;c_i|\;<\frac{N}{(d+1)X^i}\),要求的解\(x\)小於邊界\(X\)(\(|\;x|\;<X\))。
\(\displaystyle |\;h(x)|\;= |\;\sum_{i=0}^d c_i x^i|\;\le \sum_{i=0}^d |\;c_i|\; |\;x|\;^i<\sum_{i=0}^d \frac{N}{(d+1)X^i} X^i\)
\(\displaystyle =\sum_{i=0}^d \frac{N}{d+1}=\frac{N}{d+1}\cdot (d+1)=N\),得到\(|\;h(x)|\;<N\)
原本要解同餘方程式\(h(x)\equiv 0\pmod{N}\),因為\(|\;h(x)|\;<N\),變成解一般方程式\(h(x)=0\)。
\(B=\left[\matrix{-9310&13671&-4704&343&5905\cr
9310&-13671&4704&-343&\frac{99487}{4}\cr
85867&54684&-18816&1372&-\frac{28627}{4}\cr
-28932&-96173&-263424&19208&-\frac{31457}{4}\cr
44745&-4151&-100499&-432523&\frac{3537}{2}}\right]\)
\(\displaystyle h(x)=-9310+\frac{13671}{7^1}x-\frac{4704}{7^2}x^2+\frac{343}{7^3}x^3\)
  \(=-9310+1953x-96x^2+x^3\)
其中各項係數符合
\(\displaystyle |\;-9310|\;<\frac{123107}{4\cdot 7^0}=30776.75\)
\(\displaystyle |\;1953|\;<\frac{123107}{4\cdot 7^1}=4396.68\)
\(\displaystyle |\;-96|\;<\frac{123107}{4\cdot 7^2}=628.10\)
\(\displaystyle |\;1|\;<\frac{123107}{4\cdot 7^3}=89.73\)

步驟3.解一般方程式得到小於\(X\)的解\(x=x_0\)。

\(h(x)=(x-7)(x-19)(x-70)=0\)
\(x=7,19,70\),也是\(f(x)\equiv 0 \pmod{123107}\)的解。
驗算
\(f(7)=1969712\equiv 0\pmod{123107}\)
\(f(19)=15265268\equiv 0\pmod{123107}\)
\(f(70)=467314172\equiv 0\pmod{123107}\)


步驟4.計算邊界\(X\)的範圍
計算行列式值\(\displaystyle det(B)\)
\(=\left|\ \matrix{a_0&a_1X&a_2X^2&\ldots&a_{d-1}X^{d-1}&a_dX^d&\frac{1}{d+1} \cr N&0&0&0&0&0&0\cr
0&NX&0&0&0&0&0\cr
0&0&NX^2&0&0&0&0\cr
&&&\ddots&&&\cr
0&0&0&0&NX^{d-1}&0&0\cr
0&0&0&0&0&NX^d&0}\right|\)
以第\(d+2\)行降階,0降階後仍是0,只剩下\(\displaystyle \frac{1}{d+1}\)再乘上餘因子
\(\displaystyle =\frac{1}{d+1}\left|\matrix{N&0&0&0&0&0\cr
0&NX&0&0&0&0\cr
0&0&NX^2&0&0&0\cr
&&&\ddots&&\cr
0&0&0&0&NX^{d-1}&0\cr
0&0&0&0&0&NX^d} \right|\)
行列式只有對角線有值,其餘為0,行列式值由對角線元素相乘
\(\displaystyle =\frac{N^{d+1}X^{\frac{d(d+1)}{2}}}{d+1}\)

經LLL化簡後的第一列向量\(\vec{b_1}\)是整個lattice中較短的向量,向量長度符合不等式\(\Vert\;\vec{b_1}\Vert\;\le 2^{(n-1)/4}\cdot (det(B))^{1/n}\)
https://en.wikipedia.org/wiki/Le ... reduction_algorithm

其中lattice有\(d+2\)列,\(n=d+2\)。將\(\displaystyle det(B)=\frac{N^{d+1}X^{\frac{d(d+1)}{2}}}{d+1}\)代入得到\(\displaystyle \Vert\;\vec{b_1}\Vert\;\le 2^{\frac{d+1}{4}}\left(\frac{N^{d+1}X^{\frac{d(d+1)}{2}}}{d+1}\right)^{\frac{1}{d+2}}\)

若想找到邊界\(X\)的範圍,需要第一列向量長度再小於\(\displaystyle \frac{N}{d+1}\)和需要\(\displaystyle 2^{\frac{d+1}{4}}\left(\frac{N^{d+1}X^{\frac{d(d+1)}{2}}}{d+1}\right)^{\frac{1}{d+2}}<\frac{N}{d+1}\)
不等式兩邊\(d+2\)次方,\(\displaystyle 2^{\frac{(d+1)(d+2)}{4}}\frac{N^{d+1}X^{\frac{d(d+1)}{2}}}{d+1}<\frac{N^{d+2}}{(d+1)^{d+2}}\)
重新整理不等式,\(\displaystyle 2^{\frac{(d+1)(d+2)}{4}}(d+1)^{d+1}X^{\frac{d(d+1)}{2}}<N\)
令\(\epsilon(d)=2^{\frac{(d+1)(d+2)}{4}}(d+1)^{d+1}\)僅和\(d\)有關的函數,當\(d\)固定時\(\epsilon(d)\)是常數
\(\epsilon(d)X^{\frac{d(d+1)}{2}}<N\),得到邊界\(\displaystyle X<N^{\frac{2}{d(d+1)}}\)

參考資料
Håstad, J.: Solving Simultaneous Modular Equations of Low Degree. SIAM Journalon Computing 17(2), 336–341 (1988)
http://www.csc.kth.se/~johanh/rsalowexponent.pdf
http://citeseerx.ist.psu.edu/vie ... p=rep1&type=pdf
註:
原本論文以\(n\)代表邊界,但之後的資料改以\(X\)表示,本文章也以\(X\)表示能找到小於\(X\)的解\(x_0\)。



請下載LLL.zip,解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下
要先載入LLL.mac才能使用LLL指令

(%i1) load("LLL.mac");
(%o1) C:/maxima-5.43.2/share/maxima/5.43.2/LLL.mac

同餘方程式\(f(x)\)
(%i2) fx:1131*x^3+14531*x^2+116024*x+57592;
(fx) \(1131x^3+14531x^2+116024x+57592\)

\(f(x)\equiv 0\pmod{N}\)
(%i3) N:123107;
(N) \(123107\)

\(f(x)\)的次數d
(%i4) d:hipow(fx,x);
(d) \(3\)

希望能找到\(|\;x|\;<X=N^{2/d(d+1)}\),\(f(x)\equiv 0\pmod{N}\)
(%i5) X:floor(N^(2/(d*(d+1))));
(X) \(7\)

定義lattice產生方式
(%i7)
kill(genlattice)$
genlattice[i,j]:=
if i=1 and j=d+2 then 1/(d+1)/*第1列第d+2行為1/(d+1)*/
else if i=1 then coeff(fx,x,j-1)*X^(j-1)/*第一行為f(x)係數乘上X^(j-1)*/
else if i=j+1 then N*X^(j-1)/*子對角線為NX^(j-1)*/
else 0$/*剩下元素為0*/


根據\(f(x)\)係數,產生lattice
(%i8) latticeB:genmatrix(genlattice,d+2,d+2);
(latticeB) \(\left[\matrix{\displaystyle 57592&812168&712019&387933&\frac{1}{4}\cr
123107&0&0&0&0\cr
0&861749&0&0&0\cr
0&0&6032243&0&0\cr
0&0&0&42225701&0}\right]\)

經LLL化簡後的lattice B
(%i9) latticeB: LLL(latticeB);
(latticeB) \(\left[\matrix{\displaystyle -9310&13671&-4704&343&5905\cr
9310&-13671&4704&-343&\frac{99487}{4}\cr
85867&54684&-18816&1372&-\frac{28627}{4}\cr
-28932&-96173&-263424&19208&-\frac{31457}{4}\cr
44745&-4151&-100499&-432523&\frac{3537}{2}}\right]\)

lattice第一行是整個lattice中較短的向量\(\vec{b_1}\)
(%i10) b1:latticeB[1];
(b1) \([-9310,13671,-4704,343,5905]\)

取\(\vec{b_1}\)前\(d+1\)個分量除以\(X^i\)乘上\(x^i\)形成\(h(x)\)
(%i11) hx:sum(b1[i+1]/X^i*x^i,i,0,d);
(hx) \(x^3-96x^2+1953x-9310\)

將\(h(x)\)因式分解
(%i12) factor(hx);
(%o12) \((x-70)(x-19)(x-7)\)

得到\(h(x)\)的解,因為這個範例比較簡單\(f(x)\equiv 0\pmod{N}\)的三個解都找出來
(%i13) roots:solve(hx,x);
(roots) \([x=7,x=19,x=70]\)

驗證答案
(%i14)
for root in roots do
  (print(將,root,代入f(,rhs(root),)=,ev(fx,root),≡0 (mod ,N,))
  )$

將\(x=7\)代入\(f(7)=1969712\equiv 0 \pmod{123107}\)
將\(x=19\)代入\(f(19)=15265268\equiv 0 \pmod{123107}\)
將\(x=70\)代入\(f(70)=467314172\equiv 0 \pmod{123107}\)
作者: bugmens    時間: 2021-5-10 16:40

使用低次方公鑰\(e\)的RSA傳送線性相關訊息是不安全的,傳送超過\(\displaystyle \frac{e(e+1)}{2}\)個加密訊息能讓破解者回復原本的訊息。

設使用低次方公鑰\(e=3\),原本訊息\(m\),在訊息後面串接加密時間\(TimeStamp_i\)當作補綴,計算3次方後同餘\(n_i\)得到密文\(Cipertext_i\)。
\(Cipertext_i=(10000m+TimeStamp_i)^3\pmod{n_i}\)
當破解者收集超過\(\displaystyle \frac{3\cdot 4}{2}=6\)個密文\(Cipertext_i\)、加密時間\(TimeStamp_i\)和公鑰\(n_i\),利用前一篇文章的方法可以在多項式時間內回復原本的訊息\(m\)。
此時\(\displaystyle n_1>2^{\frac{(e+1)(e+2)}{4}}(e+1)^{(e+1)}\),\(n=min(n_i)\),\(n_i\ge n\)
\(\displaystyle N=\prod_{i=1}^k n_i\ge n_1\prod_{i=2}^{\frac{d(d+1)}{2}+1}n_i>2^{\frac{(e+1)(e+2)}{2}}(e+1)^{(e+1)}n^{\frac{d(d+1)}{2}}\)

破解者收集到7組密文、加密時間和公鑰
\(TimeStamp_1=\)13點40分產生密文\(Cipertext_1=10117\),公鑰\(n_1=14857\)
\(TimeStamp_2=\)13點47分產生密文\(Cipertext_2=13166\),公鑰\(n_2=15397\)
\(TimeStamp_3=\)13點56分產生密文\(Cipertext_3=11707\),公鑰\(n_3=16199\)
\(TimeStamp_4=\)14點09分產生密文\(Cipertext_4=1590\),公鑰\(n_4=16463\)
\(TimeStamp_5=\)14點18分產生密文\(Cipertext_5=15758\),公鑰\(n_5=16171\)
\(TimeStamp_6=\)14點20分產生密文\(Cipertext_6=7371\),公鑰\(n_6=16157\)
\(TimeStamp_7=\)14點24分產生密文\(Cipertext_7=6303\),公鑰\(n_7=16241\)

根據密文和加密時間產生多項式
\(f_i(x)=(10000x+TimeStamp_i)^3-Cipertext_i\pmod{n_i}\)
\(f_1(x)=(10000x+1340)^3-10117\equiv-7380x^3+7136x^2-5462x+2733\pmod{14857}\)
\(f_2(x)=(10000x+1347)^3-13166\equiv1351x^3+7316x^2-5044x-847\pmod{15397}\)
\(f_3(x)=(10000x+1356)^3-11707\equiv-4994x^3+4461x^2-2123x-3373\pmod{16199}\)
\(f_4(x)=(10000x+1409)^3-1590\equiv-7473x^3-3954x^2+4418x-1917\pmod{16463}\)
\(f_5(x)=(10000x+1418)^3-15758\equiv-5245x^3-2021x^2-7211x+1009\pmod{16171}\)
\(f_6(x)=(10000x+1420)^3-7371\equiv1554x^3-2117x^2-1884x+1717\pmod{16157}\)
\(f_7(x)=(10000x+1424)^3-6303\equiv4317x^3+441x^2-301x-5633\pmod{16241}\)

\(\displaystyle N=\prod_{i=1}^7 n_i=258865864180238903908838873371\)
\(X=\lfloor\;N^{2/(d(d+1))}\rfloor\;=79832\)

利用中國餘數定理計算新的方程式係數
將\(f_i(x)\)的常數項係數以中國餘數定理計算新的常數項\(c_0\)
\(c_0\equiv\cases{2733\pmod{14857}\cr
-847\pmod{15397}\cr
-3373\pmod{16199}\cr
-1917\pmod{16463}\cr
1009\pmod{16171}\cr
1717\pmod{16157}\cr
-5633\pmod{16241}}\),\(c_0\equiv 204373190208566474382317165684\pmod{N}\)

將\(f_i(x)\)的1次方係數以中國餘數定理計算新的1次方係數\(c_1\)
\(c_1\equiv\cases{-5462\pmod{14857}\cr
-5044\pmod{15397}\cr
-2123\pmod{16199}\cr
4418\pmod{16463}\cr
-7211\pmod{16171}\cr
-1884\pmod{16157}\cr
-301\pmod{16241}}\),\(c_1\equiv 249751034306884980399002316934\pmod{N}\)

將\(f_i(x)\)的2次方係數以中國餘數定理計算新的2次方係數\(c_2\)
\(c_2\equiv\cases{7136\pmod{14857}\cr
7316\pmod{15397}\cr
4461\pmod{16199}\cr
-3954\pmod{16463}\cr
-2021\pmod{16171}\cr
-2117\pmod{16157}\cr
441\pmod{16241}}\),\(c_2\equiv 189008702173331023044971363347\pmod{N}\)

將\(f_i(x)\)的3次方係數以中國餘數定理計算新的3次方係數\(c_3\)
\(c_3\equiv\cases{-7380\pmod{14857}\cr
1351\pmod{15397}\cr
-4994\pmod{16199}\cr
-7473\pmod{16463}\cr
-5245\pmod{16171}\cr
1554\pmod{16157}\cr
4317\pmod{16241}}\),\(c_3\equiv 1000000000000\pmod{N}\)

產生新的同餘方程式\(g(x)\pmod{N}\),若\(x=x_0\)是\(g(x)\equiv 0\pmod{N}\)解,那\(x=x_0\)也會是\(f_i(x)\equiv 0\pmod{n_i}\)的解
\(g(x)=c_0+c_1x+c_2x^2+c_3x^3\pmod{N}\)
 \(=204373190208566474382317165684+249751034306884980399002316934x+189008702173331023044971363347x^2+1000000000000x^3\pmod{N}\)

產生lattice,希望能找到較小的解\(x=x_0\)\((x_0<X=78932)\)
\(B=\left[\matrix{c_0&c_1X&c_2X^2&c_3X^3&\frac{1}{d+1}\cr
N&0&0&0&0\cr
0&NX&0&0&0\cr
0&0&NX^2&0&0\cr
0&0&0&NX^3&0}\right]\)
\(\left[\matrix{
204373190208566474382317165684&19938124570787241755213152965475088&1204580474576509549683162316445791745728&508781169018368000000000000&\frac{1}{4}\cr
258865864180238903908838873371&0&0&0&0\cr
0&20665779669236832176850424938953672&0&0&0\cr
0&0&1649790522554514786342323123726549543104&0&0\cr
0&0&0&131706076996572024423280339613337903125078528&0}\right]\)

經LLL化簡lattice
\(B=\left[\matrix{
0&0&0&0&\frac{258865864180238903908838873371}{4}\cr
19032544658836594241198114925&-110020730529168337991621111320&-69821420216485869263622535616&-94549927515912701524841700864&-\frac{74058264293788734740876853939}{4}\cr
2056083148951895180465932260&8991794266570450022519459504&-157772457706749993512226999616&88218148052792936245521824256&-\frac{31442973836260991406843209159}{2}\cr
258865864180238903908838873371&0&0&0&0\cr
-60101849692113834636025787760&433902895535857979265114013016&-240340197778189487664217294976&-337639116008434960645370124800&-\frac{44674685201276114130186287835}{4}}\right]\)

第1列向量都是0,改取第2列向量
\(\vec{b_2}=[19032544658836594241198114925,-110020730529168337991621111320,-69821420216485869263622535616,-94549927515912701524841700864,-\frac{74058264293788734740876853939}{4}]\)

化簡後方程式\(h(x)\)不需要同餘\(N\)
\(\displaystyle h(x)=\frac{19032544658836594241198114925}{X^0}-\frac{110020730529168337991621111320}{X^1}x-\frac{69821420216485869263622535616}{X^2}x^2-\frac{94549927515912701524841700864}{X^3}x^3\)
 \(\displaystyle =\frac{19032544658836594241198114925}{79832^0}-\frac{110020730529168337991621111320}{79832^1}x-\frac{69821420216485869263622535616}{79832^2}x^2-\frac{94549927515912701524841700864}{79832^3}x^3\)
 \(=19032544658836594241198114925-1378153253446842594343385x-10955561955008732159x^2-185836137957573x^3\)
 \(=-(x-12345)(185836137957573x^2+13249709078094970844x+1541720912015925009412565)\)
得\(x=12345\)


參考資料
Håstad, J.: Solving Simultaneous Modular Equations of Low Degree. SIAM Journalon Computing 17(2), 336–341 (1988)
http://www.csc.kth.se/~johanh/rsalowexponent.pdf
http://citeseerx.ist.psu.edu/vie ... p=rep1&type=pdf
註:
原本論文以n代表邊界,但之後的資料改以X表示,本文章也以X表示能找到小於X的解x0。


請下載LLL.zip,解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下
要先載入LLL.mac才能使用LLL指令

(%i1) load("LLL.mac");
(%o1) C:/maxima-5.43.2/share/maxima/5.43.2/LLL.mac

有7個密文
(%i2) Cipertext:[10117,13166,11707,1590,15758,7371,6303];
(Cipertext) \([10117,13166,11707,1590,15758,7371,6303]\)

有7個公鑰\(n_i\)
(%i3) n:[14857,15397,16199,16463,16171,16157,16241];
(n) \([14857,15397,16199,16463,16171,16157,16241]\)

有7個時戳
(%i4) Timestamp:[1340,1347,1356,1409,1418,1420,1424];
(Timestamp) \([1340,1347,1356,1409,1418,1420,1424]\)

公鑰\(e\)
(%i5) e:3;
(e) 3

同餘方程式最高次方\(d\)
(%i6) d:e;
(d) 3

根據密文和時戳產生同餘方程式\(f_i(x)\)
(%i7) fx:create_list(polymod((10000*x+Timestamp[ i ])^3-Cipertext[ i ],n[ i ]),i,1,length(n));
(fx) \(\matrix{[-7380x^3+7136x^2-5462x+2733,\cr
1351x^3+7316x^2-5044x-847,\cr
-4994x^3+4461x^2-2123x-3373,\cr
-7473x^3-3954x^2+4418x-1917,\cr
-5245x^3-2021x^2-7211x+1009,\cr
1554x^3-2117x^2-1884x+1717,\cr
4317x^3+441x^2-301x-5633]}\)

\(f_i(x)\)的常數項係數
(%i8) a0:create_list(coeff(fx[ i ],x,0),i,1,length(n));
(a0) \([2733,-847,-3373,-1917,1009,1717,-5633]\)

\(f_i(x)\)的1次方係數
(%i9) a1:create_list(coeff(fx[ i ],x,1),i,1,length(n));
(a1) \([-5462,-5044,-2123,4418,-7211,-1884,-301]\)

\(f_i(x)\)的2次方係數
(%i10) a2:create_list(coeff(fx[ i ],x,2),i,1,length(n));
(a2) \([7136,7316,4461,-3954,-2021,-2117,441]\)

\(f_i(x)\)的3次方係數
(%i11) a3:create_list(coeff(fx[ i ],x,3),i,1,length(n));
(a3) \([-7380,1351,-4994,-7473,-5245,1554,4317]\)

利用中國餘數定理計算新的常數項\(c_0\)
(%i12) c0:chinese(a0,n);
(c0) \(204373190208566474382317165684\)

利用中國餘數定理計算新的1次方係數\(c_1\)
(%i13) c1:chinese(a1,n);
(c1) \(249751034306884980399002316934\)

利用中國餘數定理計算新的2次方係數\(c_2\)
(%i14) c2:chinese(a2,n);
(c2) \(189008702173331023044971363347\)

利用中國餘數定理計算新的3次方係數\(c_3\)
(%i15) c3:chinese(a3,n);
(c3) \(1000000000000\)

產生新的同餘方程式\(g(x)\pmod{N}\),若\(x=x_0\)是\(g(x)\equiv 0\pmod{N}\)的解,那\(x=x_0\)也會是\(f_i(x)\equiv 0\pmod{n_i}\)的解
(%i16) gx:c0+c1*x+c2*x^2+c3*x^3;
(gx) \(1000000000000x^3+189008702173331023044971363347x^2+249751034306884980399002316934x+204373190208566474382317165684\)

\(N=\prod_{i=1}^7 n_i\)
(%i17) N:product(n[ i ],i,1,length(n));
(N) \(258865864180238903908838873371\)

希望能找到\(|\;x_0|\;<X=\lfloor\;N^{2/(d(d+1))} \rfloor\;,g(x_0)\equiv 0\pmod{N}\)
(%i18) X:floor(N^(2/(d*(d+1))));
(X) \(79832\)

定義lattice產生方式
(%i20)
kill(genlattice)$
genlattice[i,j]:=
if i=1 and j=d+2 then 1/(d+1)/*第1列第d+2行為1/(d+1)*/
else if i=1 then coeff(gx,x,j-1)*X^(j-1)/*第一行為f(x)係數乘上X^(j-1)*/
else if i=j+1 then N*X^(j-1)/*子對角線為NX^(j-1)*/
else 0$/*剩下元素為0*/


根據\(g(x)\)係數,產生lattice
(%i21) latticeB:genmatrix(genlattice,d+2,d+2);
(latticeB) \(\left[\matrix{
204373190208566474382317165684&19938124570787241755213152965475088&1204580474576509549683162316445791745728&508781169018368000000000000&\frac{1}{4}\cr
258865864180238903908838873371&0&0&0&0\cr
0&20665779669236832176850424938953672&0&0&0\cr
0&0&1649790522554514786342323123726549543104&0&0\cr
0&0&0&131706076996572024423280339613337903125078528&0}\right]\)

經LLL化簡後的lattice B
(%i22) latticeB: LLL(latticeB);
(latticeB) \(\left[\matrix{
0&0&0&0&\frac{258865864180238903908838873371}{4}\cr
19032544658836594241198114925&-110020730529168337991621111320&-69821420216485869263622535616&-94549927515912701524841700864&-\frac{74058264293788734740876853939}{4}\cr
2056083148951895180465932260&8991794266570450022519459504&-157772457706749993512226999616&88218148052792936245521824256&-\frac{31442973836260991406843209159}{2}\cr
258865864180238903908838873371&0&0&0&0\cr
-60101849692113834636025787760&433902895535857979265114013016&-240340197778189487664217294976&-337639116008434960645370124800&-\frac{44674685201276114130186287835}{4}}\right]\)

第1列向量都是0,改取第2列向量
(%i23) b2:latticeB[2];
(b2) \([19032544658836594241198114925,-110020730529168337991621111320,-69821420216485869263622535616,-94549927515912701524841700864,-\frac{74058264293788734740876853939}{4}]\)

化簡後方程式\(h(x)\)不需要同餘\(N\)
(%i24) hx:sum(b2[i+1]/X^i*x^i,i,0,d);
(hx) \(-185836137957573x^3-10955561955008732159x^2-1378153253446842594343385x+19032544658836594241198114925\)

將h(x)因式分解
(%i25) factor(hx);
(%o25) \(-(x-12345)(185836137957573x^2+13249709078094970844x+1541720912015925009412565)\)

得到較小的解\(x\)
(%i26) x:12345;
(x) \(12345\)

驗證答案\(f_i(12345)\equiv 0 \pmod{n_i}\)
(%i27) create_list(mod(ev(fx[ i ],x=x),n[ i ]),i,1,length(n));
(%o27) \([0,0,0,0,0,0,0]\)
作者: bugmens    時間: 2021-5-22 00:05

Rabin加密法請參閱wiki。https://en.wikipedia.org/wiki/Rabin_cryptosystem


公式範例
產生金鑰
1.選擇兩個不相同的大質數\(p\)和\(q\),其中\(p\equiv 3\pmod{4}\)和\(q\equiv 3\pmod{4}\)
2.計算\(n=pq\)
\(n\)是公鑰和\((p,q)\)是私鑰
私鑰\(p=7\)和\(q=11\)
公鑰\(n=77\)
加密
訊息\(M\)轉換成數字\(m\)(\(m<n\))
計算密文\(c=m^2\pmod{n}\)
明文\(m=20\)
密文\(c=20^2=400=15\pmod{77}\)
解密
計算密文\(c\)在同餘\(n\)的平方根得到\(m\)
1.計算\(c\)在同餘\(p\)和\(q\)的平方根
\(m_p=c^{\frac{1}{4}(p+1)}\pmod{p}\)
\(m_q=c^{\frac{1}{4}(q+1)}\pmod{q}\)
2.使用擴展歐幾里得演算法計算\(y_p\)和\(y_q\)使得\(y_p\cdot p+y_q\cdot q=1\)。
3.使用中國餘數定理\(c\)在同餘\(n\)的平方根
\(r_1=(y_p\cdot p\cdot m_q+y_q\cdot q\cdot m_p)\pmod{n}\)
\(r_2=n-r_1\)
\(r_3=(y_p\cdot p\cdot m_q-y_q\cdot q\cdot m_p)\pmod{n}\)
\(r_4=n-r_3\)
4個\(r_i\)值其中一個會是明文\(m\)
1.計算\(m_p=15^{\frac{1}{4}(7+1)}=15^2=1\pmod{7}\)
\(m_q=15^{\frac{1}{4}(11+1)}=15^3=9\pmod{11}\)
2.使用擴展歐幾里得演算法計算\(y_p\)和\(y_q\)
\(p=7\),\(q=11\)
\(q-p=11-7=4\)
\(p-(q-p)=7-4\),\(2p-q=3\)
\((q-p)-(2p-q)=4-3\),\(-3p+2q=1\)
\(y_p=-3\)和\(y_q=2\)
3.計算4個\(r_i\)值
\(r_1=(-3\cdot 7\cdot 9+2\cdot 11\cdot 1)\pmod{77}=64\)
\(r_2=77-64=13\)
\(r_3=(-3\cdot 7\cdot 9-2\cdot 11\cdot 1)\pmod{77}=20\)
\(r_4=77-20=57\)
其中\(r_3=20\)是當初的明文


使用Rabin加密函數傳送線性相關訊息是不安全的,傳送3個加密訊息能讓破解者在多項式時間內回復原本的訊息。

設原本訊息\(m\),在訊息後面串接加密時間\(TimeStamp_i\)當作補綴,計算2次方後同餘\(n_i\)得到密文\(Cipertext_i\)。
\(Cipertext_i=(10000m+TimeStamp_i)^2\pmod{n_i}\)
破解者收集到3組密文、加密時間和公鑰
\(TimeStamp_1=\)13點40分產生密文\(Cipertext_1=5926\),公鑰\(n_1=14857\)
\(TimeStamp_2=\)13點47分產生密文\(Cipertext_2=3031\),公鑰\(n_2=15397\)
\(TimeStamp_3=\)13點56分產生密文\(Cipertext_3=5421\),公鑰\(n_3=16199\)

根據密文和加密時間產生多項式
\(f_i(x)=(10000x+TimeStamp_i)^2-Cipertext_i\pmod{n_i}\)
\(f_1(x)=-2467x^2-2028x+6834\pmod{14857}\)
\(f_2(x)=-3515x^2-4750x-5468\pmod{15397}\)
\(f_3(x)=3573x^2+2874x+2828\pmod{16199}\)

\(\displaystyle N=\prod_{i=1}^3 n_i=3705573556571\)
\(X=\lfloor\;N^{2/(d(d+1))}\rfloor\;=15474\)

利用中國餘數定理計算新的方程式係數
將\(f_i(x)\)的常數項係數以中國餘數定理計算新的常數項\(c_0\)
\(c_0\equiv\cases{6834\pmod{14857}\cr -5468\pmod{15397}\cr 2828\pmod{16199}}\),\(c_0\equiv 489114568907 \pmod{N}\)

將\(f_i(x)\)的1次方係數以中國餘數定理計算新的1次方係數\(c_1\)
\(c_1\equiv\cases{-2028 \pmod{14857}\cr -4750\pmod{15397}\cr 2874\pmod{16199}}\),\(c_1\equiv 3243065948060 \pmod{N}\)

將\(f_i(x)\)的2次方係數以中國餘數定理計算新的2次方係數\(c_1\)
\(c_2\equiv\cases{-2467 \pmod{14857}\cr -3515\pmod{15397}\cr 3573\pmod{16199}}\),\(c_2\equiv 100000000 \pmod{N}\)

產生新的同餘方程式\(g(x)\pmod{N}\),若\(x=x_0\)是\(g(x)\equiv 0\pmod{N}\)解,那\(x=x_0\)也會是\(f_i(x)\equiv 0\pmod{n_i}\)的解
\(g(x)=c_0+c_1x+c_2x^2\pmod{N}\)
 \(=489114568907+3243065948060x+100000000x^2\pmod{N}\)

產生lattice,希望能找到較小的解\(x=x_0\)\((x_0<X=15474)\)
\(B=\left[\matrix{c_0&c_1X&c_2X^2&\frac{1}{d+1}\cr
N&0&0&0\cr
0&NX&0&0\cr
0&0&NX^2&0}\right]\)
\(\left[\matrix{489114568907&50183202480280440&23944467600000000&\frac{1}{3}\cr
3705573556571&0&0&0\cr
0&57340045214379654&0&0\cr
0&0&887279859647310765996&0}\right]\)

經LLL化簡lattice
\(B=\left[\matrix{0&0&0&\frac{3705573556571}{3}\cr
3705573556571&0&0&0\cr
-705084292305&-1585793949534&3095540771328&\frac{167522755129}{3}\cr
233266894054&-3534864776520&-1757763366516&240304851747}\right]\)

第1,2列向量都有0,改取第3列向量
\(\displaystyle \vec{b_3}=[-705084292305,-1585793949534,3095540771328,\frac{167522755129}{3}]\)

化簡後方程式\(h(x)\)不需要同餘\(N\)
\(\displaystyle h(x)=-\frac{705084292305}{X^0}-\frac{1585793949534}{X^1}x+\frac{3095540771328}{X^2}x^2\)
 \(\displaystyle =-\frac{705084292305}{15474^0}-\frac{1585793949534}{15474^1}x+\frac{3095540771328}{15474^2}x^2\)
 \(=-705084292305-102481191x+12928x^2\)
 \(=(x-12345)(12928x+57114969)\)
得\(x=12345\)


參考資料
Håstad, J.: Solving Simultaneous Modular Equations of Low Degree. SIAM Journalon Computing 17(2), 336–341 (1988)
http://www.csc.kth.se/~johanh/rsalowexponent.pdf
http://citeseerx.ist.psu.edu/vie ... p=rep1&type=pdf
註:
原本論文以n代表邊界,但之後的資料改以X表示,本文章也以X表示能找到小於X的解x0。


請下載LLL.zip,解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下
要先載入LLL.mac才能使用LLL指令

(%i1) load("LLL.mac");
(%o1) C:/maxima-5.43.2/share/maxima/5.43.2/LLL.mac

有3個密文
(%i2) Cipertext:[5926,3031,5421];
(Cipertext) \([5926,3031,5421]\)

有3個公鑰\(n_i\)
(%i3) n:[14857,15397,16199];
(n) \([14857,15397,16199]\)

有3個時戳
(%i4) Timestamp:[1340,1347,1356];
(Timestamp) \([1340,1347,1356]\)

同餘方程式最高次方\(d\)
(%i5) d:2;
(d) 2

根據密文和時戳產生同餘方程式\(f_i(x)\)
(%i6) fx:create_list(polymod((10000*x+Timestamp[ i ])^3-Cipertext[ i ],n[ i ]),i,1,length(n));
(fx) \(\matrix{[-2467x^2-2028x+6834,\cr -3515x^2-4750x-5468,\cr 3573x^2+2874x+2828]}\)

\(f_i(x)\)的常數項係數
(%i7) a0:create_list(coeff(fx[ i ],x,0),i,1,length(n));
(a0) \([6834,-5468,2828]\)

\(f_i(x)\)的1次方係數
(%i8) a1:create_list(coeff(fx[ i ],x,1),i,1,length(n));
(a1) \([-2028,-4750,2874]\)

\(f_i(x)\)的2次方係數
(%i9) a2:create_list(coeff(fx[ i ],x,2),i,1,length(n));
(a2) \([-2467,-3515,3573]\)

利用中國餘數定理計算新的常數項\(c_0\)
(%i10) c0:chinese(a0,n);
(c0) \(489114568907\)

利用中國餘數定理計算新的1次方係數\(c_1\)
(%i11) c1:chinese(a1,n);
(c1) \(3243065948060\)

利用中國餘數定理計算新的2次方係數\(c_2\)
(%i12) c2:chinese(a2,n);
(c2) \(100000000\)

產生新的同餘方程式\(g(x)\pmod{N}\),若\(x=x_0\)是\(g(x)\equiv 0\pmod{N}\)的解,那\(x=x_0\)也會是\(f_i(x)\equiv 0\pmod{n_i}\)的解
(%i13) gx:c0+c1*x+c2*x^2+c3*x^3;
(gx) \(100000000x^2+3243065948060x+489114568907\)

\(\displaystyle N=\prod_{i=1}^3 n_i\)
(%i14) N:product(n[ i ],i,1,length(n));
(N) \(3705573556571\)

希望能找到\(|\;x_0|\;<X=\lfloor\;N^{2/(d(d+1))} \rfloor\;,g(x_0)\equiv 0\pmod{N}\)
(%i15) X:floor(N^(2/(d*(d+1))));
(X) \(15474\)

定義lattice產生方式
(%i17)
kill(genlattice)$
genlattice[i,j]:=
if i=1 and j=d+2 then 1/(d+1)/*第1列第d+2行為1/(d+1)*/
else if i=1 then coeff(gx,x,j-1)*X^(j-1)/*第一行為f(x)係數乘上X^(j-1)*/
else if i=j+1 then N*X^(j-1)/*子對角線為NX^(j-1)*/
else 0$/*剩下元素為0*/


根據\(g(x)\)係數,產生lattice
(%i18) latticeB:genmatrix(genlattice,d+2,d+2);
(latticeB) \(\left[\matrix{
489114568907&50183202480280440&23944467600000000&\frac{1}{3}\cr
3705573556571&0&0&0\cr
0&57340045214379654&0&0\cr
0&0&887279859647310765996&0}\right]\)

經LLL化簡後的lattice B
(%i19) latticeB: LLL(latticeB);
(latticeB) \(\left[\matrix{\displaystyle 0&0&0&\frac{3705573556571}{3}\cr
3705573556571&0&0&0\cr
-705084292305&-1585793949534&3095540771328&\frac{167522755129}{3}\cr
233266894054&-3534864776520&-1757763366516&240304851747}\right]\)

第1,2列向量都有0,改取第3列向量
(%i20) b3:latticeB[3];
(b3) \(\displaystyle [-705084292305,-1585793949534,3095540771328,\frac{167522755129}{3}]\)

化簡後方程式\(h(x)\)不需要同餘\(N\)
(%i21) hx:sum(b2[i+1]/X^i*x^i,i,0,d);
(hx) \(12928x^2-102481191x-705084292305\)

將\(h(x)\)因式分解
(%i22) factor(hx);
(%o22) \((x-12345)(12928x+57114969)\)

得到較小的解\(x\)
(%i23) x:12345;
(x) \(12345\)

驗證答案\(f_i(12345)\equiv 0 \pmod{n_i}\)
(%i24) create_list(mod(ev(fx[ i ],x=x),n[ i ]),i,1,length(n));
(%o24) \([0,0,0]\)
作者: bugmens    時間: 2021-6-6 21:25



Håstad方法

Coppersmith方法

可以找出比邊界\(X\)還小的解\(x_0\)(\(\displaystyle |\;x_0|\;<X=N^{\displaystyle \frac{2}{d(d+1)}}\))可以找出比邊界\(X\)還小的解\(x_0\)(\(\displaystyle |\;x_0|\;<X=\frac{1}{2}N^{\displaystyle \frac{1}{d}}\))
將\(f(x)\)各項係數取lattice如下
\(B=\matrix{\matrix{常數項&1次方&2次方&\ldots&d-1次方&d次方&} \cr \left[\matrix{a_0&a_1X&a_2X^2&\ldots&a_{d-1}X^{d-1}&a_dX^d&\frac{1}{d+1} \cr N&0&0&0&0&0&0\cr
0&NX&0&0&0&0&0\cr
0&0&NX^2&0&0&0&0\cr
&&&\ddots&&&\cr
0&0&0&0&NX^{d-1}&0&0\cr
0&0&0&0&0&NX^d&0}\right]}\)
該lattice的向量線性組合為
\(\matrix{\matrix{s\cr -s_0 \cr -s_1 \cr -s_2 \cr \vdots \cr -s_{d-1}\cr -s_d}&\left[\matrix{a_0&a_1X&a_2X^2&\ldots&a_{d-1}X^{d-1}&a_dX^d&\frac{1}{d+1} \cr N&0&0&0&0&0&0\cr
0&NX&0&0&0&0&0\cr
0&0&NX^2&0&0&0&0\cr
&&&\ddots&&&\cr
0&0&0&0&NX^{d-1}&0&0\cr
0&0&0&0&0&NX^d&0}\right]}\)
\(=\left[\matrix{sa_0&sa_1X&sa_2X^2&\ldots&sa_{d-1}X^{d-1}&sa_dX^d&\frac{s}{d+1}\cr
-s_0N&0&0&0&0&0&0\cr
0&-s_1NX&0&0&0&0&0\cr
0&0&-s_2NX^2&0&0&0&0\cr
0&0&0&\ddots&0&0&0\cr
0&0&0&0&-s_{d-1}NX^{d-1}&0&0\cr
0&0&0&0&0&-s_dNX^d&0}\right]\)
\(=[(sa_0-s_0N),(sa_1-s_1N)X,\ldots,(sa_{d-1}-s_{d-1}N)X^{d-1},(sa_d-s_dN)X^d,\frac{s}{d+1}]\)

將向量線性組合前\(d+1\)個分量除以\(X^i\)為係數的方程式
\(h(x)=(sa_0-s_0N)+(sa_1-s_1N)x+\ldots+(sa_{d-1}-s_{d-1}N)x^{d-1}+(sa_d-s_dN)x^d\)
 \(=s(a_0+a_1x+\ldots+a_{d-1}x^{d-1}+a_d x^d)-N(s_0+s_1x^1+\ldots+s_{d-1}x^{d-1}+s_dx^d)\)
 \(=sf(x)-N(s_0+s_1x^1+\ldots+s_{d-1}x^{d-1}+s_dx^d)\)
得到\(h(x)\equiv sf(x)\pmod{N}\)
若\(x=x_0\)是\(h(x)\equiv 0 \pmod{N}\)的解,那\(x=x_0\)也會是\(f(x)\equiv 0 \pmod{N}\)的解。
將\(f(x)\)各項係數取lattice如下
\(B=\left[\matrix{1&0&0&\ldots&0&0&a_0 \cr 0&X^{-1}&0&0&0&0&a_1\cr
0&0&X^{-2}&0&0&0&a_2\cr
0&0&0&X^{-3}&0&0&a_3\cr
&&&\ddots&&&\cr
0&0&0&0&X^{-(d-1)}&0&a_{d-1}\cr
0&0&0&0&0&X^{-d}&a_d\cr
0&0&0&0&0&0&N}\right] \matrix{常數項\cr 1次方\cr 2次方\cr 3次方\cr \vdots \cr d-1次方\cr d次方}\)
該lattice的向量線性組合為
\(\matrix{\matrix{1\cr x_0 \cr x_0^2 \cr x_0^3 \cr \vdots \cr x_0^{d-1}\cr x_0^d\cr -y_0}&\left[\matrix{1&0&0&\ldots&0&0&a_0 \cr 0&X^{-1}&0&0&0&0&a_1\cr
0&0&X^{-2}&0&0&0&a_2\cr
0&0&0&X^{-3}&0&0&a_3\cr
&&&\ddots&&&\cr
0&0&0&0&X^{-(d-1)}&0&a_{d-1}\cr
0&0&0&0&0&X^{-d}&a_d\cr
0&0&0&0&0&0&N}\right]}\)
\(=\left[\matrix{1&0&0&\ldots&0&0&a_0 \cr 0&x_0^1X^{-1}&0&0&0&0&a_1x_0^1\cr
0&0&x_0^2X^{-2}&0&0&0&a_2x_0^2\cr
0&0&0&x_0^3X^{-3}&0&0&a_3x_0^3\cr
&&&\ddots&&&\cr
0&0&0&0&x_0^{(d-1)}X^{-(d-1)}&0&a_{d-1}x_0^{(d-1)}\cr
0&0&0&0&0&x_0^{d}X^{-d}&a_dx_0^d\cr
0&0&0&0&0&0&-y_0N}\right]\)
\(\displaystyle =\left[1,\left(\frac{x_0}{X}\right),\left(\frac{x_0}{X}\right)^2,,\left(\frac{x_0}{X}\right)^3,\ldots,,\left(\frac{x_0}{X}\right)^{d-1},\left(\frac{x_0}{X}\right)^d,f(x_0)-y_0N\right]\)
若能找到\(x_0,y_0\)使得\(|\;x_0|\;<X\)、\(f(x_0)-y_0N\equiv 0\pmod{N}\)
此時向量長度\(\sqrt{1^2+\left(\frac{x_0}{X}\right)^2+\left(\frac{x_0}{X}\right)^4+\ldots+\left(\frac{x_0}{X}\right)^{2d}+0^2}<\sqrt{d+1}\)是短向量。

上面是Håstad和Coppersmith所用的lattice比較表,Håstad僅針對一個方程式\(h(x_0)=sf(x_0)\pmod{N}\)來產生lattice,而Coppersmith增加方程式個數,產生更大的lattice雖然增加LLL執行時間,但能提高解的上界。
\(f(x_0)-y_0N=0\)
\(x_0f(x_0)-x_0y_0N=0\)
\((f(x_0))^2-y_0^2N^2=0\)
\(x_0(f(x_0))^2-x_0y_0^2N^2=0\)

Coppersmith方法如下:









方法

範例

問題敘述

設同餘方程式為\(p(x)=x^k+a_{k-1}x^{k-1}+\ldots+a_1 x+a_0\equiv 0 \pmod{N}\)
且\(p(x)\)為monic(最高次方項係數為1)且不可分解。
利用LLL方法可以找出比邊界\(X\)還小的解\(x_0\)(\(\displaystyle |\;x_0|\;<X=\frac{1}{2}N^{\displaystyle \frac{1}{k}}\))
使得\(p(x_0)\equiv 0 \pmod{N}\)
設同餘方程式為\(p(x)=x^2+14x+19\equiv 0\pmod{35}\)
且\(p(x)\)為monic(最高次方項係數為1)且不可分解。
利用LLL方法可以找出比邊界\(X\)還小的解
使得\(p(x_0)\equiv 0 \pmod{35}\)

步驟1:計算參數\(h\)和\(X\)

步驟3需要\(hk\ge7\)、\(\displaystyle h-1\ge (hk-1)(\frac{1}{k}-\epsilon)\)和\(\displaystyle X=\frac{1}{2}N^{\frac{1}{k}}\)
\(hk\ge7\)化簡為\(\displaystyle h\ge \frac{7}{k}\)
\(\displaystyle h-1\ge (hk-1)(\frac{1}{k}-\epsilon)\)化簡為
\(\displaystyle h-1\ge h-\epsilon hk-\frac{1}{k}+\epsilon\)
\(\displaystyle \epsilon hk\ge \frac{k+\epsilon k-1}{k}\)
\(\displaystyle h\ge \frac{k+\epsilon k-1}{\epsilon k^2}\)
兩個條件合併一起
\(\displaystyle h\ge max\left(\frac{7}{k},\frac{k+\epsilon k-1}{\epsilon k^2}\right)\)
\(p(x)\)最高次方為2次方\((k=2)\)
設\(\epsilon=0.1\)
\(\displaystyle h\ge max\left(\frac{7}{2},\frac{2+0.1\cdot 2-1}{0.1\cdot 2^2}\right)=max(3.5,3)\)
\(h\ge 4\)但本範例取\(h=3\)就能得到答案
\(\displaystyle X=\frac{1}{2}35^{1/2}=2.958\),取\(X=2\)

步驟2:產生矩陣\(M\)

矩陣\(M\)是大小\((2hk-k)\times(2hk-k)\)的上三角矩陣
\(M=\left[\matrix{D&A\cr0_{hk}&D'}\right]\)
左上角矩陣\(D=(d(i,j))\)是大小\(hk\times hk\)的對角矩陣,
對角線元素為\(d_{i,i}=\delta X^{1-i}\),\(\displaystyle \delta=\frac{1}{\sqrt{hk}}\)
右上角矩陣\(A=(a_{i,j})\)是大小\((hk\times (h-1)k)\)矩陣,
矩陣元素\(a_{i,j}\)是\(x^u(p(x))^v\)的\(x^i\)項係數
其中\(\displaystyle v=\lfloor\;\frac{k+j-1}{k}\rfloor\;\)和\(u=(j-1)-k(v-1)\)
左下角\(0_{hk}\)為零矩陣
右下角矩陣\(D'=(d_{i,j}')\)是大小\(((h-1)k\times (h-1)k)\)的對角矩陣,
對角線元素為\(d_{i,i}'=N^v\)

\(M\)為上三角矩陣,行列式值為對角線元素相乘
\(\displaystyle det(M)=\prod_{g=0}^{hk-1}\delta X^{-g}\prod_{\gamma(i,j)=hk}^{2hk-k}N^j\)
  \(\displaystyle =\delta^{hk} X^{-{\frac{hk(hk-1)}{2}}}N^{\frac{hk(h-1)}{2}}\)
  \(\displaystyle =(N^{h-1}X^{-(hk-1)}(hk)^{-1})^{\frac{hk}{2}}\)
-------------------
\(p(x)=x^2+ax+b\equiv 0\pmod{N}\)
\(xp(x)=x^3+ax^2+bx\equiv 0\pmod{N}\)
\((p(x))^2=x^4+cx^3+dx^2+ex+f\equiv 0\pmod{N^2}\)
\(x(p(x))^2=x^5+cx^4+dx^3+ex^2+fx\equiv 0\pmod{N^2}\)
\(M=\left[\matrix{\matrix{\delta&&&&&\cr&\delta X^{-1}&&&&\cr&&\delta X^{-2}&&&\cr&&&\delta X^{-3}&&\cr&&&&\delta X^{-4}&\cr&&&&&\delta X^{-5}}&\matrix{│\cr │\cr │\cr │}&
\matrix{
b&0&e&0\cr
a&b&d&f\cr
1&a&d&e\cr
&1&c&d\cr
&&1&c\cr
&&&1}\cr ―――――――――&┼&――――――― \cr
\matrix{0}&\matrix{│\cr │\cr │}&\matrix{N&&&\cr &N&&\cr &&N^2&\cr &&&N^2}}\right]\)
設\(r\)向量左手邊為\(r_g=x_0^g\),右手邊為\(x_0\)和\(y_0\)的非負次方\(r_{\gamma(i,j)}=-x_0^iy_0^j\)
\(r=[1,x_0,x_0^2,x_0^3,x_0^4,x_0^5,-y_0,-x_0y_0,-y_0^2,-x_0y_0^2]\)
計算向量線性組合\(s=rM\)
\(\displaystyle s=[1,\delta\frac{x_0}{X},\delta\left(\frac{x_0}{X}\right)^2,\delta\left(\frac{x_0}{X}\right)^3,\delta\left(\frac{x_0}{X}\right)^4,\delta\left(\frac{x_0}{X}\right)^5,\)
\(-p(x_0)-y_0N,x_0p(x_0)-x_0y_0N,(p(x_0))^2-y_0^2N^2,x_0(p(x_0))^2-x_0y_0^2N^2]\)
存在\(|\;x_0|\;<X\)和\(y_0\)使得\(p(x_0)-y_0N=0\)
\(\displaystyle s=\left[1,\delta\frac{x_0}{X},\delta\left(\frac{x_0}{X}\right)^2,\delta\left(\frac{x_0}{X}\right)^3,\delta\left(\frac{x_0}{X}\right)^4,\delta\left(\frac{x_0}{X}\right)^5,0,0,0,0\right]\)
計算向量\(s\)長度比1短
\(\displaystyle \Vert\;s\Vert\;=\sqrt{\sum_{k=0}^{hk-1}\left(\delta \left( \frac{x_0}{X}\right)^{k}\right)^2}<\sqrt{\sum_{k=0}^{hk-1}(\delta \cdot 1)^2}=\sqrt{\delta^2\cdot hk}=1\)
\(p(x)=x^2+14x+19\equiv 0\pmod{35}\)
\(xp(x)=x^3+14x^2+19x\equiv 0\pmod{35}\)
\(p(x)^2=x^4+28x^3+234x^2+532x+361\equiv 0\pmod{35^2}\)
\(xp(x)^2=x^5+28x^4+234x^3+532x^2+361x\equiv 0\pmod{35^2}\)
原本\(\displaystyle \delta=\frac{1}{\sqrt{hk}}=\frac{1}{\sqrt{6}}\),但本範例忽略\(\delta\)也能算出答案
\(M=\left[\matrix{\matrix{1&&&&&\cr&2^{-1}&&&&\cr&&2^{-2}&&&\cr&&&2^{-3}&&\cr&&&&2^{-4}&\cr&&&&&2^{-5}}&\matrix{│\cr │\cr │\cr │}&
\matrix{
19&0&361&0\cr
14&19&532&361\cr
1&14&234&532\cr
&1&28&234\cr
&&1&28\cr
&&&1}\cr ―――――――――&┼&――――――― \cr
\matrix{0}&\matrix{│\cr │\cr │}&\matrix{35&&&\cr &35&&\cr &&1225&\cr &&&1225}}\right]\)

\(det(M)=1\cdot 2^{-1}\ldots 2^{-5}\cdot 35 \cdot 35 \cdot 1225 \cdot 1225\)
  \(=2^{-15}35^6\)

步驟3:矩陣\(M\)基本列運算得到\(\widehat{M}\)

因為\(p(x)\)為monic(最高次方項係數為1),在矩陣\(A\)的對角線元素為1,進行基本列運算將右上角化簡為零,右下角化簡為零,再將對角線元素為1的一整列移到整個矩陣下方。
\(\widetilde{M}=\left[\matrix{\widehat{M}&│&0_{(hk\times (h-1)k)}\cr ―&┼&――――――\cr A'&│&I_{(h-1)k}}\right]\)
得到左上角矩陣\(\widehat{M}\)
-------------------
\(|\;det(M)|\;=|\;det(\widetilde{M})|\;=|\;det(\widehat{M})det(I)|\;=|\;det(\widehat{M})|\;\)
得到\(\displaystyle det(M)=(N^{h-1}X^{-(hk-1)}(hk)^{-1})^{\frac{hk}{2}}=det(\widehat{M})\)
設\(hk\ge 7\),可推得\(\displaystyle hk<2^{\frac{hk-1}{2}}\),\((hk)^{-1}>2^{-\frac{(hk-1)}{2}}\)
\(\displaystyle det(\widehat{M})>(N^{h-1}X^{-(hk-1)}2^{-\frac{(hk-1)}{2}})^{\frac{hk}{2}}\)
設\(\displaystyle X=\frac{1}{2}N^{\frac{1}{k}-\epsilon}\),可推得\(\displaystyle X^{-1}=2N^{-(\frac{1}{k}-\epsilon)}\),\(\displaystyle X^{-(hk-1)}=2^{hk-1}N^{-(hk-1)(\frac{1}{k}-\epsilon)}\)
\(\displaystyle det(\widehat{M})>(N^{n-1-(hk-1)(\frac{1}{k}-\epsilon)}\cdot 2^{+\frac{(hk-1)}{2}})^{\frac{hk}{2}}\)
設\(\displaystyle n-1\ge (hk-1)(\frac{1}{k}-\epsilon)\)
\(\displaystyle det(\widehat{M})>(N^0\cdot 2^{+\frac{(hk-1)}{2}})2^{\frac{hk}{2}}=2^{\frac{(hk)(hk-1)}{4}}\)
設\(n=hk=dim(\widehat{M})\)
\(\displaystyle det(\widehat{M})>2^{\frac{n(n-1)}{4}}\)
\(\displaystyle det(\widehat{M})^{\frac{1}{n}}>2^{\frac{n-1}{4}}\)
\(\displaystyle det(\widehat{M})^{\frac{1}{n}}\cdot 2^{-\frac{n-1}{4}}>1\)
由步驟2結論可知向量\(s\)長度小於1(\(1>\Vert\;s\Vert\;\))
得到\(\displaystyle det(\widehat(M))^{\frac{1}{n}}\cdot 2^{-\frac{n-1}{4}}>\Vert\;s\Vert\;\)
將右上角化簡為零
\(\widetilde{M}=\left[\matrix{\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr
&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr
&&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}\cr
&&&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}\cr
&&&&\frac{1}{16}&-\frac{7}{8}\cr
&&&&&\frac{1}{32}}&\matrix{│\cr│\cr│\cr│\cr│\cr│}&\matrix{\displaystyle 0&0&0&0\cr 0&0&0&0\cr 1&0&0&0\cr &1&0&0\cr &&1&0\cr &&&1}\cr
――――――――――――――&┼&―――――――――\cr
\matrix{0}&\matrix{│\cr│\cr│\cr│}&\matrix{35&&&\cr&35&&\cr&&1225&\cr&&&1225}}\right]\)
將右下角化簡為零
\(\widetilde{M}=\left[\matrix{\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr
&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr
&&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}\cr
&&&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}\cr
&&&&\frac{1}{16}&-\frac{7}{8}\cr
&&&&&\frac{1}{32}}&\matrix{│\cr│\cr│\cr│\cr│\cr│}&\matrix{\displaystyle 0&0&0&0\cr 0&0&0&0\cr 1&0&0&0\cr &1&0&0\cr &&1&0\cr &&&1}\cr
――――――――――――――&┼&―――\cr
\matrix{\displaystyle &&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&-\frac{3675}{2}\cr
&&&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr
&&&&-\frac{1225}{16}&-\frac{8575}{8}\cr
&&&&&-\frac{1225}{32}}&\matrix{│\cr│\cr│\cr│}&\matrix{0&&&\cr&0&&\cr&&0&\cr&&&0}}\right]\)
將對角線元素為1的一整列移到整個矩陣下方
\(\widetilde{M}=\left[\matrix{\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr
&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr
&&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&-\frac{3675}{2}\cr
&&&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr
&&&&-\frac{1225}{16}&-\frac{8575}{8}\cr
&&&&&-\frac{1225}{32}}&\matrix{│\cr│\cr│\cr│\cr│\cr│}&\matrix{\displaystyle 0&0&0&0\cr 0&0&0&0\cr 0&0&0&0\cr &0&0&0\cr &&0&0\cr &&&0}\cr
――――――――――――――&┼&―――\cr
\matrix{\displaystyle   & &\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}\cr
&&&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}\cr
&&&&\frac{1}{16}&-\frac{7}{8}\cr
&&&&&\frac{1}{32}\cr}&\matrix{│\cr│\cr│\cr│}&\matrix{1&&&\cr&1&&\cr&&1&\cr&&&1}}\right]\)
得到左上角矩陣\(\widehat{M}\)
\(\widehat{M}=\left[\matrix{\displaystyle 1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr
&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr
&&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&-\frac{3675}{2}\cr
&&&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr
&&&&-\frac{1225}{16}&-\frac{8575}{8}\cr
&&&&&-\frac{1225}{32}}\right]\)
\(\displaystyle det(\widehat{M})=1\cdot \frac{1}{2}\cdot \frac{-35}{4}\cdot \frac{-35}{8}\cdot \frac{-1225}{16}\cdot \frac{-1225}{35}\)
  \(\displaystyle =2^{-15}35^6\)
\(\widehat{M}\)乘32倍變成整數
\(\widehat{M}=\left[\matrix{
32&0&-152&1064&-6726&42028\cr
&16&-112&708&-4424&27605\cr
&&-280&1960&-11060&58800\cr
&&&-140&1960&-19250\cr
&0&&&-2450&34300\cr
&&&&&-1225}\right]\)

步驟4:經LLL化簡和Gram-Schmidt正交化後得到不需要同餘\(N\)的方程式

矩陣\(\widehat{M}\)經LLL化簡為\(B\)
\(B=LLL(\widehat{M})\)
矩陣\(B\)經Gram-Schmidt正交化得到\(B^{*}\)
\(B^{*}=\)Gram-Schmidt\((B)\)
-------------------
引理1:
假設lattice \(L\)經LLL化簡後向量為\(b_1,b_2,\ldots,b_n\),經Gram-Schmidt化簡後向量為\(b_1^{*},b_2^{*},\ldots,b_n^{*}\),則\(\displaystyle \Vert\;b_n^{*}\Vert\;\ge det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}\)。
[證明]
\(\displaystyle det(L)^2=\prod_{i=1}^n \Vert\;b_i^{*}\Vert\;^2=\Vert\;b_1^{*}\Vert\;^2 \Vert\;b_2^{*}\Vert\;^2\cdot \Vert\;b_n^{*}\Vert\;^2\)
經LLL化簡後向量長度滿足\(\Vert\;b_i^{*}\Vert\;^2\le 2\Vert\;b_{i+1}^{*}\Vert\;^2\) \((i=1,2,\ldots,n-1)\)
\(\displaystyle det(L)^2 \le \left(2^{n-1}\Vert\;b_n^{*}\Vert\;^2\right)\left(2^{n-2}\Vert\;b_n^{*}\Vert\;^2\right)\ldots \left(\Vert\;b_n^{*}\Vert\;^2\right)\left(\Vert\;b_n^{*}\Vert\;^2\right)\)
\(\displaystyle det(L)^2 \le 2^{\frac{n(n-1)}{2}}\Vert\;b_n^{*}\Vert\;^{2n}\)
\(\displaystyle \Vert\;b_n^{*}\Vert\;^{2n}\ge det(L)^2 2^{-\frac{n(n-1)}{2}}\)
兩邊各加上\(\displaystyle \frac{1}{2n}\)次方\(\Vert\;b_n^{*}\Vert\;\ge det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}\)

引理2:
假設lattice \(L\)其中一個元素\(s\)滿足\(\displaystyle det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}>\Vert\;s\Vert\;\),則\(s\)會落在由\(b_1,b_2,\ldots,b_{n-1}\)所展開的超平面上。
[證明]
將lattice 元素\(s\)表示成\(b_1,b_2,\ldots,b_n\)的線性組合\(\displaystyle s=\sum_{i=1}^n a_ib_i\),其中\(a_i\)是整數
向量長度\(\Vert\;s\Vert\;=\Vert\;a_1b_1+a_2b_2+\ldots+a_nb_n\Vert\;\ge \Vert\;a_nb_n\Vert\;=|\;a_n|\;\Vert\;b_n\Vert\;\ge |\;a_n|\;\Vert\;b_n^{*}\Vert\;\)
由引理1可知\(\Vert\;b_n^{*}\Vert\;\ge det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}\)、\(\displaystyle det(L)^{\frac{1}{n}}2^{-\frac{n-1}{4}}>\Vert\;s\Vert\;\)和
\(\Vert\;s\Vert\;\ge |\;a_n|\;\Vert\;b_n^{*}\Vert\;\),得到\(\Vert\;b_n^{*}\Vert\;>|\;a_n|\;\Vert\;b_n^{*}\Vert\;\),\(a_n=0\)
\(s\)可表示成\(b_1,b_2,\ldots,b_{n-1}\)的線性組合,\(s\)落在由\(b_1,b_2,\ldots,b_{n-1}\)所展開的超平面上。
-------------------
\(\displaystyle s=\left[1,\delta \frac{x_0}{X},\ldots,\delta\left(\frac{x_0}{X}\right)^{hk-1}\right]\)是lattice\(\widehat{M}\)的向量元素,
由步驟3結論可知\(\displaystyle det(\widehat{M})^{\frac{1}{n}}2^{-\frac{n-1}{4}}>\Vert\;s\Vert\;\)
由上面引理2可知\(s\)落在由\(b_1,b_2,\ldots,b_{n-1}\)所展開的超平面上。
而這個超平面會和Gram-Schmidt的向量\(b_n^{*}\)正交,得到\(s\cdot b_n^{*}=0\),可得到一個不需要同餘\(N\)的方程式。

LLL化簡
\(B=\left[\matrix{0&160&0&-60&0&-100\cr
-64&-64&-88&80&-72&-51\cr
64&-48&32&4&-180&16\cr
128&-80&-48&16&116&-13\cr
-32&-96&-16&-132&90&-108\cr
-64&-32&248&96&-30&-141}\right]\)
Gram-Schmidt正交化
\(B^{*}=\left[\matrix{\displaystyle 0&160&0&-60&0&-100\cr
-64&-\frac{164}{7}&-88&\frac{907}{14}&-72&-\frac{1069}{14}\cr
\frac{4327744}{55201}&-\frac{213712}{55201}&\frac{2859392}{55201}&-\frac{1388192}{55201}&-\frac{9041940}{55201}&\frac{490976}{55201}\cr
\frac{2396089600}{17933807}&-\frac{673016640}{17933807}&-\frac{1044380280}{17933807}&\frac{154688960}{17933807}&\frac{745216000}{17933807}&-\frac{1169640000}{17933807}\cr
-\frac{2184694400}{45963969}&-\frac{1521655800}{15321323}&\frac{344724800}{15321323}&-\frac{6338718400}{45963969}&\frac{172362400}{45963969}&-\frac{1166905600}{15321323}\cr
-\frac{117600}{17929}&-\frac{627200}{17929}&\frac{3763200}{17929}&\frac{2508800}{17929}&\frac{627200}{17929}&-\frac{2508800}{17929}}\right]\)
取最後一列向量乘上\(\displaystyle \frac{17929}{39200}\)變成整數
\([−3, −16, 96, 64, 16, −64]\)
形成不需要再同餘\(N\)的方程式
\(\displaystyle h(x)=-3-16\left(\frac{x}{2}\right)+96\left(\frac{x}{2}\right)^2+64\left(\frac{x}{2}\right)^3+16\left(\frac{x}{2}\right)^4-64\left(\frac{x}{2}\right)^5\)
 \(=-3-8x+24x^2+8x^3+x^4-2x^5\)
 \(=-(x-3)(2x-1)(x^3+3x^2+5x+1)\)
解方程式得到答案
\(x=3\)


參考資料:
D. Coppersmith. Finding a small root of a univariate modular equation. In Proceedings of Eurocrypt 1996, volume 1070 of Lecture Notes in Computer Science, pages 155–165. Springer, 1996.
https://link.springer.com/chapter/10.1007/3-540-68339-9_14
N. Howgrave-Graham. Finding small roots of univariate modular equations revisited. In Cryptography and Coding– Proc. IMA ’97, volume 1355 of Lecture Notes in Computer Science, pages 131–142. Springer, 1997.
https://link.springer.com/chapter/10.1007/BFb0024458
有二次同餘方程式範例
Finding Small Roots of Polynomial Equations Using Lattice Basis Reduction
https://ntnuopen.ntnu.no/ntnu-xm ... e=1&isAllowed=y
有三次同餘方程式範例
Lattice Basis Reduction:An Introduction to the LLL Algorithm and Its Applications
https://www.routledge.com/Lattic ... /book/9781439807026
有一整章關於Coppersmith方法的介紹



請下載LLL.zip,解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下
要先載入LLL.mac才能使用LLL指令

(%i1) load("LLL.mac");
(%o1) C:/maxima-5.43.2/share/maxima/5.43.2/share/LLL.mac

要先載入eigen.mac才能使用gramschmidt指令
(%i2) load("eigen.mac");
(%o2) C:/maxima-5.43.2/share/maxima/5.43.2/share/matrix/eigen.mac

要先載入diag.mac才能使用diag指令
(%i3) load("diag.mac");
(%o3) C:/maxima-5.43.2/share/maxima/5.43.2/share/contrib/diag.mac

同餘方程式\(p(x)\)
(%i4) px:x^2+14*x+19;
(px) \(x^2+14x+19\)

\(p(x)\equiv 0\pmod{N}\)
(%i5) N:35;
(N) \(35\)

\(p(x)\)的次數\(k\)
(%i6) k:hipow(px,x);
(k) \(2\)

設誤差值\(\epsilon=0.1\)
(%i7) epsilon:0.1;
(epsilon) \(0.1\)

參數\(h\),按照公式應該是\(h=4\),但\(h=3\)也能算出來
(%i9)
h:ceiling(max(7/k,(k+epsilon*k-1)/(epsilon*k^2)));
h:3;

(h) 4
(h) 3

\(\widehat{M}\)的維度\(n=hk\)
(%i10) n:h*k;
(n) 6

參數\(\delta\),按照公式應該是\(\displaystyle \delta=\frac{1}{\sqrt{6}}\),改成\(\delta=1\)方便計算
(%i12)
delta:1/sqrt(h*k);
delta:1;

(delta) \(\displaystyle \frac{1}{\sqrt{6}}\)
(delta) 1

希望能找到\(|\;x|\;<X=\frac{1}{2}N^{1/k}\),\(p(x)\equiv 0\pmod{N}\)
(%i13) X:floor(1/2*N^(1/k));
(X) 2

左上角矩陣對角線元素\(\delta X^{-i}\)
(%i14) Xpower:create_list(delta*X^-(i-1),i,1,h*k);
(Xpower) \(\displaystyle \left[1,\frac{1}{2},\frac{1}{4},\frac{1}{8},\frac{1}{16},\frac{1}{32}\right]\)

左上角矩陣
(%i15) D1:diag(Xpower);
(D1) \(\left[\matrix{\displaystyle 1&0&0&0&0&0\cr
0&\frac{1}{2}&0&0&0&0\cr
0&0&\frac{1}{4}&0&0&0\cr
0&0&0&\frac{1}{8}&0&0\cr
0&0&0&0&\frac{1}{16}&0\cr
0&0&0&0&0&\frac{1}{32}}\right]\)

多項式\(x^u\cdot p(x)^v\)
(%i16) xpxpower:create_list(x^u*px^v,v,1,h-1,u,0,k-1);
(xpxpower) \([x^2+14x+19,x(x^2+14x+19),(x^2+14x+19)^2,x(x^2+14x+19)^2]\)

\(x^1,x^2,\ldots,x^{n-1}\)
(%i17) xpower:create_list(x^i,i,1,n-1);
(xpower) \([x,x^2,x^3,x^4,x^5]\)

取多項式\(x^u\cdot p(x)^v\)係數,形成右上角矩陣(常數項在最後一行)
(%i18) A:augcoefmatrix(xpxpower,xpower);
(A) \(\left[\matrix{14&1&0&0&0&19\cr
19&14&1&0&0&0\cr
532&234&28&1&0&361\cr
361&532&234&28&1&0}\right]\)

將常數項移到第一行
(%i19) A:addcol(col(A,h*k),submatrix(A,h*k));
(A) \(\left[ \matrix{
19&14&1&0&0&0\cr
0&19&14&1&0&0\cr
361&532&234&28&1&0\cr
0&361&532&234&28&1}\right]\)

矩陣\(A\)轉置
(%i20) A:transpose(A);
(A) \(\left[ \matrix{
19&0&361&0\cr
14&19&532&361\cr
1&14&234&532\cr
0&1&28&234\cr
0&0&1&28\cr
0&0&0&1}\right]\)

左下角0矩陣
(%i21) Zero:zeromatrix((h-1)*k,h*k);
(Zero) \(\left[ \matrix{
0&0&0&0&0&0\cr
0&0&0&0&0&0\cr
0&0&0&0&0&0\cr
0&0&0&0&0&0}\right]\)

右下角矩陣元素\(N^v\)
(%i22) Npower:create_list(N^v,v,1,h-1,u,0,k-1);
(Npower) \([35,35,1225,1225]\)

右下角矩陣
(%i23) D2:diag(Npower);
(D2) \(\left[ \matrix{
35&0&0&0\cr
0&35&0&0\cr
0&0&1225&0\cr
0&0&0&1225}\right]\)

4個子矩陣合併成矩陣\(M\)
(%i24) M:addrow(addcol(D1,A),addcol(Zero,D2));
(M) \(\left[ \matrix{\displaystyle
1&0&0&0&0&0&19&0&361&0\cr
0&\frac{1}{2}&0&0&0&0&14&19&532&361\cr
0&0&\frac{1}{4}&0&0&0&1&14&234&532\cr
0&0&0&\frac{1}{8}&0&0&0&1&28&234\cr
0&0&0&0&\frac{1}{16}&0&0&0&1&28\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1\cr
0&0&0&0&0&0&35&0&0&0\cr
0&0&0&0&0&0&0&35&0&0\cr
0&0&0&0&0&0&0&0&1225&0\cr
0&0&0&0&0&0&0&0&0&1225}\right]\)

將矩陣\(M\)複製成另一個矩陣\(\widetilde{M}\),進行矩陣列運算
(%i25) M_tilde:copymatrix(M)$

將右上角化簡為零
(%i27)
for i:k+1 thru n do
  (for j:1 thru i-1 do
     (print("第",j,"列=第",j,"列-",M_tilde[j,i+n-k],"*第",i,"列=",
               M_tilde[j]:M_tilde[j]-M_tilde[j,i+n-k]*M_tilde[ i ])
     )
  )$
M_tilde;

第1列=第1列-19*第3列\(\displaystyle =[1,0,-\frac{19}{4},0,0,0,0,-266,-4085,-10108]\)
第2列=第2列-14*第3列\(\displaystyle =[0,\frac{1}{2},-\frac{7}{2},0,0,0,0,-177,-2744,-7087]\)
第1列=第1列--266*第4列\(\displaystyle =[1,0,-\frac{19}{4},\frac{133}{4},0,0,0,0,3363,52136]\)
第2列=第2列--177*第4列\(\displaystyle =[0,\frac{1}{2},-\frac{7}{2},\frac{177}{8},0,0,0,0,2212,34331]\)
第3列=第3列-14*第4列\(\displaystyle =[0,0,\frac{1}{4},-\frac{7}{4},0,0,1,0,-158,-2744]\)
第1列=第1列-3363*第5列\(\displaystyle =[1,0,-\frac{19}{4},\frac{133}{4},-\frac{3363}{16},0,0,0,0,-42028]\)
第2列=第2列-2212*第5列\(\displaystyle =[0,\frac{1}{2},-\frac{7}{2},\frac{177}{8},-\frac{553}{4},0,0,0,0,-27605]\)
第3列=第3列--158*第5列\(\displaystyle =[0,0,\frac{1}{4},-\frac{7}{4},\frac{79}{8},0,1,0,0,1680]\)
第4列=第4列-28*第5列\(\displaystyle =[0,0,0,\frac{1}{8},-\frac{7}{4},0,0,1,0,-550]\)
第1列=第1列--42028*第6列\(\displaystyle =[1,0,-\frac{19}{4},\frac{133}{4},-\frac{3363}{16},\frac{10507}{8},0,0,0,0]\)
第2列=第2列--27605*第6列\(\displaystyle =[0,\frac{1}{2},-\frac{7}{2},\frac{177}{8},-\frac{553}{4},\frac{27605}{32},0,0,0,0]\)
第3列=第3列-1680*第6列\(\displaystyle =[0,0,\frac{1}{4},-\frac{7}{4},\frac{79}{8},-\frac{105}{2},1,0,0,0]\)
第4列=第4列--550*第6列\(\displaystyle =[0,0,0,\frac{1}{8},-\frac{7}{4},\frac{275}{16},0,1,0,0]\)
第5列=第5列-28*第6列\(\displaystyle =[0,0,0,0,\frac{1}{16},-\frac{7}{8},0,0,1,0]\)
(%o27) \(\left[ \matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}&0&0&0&0\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}&0&0&0&0\cr
0&0&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}&1&0&0&0\cr
0&0&0&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}&0&1&0&0\cr
0&0&0&0&\frac{1}{16}&-\frac{7}{8}&0&0&1&0\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1\cr
0&0&0&0&0&0&35&0&0&0\cr
0&0&0&0&0&0&0&35&0&0\cr
0&0&0&0&0&0&0&0&1225&0\cr
0&0&0&0&0&0&0&0&0&1225}\right]\)

將右下角化簡為零
(%i29)
for i:k+1 thru n do
  (j:i+n-k,
   print("第",j,"列=第",j,"列-",M_tilde[j,j],"*第",i,"列=",
    M_tilde[j]:M_tilde[j]-M_tilde[j,j]*M_tilde[ i ])
  )$
M_tilde;

第7列=第7列-35*第3列\(\displaystyle =[0,0,-\frac{35}{4},\frac{245}{4},-\frac{2765}{8},\frac{3675}{2},0,0,0,0]\)
第8列=第8列-35*第4列\(\displaystyle =[0,0,0,-\frac{35}{8},\frac{245}{4},-\frac{9625}{16},0,0,0,0]\)
第9列=第9列-1225*第5列\(\displaystyle =[0,0,0,0,-\frac{1225}{16},\frac{8575}{8},0,0,0,0]\)
第10列=第10列-1225*第6列\(\displaystyle =[0,0,0,0,0,-\frac{1225}{32},0,0,0,0]\)
(%o29) \(\left[ \matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}&0&0&0&0\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}&0&0&0&0\cr
0&0&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}&1&0&0&0\cr
0&0&0&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}&0&1&0&0\cr
0&0&0&0&\frac{1}{16}&-\frac{7}{8}&0&0&1&0\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1\cr
0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}&0&0&0&0\cr
0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}&0&0&0&0\cr
0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}&0&0&0&0\cr
0&0&0&0&0&-\frac{1225}{32}&0&0&0&0}\right]\)

將對角線元素為1的一整列移到整個矩陣下方
(%i31)
for i:k+1 thru n do
  (j:i+n-k,
   print("第",i,"列和第",j,"列交換"),
   [M_tilde[j],M_tilde[ i ]]:[M_tilde[ i ],M_tilde[j]]
  )$
M_tilde;

第3列和第7列交換
第4列和第8列交換
第5列和第9列交換
第6列和第10列交換
(%o31) \(\left[ \matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}&0&0&0&0\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}&0&0&0&0\cr
0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}&0&0&0&0\cr
0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}&0&0&0&0\cr
0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}&0&0&0&0\cr
0&0&0&0&0&-\frac{1225}{32}&0&0&0&0\cr
0&0&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}&1&0&0&0\cr
0&0&0&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}&0&1&0&0\cr
0&0&0&0&\frac{1}{16}&-\frac{7}{8}&0&0&1&0\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1}\right]\)

得到左上角矩陣\(\widehat{M}\)
(%i32) M_hat:genmatrix(lambda([i,j],M_tilde[i,j]),n,n);
(M_hat) \(\left[ \matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr
0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}\cr
0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr
0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}\cr
0&0&0&0&0&-\frac{1225}{32}}\right]\)

\(\widehat{M}\)乘32倍變成整數
(%i33) M_hat:M_hat*1/delta*X^(n-1);
(M_hat) \(\left[ \matrix{
32&0&-152&1064&-6726&42028\cr
0&16&-112&708&-4424&27605\cr
0&0&-280&1960&-11060&58800\cr
0&0&0&-140&1960&-19250\cr
0&0&0&0&-2450&34300\cr
0&0&0&0&0&-1225}\right]\)

LLL化簡
(%i34) B: LLL(M_hat);
(B) \(\left[ \matrix{
0&160&0&-60&0&-100\cr
-64&-64&-88&80&-72&-51\cr
64&-48&32&4&-180&16\cr
128&-80&-48&16&116&-13\cr
-32&-96&-16&-132&90&-108\cr
-64&-32&248&96&-30&-141}\right]\)

Gram-Schmidt正交化
(%i35) Bstar:apply(matrix,expand(gramschmidt(B)));
(Bstar) \(\left[ \matrix{\displaystyle
0&160&0&-60&0&-100\cr
-64&-\frac{164}{7}&-88&\frac{907}{14}&-72&-\frac{1069}{14}\cr
\frac{4327744}{55201}&-\frac{213712}{55201}&\frac{2859392}{55201}&-\frac{1388192}{55201}&-\frac{9041940}{55201}&\frac{490976}{55201}\cr
\frac{2396089600}{17933807}&-\frac{673016640}{17933807}&-\frac{1044380280}{17933807}&\frac{154688960}{17933807}&\frac{745216000}{17933807}&-\frac{1169640000}{17933807}\cr
-\frac{2184694400}{45963969}&-\frac{1521655800}{15321323}&\frac{344724800}{15321323}&-\frac{6338718400}{45963969}&\frac{172362400}{45963969}&-\frac{1166905600}{15321323}\cr
-\frac{117600}{17929}&-\frac{627200}{17929}&\frac{3763200}{17929}&\frac{2508800}{17929}&\frac{627200}{17929}&-\frac{2508800}{17929}}\right]\)

取最後一個正交向量
(%i36) Bstar_n:Bstar[n];
(Bstar_n) \(\displaystyle \left[-\frac{117600}{17929},-\frac{627200}{17929},\frac{3763200}{17929},\frac{2508800}{17929},\frac{627200}{17929},-\frac{2508800}{17929}\right]\)

取各分數的分母
(%i37) Denom:map('denom,Bstar_n);
(Denom) \([17929,17929,17929,17929,17929,17929]\)

求最大的分母
(%i38) MaxDenom:lmax(%);
(MaxDenom) 17929

正交向量化為整數
(%i39) Bstar_n:Bstar_n*MaxDenom;
(Bstar_n) \([-117600,-627200,3763200,2508800,627200,-2508800]\)

計算最大公因數
(%i40) GCD:lreduce('gcd,Bstar_n);
(GCD) 39200

同除最大公因數,得到化簡的正交向量
(%i41) Bstar_n:Bstar_n/GCD;
(Bstar_n) \([-3,-16,96,64,16,-64]\)

正交向量和\(\displaystyle \left(\frac{x}{X}\right)^i\)相乘
(%i42) hx:sum(Bstar_n[i+1]*(x/X)^i,i,0,n-1);
(hx) \(-2x^5+x^4+8x^3+24x^2-8x-3\)

將\(h(x)\)因式分解
(%i43) factor(hx);
(%o43) \(-(x-3)(2x-1)(x^3+3x^2+5x+1)\)

得到\(h(x)\)的解
(%i44) x:3;
(x) 3

驗證答案
(%i45) ev(mod(px,N),x=3);
(%o45) 0
作者: bugmens    時間: 2021-6-7 19:44

解三次同餘方程式\(p(x)=x^3-4x^2-3x-10\pmod{1131}\)。

參考資料
Finding Small Roots of Polynomial Equations Using Lattice Basis Reduction
https://ntnuopen.ntnu.no/ntnu-xm ... e=1&isAllowed=y



請下載LLL.zip,解壓縮後將LLL.mac放到C:\maxima-5.43.2\share\maxima\5.43.2\share目錄下
要先載入LLL.mac才能使用LLL指令

(%i1) load("LLL.mac");
(%o1) C:/maxima-5.43.2/share/maxima/5.43.2/share/LLL.mac

要先載入eigen.mac才能使用gramschmidt指令
(%i2) load("eigen.mac");
(%o2) C:/maxima-5.43.2/share/maxima/5.43.2/share/matrix/eigen.mac

要先載入diag.mac才能使用diag指令
(%i3) load("diag.mac");
(%o3) C:/maxima-5.43.2/share/maxima/5.43.2/share/contrib/diag.mac

同餘方程式\(p(x)\)
(%i4) px:x^3-4*x^2-3*x-10;
(px) \(x^3-4x^2-3x-10\)

\(p(x)\equiv 0\pmod{N}\)
(%i5) N:1131;
(N) 1131

\(p(x)\)的次數\(k\)
(%i6) k:hipow(px,x);
(k) 3

設誤差值\(epsilon=0.1\)
(%i7) epsilon:0.1;
(epsilon) 0.1

參數h
(%i8) h:ceiling(max(7/k,(k+epsilon*k-1)/(epsilon*k^2)));
(h) 3

\(\widehat{M}\)的維度\(n=hk\)
(%i9) n:h*k;
(n) 9

參數\(\delta\),按照公式應該是\(\displaystyle \delta=\frac{1}{3}\),本範例\(\displaystyle \delta=\frac{1}{9}\)
(%i11)
delta:1/sqrt(h*k);
delta:1/9;

(delta) \(\displaystyle \frac{1}{3}\)
(delta) \(\displaystyle \frac{1}{9}\)

希望能找到\(|\;x|\;<X=\frac{1}{2}N^{1/k}\),\(p(x)\equiv 0\pmod{N}\)
按照公式應該是5,本範例\(X=6\)

(%i13)
X:floor(1/2*N^(1/k));
X:6;

(X) 5
(X) 6


(%i14) Xpower:create_list(delta*X^-(i-1),i,1,h*k);
(Xpower) \(\displaystyle \left[\frac{1}{9},\frac{1}{54},\frac{1}{324},\frac{1}{1944},\frac{1}{11664},\frac{1}{69984},\frac{1}{419904},\frac{1}{2519424},\frac{1}{15116544}\right]\)

左上角矩陣
(%i15) 
(D1) \(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&0&0&0&0&0&0\cr
0&\frac{1}{54}&0&0&0&0&0&0&0\cr
0&0&\frac{1}{324}&0&0&0&0&0&0\cr
0&0&0&\frac{1}{1944}&0&0&0&0&0\cr
0&0&0&0&\frac{1}{11664}&0&0&0&0\cr
0&0&0&0&0&\frac{1}{69984}&0&0&0\cr
0&0&0&0&0&0&\frac{1}{419904}&0&0\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&0\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}}\right]\)

多項式\(x^u\cdot p(x)^v\)
(%i16) xpxpower:create_list(x^u*px^v,v,1,h-1,u,0,k-1);
(xpxpower) \([x^3-4x^2-3x-10,x(x^3-4x^2-3x-10),x^2(x^3-4x^2-3x-10),(x^3-4x^2-3x-10)^2,x(x^3-4x^2-3x-10)^2,x^2(x^3-4x^2-3x-10)^2]\)

\(x^1,x^2,\ldots,x^{n-1}\)
(%i17) xpower:create_list(x^i,i,1,n-1);
(xpower) \([x,x^2,x^3,x^4,x^5,x^6,x^7,x^8]\)

取多項式\(x^u\cdot(x)^v\)係數,形成右上角矩陣(常數項在最後一行)
(%i8) A:augcoefmatrix(xpxpower,xpower);
(A) \(\left[\matrix{\displaystyle
-3&-4&1&0&0&0&0&0&-10\cr
-10&-3&-4&1&0&0&0&0&0\cr
0&-10&-3&-4&1&0&0&0&0\cr
60&89&4&10&-8&1&0&0&100\cr
100&60&89&4&10&-8&1&0&0\cr
0&100&60&89&4&10&-8&1&0}\right]\)

將常數項移到第一行
(%i19) A:addcol(col(A,h*k),submatrix(A,h*k));
(A) \(\left[\matrix{\displaystyle
-10&-3&-4&1&0&0&0&0&0\cr
0&-10&-3&-4&1&0&0&0&0\cr
0&0&-10&-3&-4&1&0&0&0\cr
100&60&89&4&10&-8&1&0&0\cr
0&100&60&89&4&10&-8&1&0\cr
0&0&100&60&89&4&10&-8&1}\right]\)

矩陣\(A\)轉置
(%i20) A:transpose(A);
(A) \(\left[\matrix{\displaystyle
-10&0&0&100&0&0\cr
-3&-10&0&60&100&0\cr
-4&-3&-10&89&60&100\cr
1&-4&-3&4&89&60\cr
0&1&-4&10&4&89\cr
0&0&1&-8&10&4\cr
0&0&0&1&-8&10\cr
0&0&0&0&1&-8\cr
0&0&0&0&0&1}\right]\)

左下角0矩陣
(%i21) Zero:zeromatrix((h-1)*k,h*k);
(Zero) \(\left[\matrix{\displaystyle
0&0&0&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0}\right]\)

右下角矩陣元素\(N^v\)
(%i22) Npower:create_list(N^v,v,1,h-1,u,0,k-1);
(Npower) \([1131,1131,1131,1279161,1279161,1279161]\)

右下角矩陣
(%i23) D2:diag(Npower);
(D2) \(\left[\matrix{\displaystyle
1131&0&0&0&0&0\cr
0&1131&0&0&0&0\cr
0&0&1131&0&0&0\cr
0&0&0&1279161&0&0\cr
0&0&0&0&1279161&0\cr
0&0&0&0&0&1279161}\right]\)

4個子矩陣合併成矩陣\(M\)
(%i24) M:addrow(addcol(D1,A),addcol(Zero,D2));
(M) \(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&0&0&0&0&0&0&-10&0&0&100&0&0\cr
0&\frac{1}{54}&0&0&0&0&0&0&0&-3&-10&0&60&100&0\cr
0&0&\frac{1}{324}&0&0&0&0&0&0&-4&-3&-10&89&60&100\cr
0&0&0&\frac{1}{1944}&0&0&0&0&0&1&-4&-3&4&89&60\cr
0&0&0&0&\frac{1}{11664}&0&0&0&0&0&1&-4&10&4&89\cr
0&0&0&0&0&\frac{1}{69984}&0&0&0&0&0&1&-8&10&4\cr
0&0&0&0&0&0&\frac{1}{419904}&0&0&0&0&0&1&-8&10\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&0&0&0&0&0&1&-8\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1\cr
0&0&0&0&0&0&0&0&0&1131&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&1131&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&1131&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&1279161&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&1279161&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&0&1279161}\right]\)

將矩陣\(M\)複製成另一個矩陣\(\widetilde{M}\),進行矩陣列運算
(%i25) M_tilde:copymatrix(M)$

將右上角化簡為零
(%i27)
for i:k+1 thru n do
  (for j:1 thru i-1 do
     (print("第",j,"列=第",j,"列-",M_tilde[j,i+n-k],"*第",i,"列=",
               M_tilde[j]:M_tilde[j]-M_tilde[j,i+n-k]*M_tilde[ i ])
     )
  )$
M_tilde;

(%o27)
第1列=第1列--10*第4列\(\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},0,0,0,0,0,0,-40,-30,140,890,600\right]\)
第2列=第2列--3*第4列\(\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},0,0,0,0,0,0,-22,-9,72,367,180\right]\)
第3列=第3列--4*第4列\(\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},0,0,0,0,0,0,-19,-22,105,416,340\right]\)
第1列=第1列--40*第5列\(\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},0,0,0,0,0,0,-190,540,1050,4160\right]\)
第2列=第2列--22*第5列\(\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},0,0,0,0,0,0,-97,292,455,2138\right]\)
第3列=第3列--19*第5列\(\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},0,0,0,0,0,0,-98,295,492,2031\right]\)
第4列=第4列--4*第5列\(\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},0,0,0,0,1,0,-19,44,105,416\right]\)
第1列=第1列--190*第6列\(\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},\frac{95}{34992},0,0,0,0,0,0,-980,2950,4920\right]\)
第2列=第2列--97*第6列\(\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},\frac{97}{69984},0,0,0,0,0,0,-484,1425,2526\right]\)
第3列=第3列--98*第6列\(\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},\frac{49}{34992},0,0,0,0,0,0,-489,1472,2423\right]\)
第4列=第4列--19*第6列\(\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},\frac{19}{69984},0,0,0,1,0,0,-108,295,492\right]\)
第5列=第5列--4*第6列\(\displaystyle =\left[0,0,0,0,\frac{1}{11664},\frac{1}{17496},0,0,0,0,1,0,-22,44,105\right]\)
第1列=第1列--980*第7列\(\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},\frac{95}{34992},\frac{245}{104976},0,0,0,0,0,0,-4890,14720\right]\)
第2列=第2列--484*第7列\(\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},\frac{97}{69984},\frac{121}{104976},0,0,0,0,0,0,-2447,7366\right]\)
第3列=第3列--489*第7列\(\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},\frac{49}{34992},\frac{163}{139968},0,0,0,0,0,0,-2440,7313\right]\)
第4列=第4列--108*第7列\(\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},\frac{19}{69984},\frac{1}{3888},0,0,1,0,0,0,-569,1572\right]\)
第5列=第5列--22*第7列\(\displaystyle =\left[0,0,0,0,\frac{1}{11664},\frac{1}{17496},\frac{11}{209952},0,0,0,1,0,0,-132,325\right]\)
第6列=第6列--8*第7列\(\displaystyle =\left[0,0,0,0,0,\frac{1}{69984},\frac{1}{52488},0,0,0,0,1,0,-54,84\right]\)
第1列=第1列--4890*第8列\(\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},\frac{95}{34992},\frac{245}{104976},\frac{815}{419904},0,0,0,0,0,0,-24400\right]\)
第2列=第2列--2447*第8列\(\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},\frac{97}{69984},\frac{121}{104976},\frac{2447}{2519424},0,0,0,0,0,0,-12210\right]\)
第3列=第3列--2440*第8列\(\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},\frac{49}{34992},\frac{163}{139968},\frac{305}{314928},0,0,0,0,0,0,-12207\right]\)
第4列=第4列--569*第8列\(\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},\frac{19}{69984},\frac{1}{3888},\frac{569}{2519424},0,1,0,0,0,0,-2980\right]\)
第5列=第5列--132*第8列\(\displaystyle =\left[0,0,0,0,\frac{1}{11664},\frac{1}{17496},\frac{11}{209952},\frac{11}{209952},0,0,1,0,0,0,-731\right]\)
第6列=第6列--54*第8列\(\displaystyle =\left[0,0,0,0,0,\frac{1}{69984},\frac{1}{52488},\frac{1}{46656},0,0,0,1,0,0,-348\right]\)
第7列=第7列--8*第8列\(\displaystyle =\left[0,0,0,0,0,0,\frac{1}{419904},\frac{1}{314928},0,0,0,0,1,0,-54\right]\)
第1列=第1列--24400*第9列\(\displaystyle =\left[\frac{1}{9},0,0,\frac{5}{972},\frac{5}{1458},\frac{95}{34992},\frac{245}{104976},\frac{815}{419904},\frac{1525}{944784},0,0,0,0,0,0\right]\)
第2列=第2列--12210*第9列\(\displaystyle =\left[0,\frac{1}{54},0,\frac{1}{648},\frac{11}{5832},\frac{97}{69984},\frac{121}{104976},\frac{2447}{2519424},\frac{2035}{2519424},0,0,0,0,0,0\right]\)
第3列=第3列--12207*第9列\(\displaystyle =\left[0,0,\frac{1}{324},\frac{1}{486},\frac{19}{11664},\frac{49}{34992},\frac{163}{139968},\frac{305}{314928},\frac{4069}{5038848},0,0,0,0,0,0\right]\)
第4列=第4列--2980*第9列\(\displaystyle =\left[0,0,0,\frac{1}{1944},\frac{1}{2916},\frac{19}{69984},\frac{1}{3888},\frac{569}{2519424},\frac{745}{3779136},1,0,0,0,0,0\right]\)
第5列=第5列--731*第9列\(\displaystyle =\left[0,0,0,0,\frac{1}{11664},\frac{1}{17496},\frac{11}{209952},\frac{11}{209952},\frac{731}{15116544},0,1,0,0,0,0\right]\)
第6列=第6列--348*第9列\(\displaystyle =\left[0,0,0,0,0,\frac{1}{69984},\frac{1}{52488},\frac{1}{46656},\frac{29}{1259712},0,0,1,0,0,0\right]\)
第7列=第7列--54*第9列\(\displaystyle =\left[0,0,0,0,0,0,\frac{1}{419904},\frac{1}{314928},\frac{1}{279936},0,0,0,1,0,0\right]\)
第8列=第8列--8*第9列\(\displaystyle =\left[0,0,0,0,0,0,0,\frac{1}{2519424},\frac{1}{1889568},0,0,0,0,1,0\right]\)
\(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}&0&0&0&0&0&0\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}&0&0&0&0&0&0\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}&0&0&0&0&0&0\cr
0&0&0&\frac{1}{1944}&\frac{1}{2916}&\frac{19}{69984}&\frac{1}{3888}&\frac{569}{2519424}&\frac{745}{3779136}&1&0&0&0&0&0\cr
0&0&0&0&\frac{1}{11664}&\frac{1}{17496}&\frac{11}{209952}&\frac{11}{209952}&\frac{731}{15116544}&0&1&0&0&0&0\cr
0&0&0&0&0&\frac{1}{69984}&\frac{1}{52488}&\frac{1}{46656}&\frac{29}{1259712}&0&0&1&0&0&0\cr
0&0&0&0&0&0&\frac{1}{419904}&\frac{1}{314928}&\frac{1}{279936}&0&0&0&1&0&0\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&\frac{1}{1889568}&0&0&0&0&1&0\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1\cr
0&0&0&0&0&0&0&0&0&1131&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&1131&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&1131&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&1279161&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&1279161&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&0&1279161}\right]\)

將右下角化簡為零
(%i29)
for i:k+1 thru n do
  (j:i+n-k,
   print("第",j,"列=第",j,"列-",M_tilde[j,j],"*第",i,"列=",
    M_tilde[j]:M_tilde[j]-M_tilde[j,j]*M_tilde[ i ])
  )$
M_tilde;

(%o29)
第10列=第10列-1131*第4列\(\displaystyle =\left[0,0,0,-\frac{377}{648},-\frac{377}{972},-\frac{7163}{23328},-\frac{377}{1296},-\frac{214513}{839808},-\frac{280865}{1259712},0,0,0,0,0,0\right]\)
第11列=第11列-1131*第5列\(\displaystyle =\left[0,0,0,0,-\frac{377}{3888},-\frac{377}{5832},-\frac{4147}{69984},-\frac{4147}{69984},-\frac{275587}{5038848},0,0,0,0,0,0\right]\)
第12列=第12列-1131*第6列\(\displaystyle =\left[0,0,0,0,0,-\frac{377}{23328},-\frac{377}{17496},-\frac{377}{15552},-\frac{10933}{419904},0,0,0,0,0,0\right]\)
第13列=第13列-1279161*第7列\(\displaystyle =\left[0,0,0,0,0,0,-\frac{142129}{46656},-\frac{142129}{34992},-\frac{142129}{31104},0,0,0,0,0,0\right]\)
第14列=第14列-1279161*第8列\(\displaystyle =\left[0,0,0,0,0,0,0,-\frac{142129}{279936},-\frac{142129}{209952},0,0,0,0,0,0\right]\)
第15列=第15列-1279161*第9列\(\displaystyle =\left[0,0,0,0,0,0,0,0,-\frac{142129}{1679616},0,0,0,0,0,0\right]\)
\(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}&0&0&0&0&0&0\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}&0&0&0&0&0&0\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}&0&0&0&0&0&0\cr
0&0&0&\frac{1}{1944}&\frac{1}{2916}&\frac{19}{69984}&\frac{1}{3888}&\frac{569}{2519424}&\frac{745}{3779136}&1&0&0&0&0&0\cr
0&0&0&0&\frac{1}{11664}&\frac{1}{17496}&\frac{11}{209952}&\frac{11}{209952}&\frac{731}{15116544}&0&1&0&0&0&0\cr
0&0&0&0&0&\frac{1}{69984}&\frac{1}{52488}&\frac{1}{46656}&\frac{29}{1259712}&0&0&1&0&0&0\cr
0&0&0&0&0&0&\frac{1}{419904}&\frac{1}{314928}&\frac{1}{279936}&0&0&0&1&0&0\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&\frac{1}{1889568}&0&0&0&0&1&0\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1\cr
0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}&0&0&0&0&0&0\cr
0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}&0&0&0&0&0&0\cr
0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}&0&0&0&0&0&0\cr
0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&-\frac{142129}{1679616}&0&0&0&0&0&0}\right]\)

將對角線元素為1的一整列移到整個矩陣下方
(%i31)
for i:k+1 thru n do
  (j:i+n-k,
   print("第",i,"列和第",j,"列交換"),
   [M_tilde[j],M_tilde[ i ]]:[M_tilde[ i ],M_tilde[j]]
  )$
M_tilde;

(%o31)
第4列和第10列交換
第5列和第11列交換
第6列和第12列交換
第7列和第13列交換
第8列和第14列交換
第9列和第15列交換
\(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}&0&0&0&0&0&0\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}&0&0&0&0&0&0\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}&0&0&0&0&0&0\cr
0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}&0&0&0&0&0&0\cr
0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}&0&0&0&0&0&0\cr
0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}&0&0&0&0&0&0\cr
0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&-\frac{142129}{1679616}&0&0&0&0&0&0\cr
0&0&0&\frac{1}{1944}&\frac{1}{2916}&\frac{19}{69984}&\frac{1}{3888}&\frac{569}{2519424}&\frac{745}{3779136}&1&0&0&0&0&0\cr
0&0&0&0&\frac{1}{11664}&\frac{1}{17496}&\frac{11}{209952}&\frac{11}{209952}&\frac{731}{15116544}&0&1&0&0&0&0\cr
0&0&0&0&0&\frac{1}{69984}&\frac{1}{52488}&\frac{1}{46656}&\frac{29}{1259712}&0&0&1&0&0&0\cr
0&0&0&0&0&0&\frac{1}{419904}&\frac{1}{314928}&\frac{1}{279936}&0&0&0&1&0&0\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&\frac{1}{1889568}&0&0&0&0&1&0\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1}\right]\)

得到左上角矩陣\(\widehat{M}\)
(%i32) M_hat:genmatrix(lambda([i,j],M_tilde[i,j]),n,n);
(M_hat) \(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}\cr
0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}\cr
0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}\cr
0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}\cr
0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}\cr
0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}\cr
0&0&0&0&0&0&0&0&-\frac{142129}{1679616}}\right]\)

\(\widehat{M}\)變成整數
(%i33) M_hat:M_hat*1/delta*X^(n-1);
(M_hat) \(\left[\matrix{\displaystyle
1679616&0&0&77760&51840&41040&35280&29340&24400\cr
0&279936&0&23328&28512&20952&17424&14682&12210\cr
0&0&46656&31104&24624&21168&17604&14640&12207\cr
0&0&0&-8794656&-5863104&-4641624&-4397328&-3861234&-3370380\cr
0&0&0&0&-1465776&-977184&-895752&-895752&-826761\cr
0&0&0&0&0&-244296&-325728&-366444&-393588\cr
0&0&0&0&0&0&-46049796&-61399728&-69074694\cr
0&0&0&0&0&0&0&-7674966&-10233288\cr
0&0&0&0&0&0&0&0&-1279161}\right]\)

LLL化簡
(%i34) B: LLL(M_hat);
(B) \(\left[\matrix{\displaystyle
0&0&46656&31104&24624&21168&17604&14640&12207\cr
0&279936&-46656&-7776&3888&-216&-180&42&3\cr
0&0&186624&124416&98496&-159624&-255312&-307884&-344760\cr
0&0&-46656&-31104&-24624&223128&308124&351804&-897780\cr
0&0&513216&342144&-1194912&-255744&-50652&-1824&94692\cr
1679616&0&-46656&46656&27216&19872&17676&14700&12193\cr
0&0&-513216&-342144&-270864&2210112&3063636&-4171566&-35880\cr
0&559872&3825792&-6197472&610416&67608&-231696&55866&135297\cr
0&0&-559872&-373248&-4692816&20511144&-17352684&1982268&-265239}\right]\)

Gram-Schmidt正交化
(%i35) Bstar:apply(matrix,expand(gramschmidt(B)));
(Bstar) 矩陣太大不列出來

取最後一個正交向量
(%i36) Bstar_n:Bstar[n];
(Bstar_n) \(\displaystyle \left[-\frac{6714060256800}{194554091},-\frac{24170616924480}{194554091},-\frac{215118490627872}{194554091},-\frac{58009480618752}{194554091},-\frac{870142209281280}{194554091},\frac{4176682604550144}{194554091},-\frac{3132511953412608}{194554091},0,0\right]\)

取各分數的分母
(%i37) Denom:map('denom,Bstar_n);
(Denom) \(\left[194554091,194554091,194554091,194554091,194554091,194554091,194554091,1,1\right]\)

求最大的分母
(%i38) MaxDenom:lmax(%);
(MaxDenom) 194554091

正交向量化為整數
(%i39) Bstar_n:Bstar_n*MaxDenom;
(Bstar_n) \(\left[-6714060256800,-24170616924480,-215118490627872,-58009480618752,-870142209281280,4176682604550144,-3132511953412608,0,0\right]\)

計算最大公因數
(%i40) GCD:lreduce('gcd,Bstar_n);
(GCD) 268562410272

同除最大公因數,得到化簡的正交向量
(%i41) Bstar_n:Bstar_n/GCD;
(Bstar_n) \(\left[-25,-90,-801,-216,-3240,15552,-11664,0,0\right]\)

正交向量和\(\displaystyle \left(\frac{x}{X}\right)^{i}\)相乘
(%i42) hx:sum(Bstar_n[i+1]*(x/X)^i,i,0,n-1);
(hx) \(\displaystyle -\frac{1}{4}x^6+2x^5-\frac{5}{2}x^4-x^3-\frac{89}{4}x^2-15x-25\)

取\(h(x)\)各項係數
(%i43) 
(coef) \(\left[\matrix{\displaystyle -15&-\frac{89}{4}&-1&-\frac{5}{2}&2&-\frac{1}{4}&0&0&-25}\right]\)

取\(h(x)\)係數的分母
(%i44) Denom:map('denom,args(coef)[1]);
(Denom) \([1,4,1,2,1,4,1,1,1]\)

求最大的分母
(%i45) MaxDenom:lmax(Denom);
(MaxDenom) 4

將\(h(x)\)化成整數
(%i46) hx:expand(hx*MaxDenom);
(hx) 

將\(h(x)\)因式分解
(%i47) factor(hx);
(%o47) \(-(x-5)^2(x^2+x+2)^2\)

得到\(h(x)\)的解
(%i48) x:5;
(x) 5

驗證答案
(%i49) ev(mod(px,N),x=5);
(%o49) 0
作者: bugmens    時間: 2021-6-19 17:56

Howgrave-Graham論文中回顧Coppersmith方法,但步驟3,4又和Coppersmith有些許不同,本文章就之前範例說明。





方法

範例

步驟1:計算參數\(h\)和\(X\)(和Coppersmith相同)

步驟2:產生矩陣\(M\)(和Coppersmith相同)

步驟3:矩陣\(M\)基本列運算得到\(\widehat{M}\),計算\([r(x)H_1^{-1}]_{sh}\)

因為\(p(x)\)為monic(最高次方項係數為1),在矩陣\(A\)的對角線元素為1,進行基本列運算將右上角化簡為零,右下角化簡為零,再將對角線元素為1的一整列移到整個矩陣下方。
\(\widetilde{M}=H_1M=\left[\matrix{\widehat{M}&│&0_{(hk\times (h-1)k)}\cr ―&┼&――――――\cr A'&│&I_{(h-1)k}}\right]\)
得到左上角矩陣\(\widehat{M}\)
計算矩陣\(H_1^{-1}=M\widetilde{M}^{-1}\)
\(r(x)=[1,x_0,x_0^2,x_0^3,x_0^4,x_0^5,-y_0,-x_0y_0,-y_0^2,-x_0y_0^2]\)
又\(p(x_0)\equiv 0\pmod{N}\),\(p(x_0)=y_0N\),\(\displaystyle y_0=\frac{p(x_0)}{N}\)
\(\displaystyle r(x)=[1,x_0,x_0^2,x_0^3,x_0^4,x_0^5,-\frac{p(x_0)}{N},-\frac{x_0p(x_0)}{N},-\frac{p^2(x_0)}{N},-\frac{x_0p^2(x_0)}{N}]\)
計算\(\displaystyle p(x_0)H_1^{-1}\)
將後面的0刪除\(\displaystyle [p(x_0)H_1^{-1}]_{sh}\)
\(H_1^{-1}=M\widetilde{M}^{-1}=\left[\matrix{
1&&&&&&19&0&361&0\cr
&1&&&&&14&19&532&361\cr
&&&&&&1&14&234&532\cr
&&&&&&&1&28&234\cr
&&&&&&&&1&28\cr
&&&&&&&&&1\cr
&&1&&&&35&&&\cr
&&&1&&&&35&&\cr
&&&&1&&&&1225&\cr
&&&&&1&&&&1225} \right]\)
\(\displaystyle r(x)=(1,x,x^2,x^3,x^4,x^5,-\frac{p(x)}{35},-\frac{xp(x)}{35},-\frac{p^2(x)}{35^2},-\frac{xp^2(x)}{35^2})\)
\(r(x)H_1^{-1}=(1,x,-\frac{p(x)}{35},-\frac{xp(x)}{35},-\frac{p^2(x)}{35^2},-\frac{xp^2(x)}{35^2},\)
     \(19+14x+x^2-p(x),\)
     \(19x+14x^2+x^3-xp(x),\)
     \(361+532x+234x^2+28x^3+x^4-p^2(x),\)
     \(361x+532x^2+234x^3+28x^4+x^5-xp^2(x))\)
\(r(x)H_1^{-1}=(1,x,-\frac{p(x)}{35},-\frac{xp(x)}{35},-\frac{p^2(x)}{35^2},-\frac{xp^2(x)}{35^2},0,0,0,0)\)
\(\left[r(x)H_1^{-1}\right]_{sh}=(1,x,-\frac{p(x)}{35},-\frac{xp(x)}{35},-\frac{p^2(x)}{35^2},-\frac{xp^2(x)}{35^2})\)

步驟4:經LLL化簡和計算矩陣\(H_2^{-1}\)得到不需要同餘\(N\)的方程式

\(B_2=LLL(\widehat{M})\)
計算\(B_2=H_2\widehat{M}\),\(H_2^{-1}=\widehat{M}B_2^{-1}\)
\(r'_{hk}(x)=[r(x)H_1^{-1}]_{sh}\cdot ((H_2^{-1})_{hk})^T\)
解出\(x\)

\(\widehat{M}=\left[\matrix{
32&0&-152&1064&-6726&42028\cr
&16&-112&708&-4424&27605\cr
&&-280&1960&-11060&58800\cr
&&&-140&1960&-19250\cr
&0&&&-2450&34300\cr
&&&&&-1225}\right]\)
\(B=LLL(\widehat{M})=\left[\matrix{0&160&0&-60&0&-100\cr
-64&-64&-88&80&-72&-51\cr
64&-48&32&4&-180&16\cr
128&-80&-48&16&116&-13\cr
-32&-96&-16&-132&90&-108\cr
-64&-32&248&96&-30&-141}\right]\)

\(H_2^{-1}=\widehat{M}B_2^{-1}=\left[\matrix{-166&-125&-9&-111&-73&-70\cr
-109&-82&-6&-73&-48&-46\cr
-231&-171&-7&-157&-104&-98\cr
77&60&8&50&32&32\cr
-138&-109&-18&-88&-56&-57\cr
5&4&1&3&2&2}\right]\)
\(((H_2^{-1})_{6})^T=\left[-70,-46,-98,32,-57,2\right]\)
\(\displaystyle [r(x)H_1^{-1}]_{sh}\cdot ((H_2^{-1})_6)^T=-70\cdot 1-46x+98\frac{p(x)}{35}-32\frac{xp(x)}{35}+57\frac{p^2(x)}{35^2}-2\frac{xp^2(x)}{35^2}\)
\(\displaystyle h(x)=\frac{-1}{1225}(2x^5-x^4-8x^3-24x^2+8x+3)\)
  \(\displaystyle =\frac{-1}{1225}(x-3)(2x-1)(x^3+3x^2+5x+1)\)
解方程式得到答案
\(x=3\)

註:
1.原論文用\(c(x)\),本文章和Coppersmith一致用\(r(x)\)。
2.原論文的\(\widehat{M}\)有行列互換,但本文章沒有行列互換,但不影響計算過程。
原論文
\(\widetilde{M}=\left[\matrix{
-1225&&&&&\cr
34300&-2450&&&&\cr
-19250&1960&-140&&&\cr
58800&-11060&1960&-280&&\cr
27605&-4424&708&-112&16&\cr
42028&-6726&1064&-152&0&32}\right]\),\(H_2^{-1}=\left[\matrix{
-5&4&-2&1&-1&-2\cr
138&-109&56&-18&31&57\cr
-77&60&-32&8&-18&-32\cr
231&-171&104&-7&59&98\cr
109&-82&48&-6&27&46\cr
166&-125&73&-9&41&70}\right]\)
本文章
\(\widetilde{M}=\left[\matrix{
32&0&-152&1064&-6726&42028\cr
&16&-112&708&-4424&27605\cr
&&-280&1960&-11060&58800\cr
&&&-140&1960&-19250\cr
&&&&-2450&34300\cr
&&&&&-1225}\right]\),\(H_2^{-1}=\left[\matrix{
-166&-125&-9&-111&-73&-70\cr
-109&-82&-6&-73&-48&-46\cr
-231&-171&-7&-157&-104&-98\cr
77&60&8&50&32&32\cr
-138&-109&-18&-88&-56&-57\cr
5&4&1&3&2&2}\right]\)


參考資料:
N. Howgrave-Graham. Finding small roots of univariate modular equations revisited. In Cryptography and Coding– Proc. IMA ’97, volume 1355 of Lecture Notes in Computer Science, pages 131–142. Springer, 1997.
https://link.springer.com/chapter/10.1007/BFb0024458



請下載LLL.zip,解壓縮後將LLL.mac放到C:\maxima-5.45.0\share\maxima\5.45.0\share目錄下
要先載入LLL.mac才能使用LLL指令

(%i1) load("LLL.mac");
(%o1) C:/maxima-5.45.0/share/maxima/5.45.0/share/LLL.mac

同餘方程式
(%i2) px:x^2+14*x+19;
(px) \(x^2+14x+19\)

\(p(x)\equiv 0\pmod{N}\)
(%i3) N:35;
(N) 35

\(p(x)\)的次數\(k\)
(%i4) k:hipow(px,x);
(k) 2

設誤差值\(epsilon=0.1\)
(%i5) epsilon:0.1;
(epsilon) 0.1

參數\(h\)
(%i7)
h:ceiling(max(7/k,(k+epsilon*k-1)/(epsilon*k^2)));
h:3;

(h) 4
(h) 3

\(\widehat{M}\)的維度\(n=hk\)
(%i8) n:h*k;
(n) 6

參數\(\delta\),按照公式應該是\(\displaystyle \delta=\frac{1}{\sqrt{6}}\),本範例\(\delta=1\)
(%i10)
delta:1/sqrt(h*k);
delta:1;

(delta) \(\displaystyle \frac{1}{\sqrt{6}}\)
(delta) 1

希望能找到\(|\;x|\;<X=\frac{1}{2}N^{1/k}\),\(p(x)\equiv 0\pmod{N}\)
(%i11) X:floor(1/2*N^(1/k));
(X) 2

產生矩陣\(M\)
(%i14)
kill(genlattice)$
genlattice[i,j]:=(
v:floor((k+j-h*k-1)/k),
u: (j-h*k-1)-k*(v-1),
if i<=h*k and j<=h*k then if i=j then delta*X^(1-i) else 0/*左上角矩陣*/
else if i<=h*k and j>h*k then (coeff(expand(x^u*px^v),x,i-1))/*右上角矩陣*/
else if i>h*k and j<=h*k then 0/*左下角矩陣*/
else if i>h*k and j>h*k then if i=j then N^v else 0)$/*右下角矩陣*/
M:genmatrix(genlattice,2*h*k-k,2*h*k-k);

(M) \(\left[\matrix{\displaystyle
1&0&0&0&0&0&19&0&361&0\cr
0&\frac{1}{2}&0&0&0&0&14&19&532&361\cr
0&0&\frac{1}{4}&0&0&0&1&14&234&532\cr
0&0&0&\frac{1}{8}&0&0&0&1&28&234\cr
0&0&0&0&\frac{1}{16}&0&0&0&1&28\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1\cr
0&0&0&0&0&0&35&0&0&0\cr
0&0&0&0&0&0&0&35&0&0\cr
0&0&0&0&0&0&0&0&1225&0\cr
0&0&0&0&0&0&0&0&0&1225}\right]\)

將矩陣\(M\)複製成另一個矩陣\(\widetilde{M}\)
(%i15) M_tilde:copymatrix(M)$

矩陣\(\widetilde{M}\)進行矩陣列運算
(%i17)
for i:n thru k+1 step -1 do
  (for j:1 thru i-1 do
      (M_tilde:rowop(M_tilde,j,i,M_tilde[j,i+n-k])),/*消掉右上角*/
   j:i+n-k,
   M_tilde:rowop(M_tilde,j,i,M_tilde[j,j]),/*消掉右下角N^v*/
   M_tilde:rowswap(M_tilde,i,j)/*列交換*/
   )$
M_tilde;

(%o17) \(\left[\matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}&0&0&0&0\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}&0&0&0&0\cr
0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}&0&0&0&0\cr
0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}&0&0&0&0\cr
0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}&0&0&0&0\cr
0&0&0&0&0&-\frac{1225}{32}&0&0&0&0\cr
0&0&\frac{1}{4}&-\frac{7}{4}&\frac{79}{8}&-\frac{105}{2}&1&0&0&0\cr
0&0&0&\frac{1}{8}&-\frac{7}{4}&\frac{275}{16}&0&1&0&0\cr
0&0&0&0&\frac{1}{16}&-\frac{7}{8}&0&0&1&0\cr
0&0&0&0&0&\frac{1}{32}&0&0&0&1}\right]\)

計算矩陣\(H_1^{-1}=M\widetilde{M}^{-1}\)
(%i18) H1_inv:M.invert(M_tilde);
(H1_inv) \(\left[\matrix{\displaystyle
1&0&0&0&0&0&19&0&361&0\cr
0&1&0&0&0&0&14&19&532&361\cr
0&0&0&0&0&0&1&14&234&532\cr
0&0&0&0&0&0&0&1&28&234\cr
0&0&0&0&0&0&0&0&1&28\cr
0&0&0&0&0&0&0&0&0&1\cr
0&0&1&0&0&0&35&0&0&0\cr
0&0&0&1&0&0&0&35&0&0\cr
0&0&0&0&1&0&0&0&1225&0\cr
0&0&0&0&0&1&0&0&0&1225}\right]\)

產生\(r(x)\)
(%i19) rx:create_list(x^i,i,0,h*k-1);
(rx) \(\left[1,x,x^2,x^3,x^4,x^5\right]\)

產生\(r(x)\)
(%i21)
for j:1 thru h*k-k do
  (print("j=",j,
           ",v=floor(","k+j-1"/"k",")=floor(",(k+j-1)/k,")=",v:floor((k+j-1)/k),
            ",u=(j-1)-k(v-1)=(",j,"-1)-",k,"(",v,"-1)","=",u: (j-1)-k*(v-1),
            ",-","x"^"u"*"p(x)"^"v"/"N"^"v","=","-","x"^u*"p(x)"^v/"N"^v),
   rx:append(rx,[-x^u*px^v/N^v])
  )$
rx;

\(\displaystyle j=1,v=floor(\frac{k+j-1}{k})=floor(1)=1,u=(j-1)-k(v-1)=(1-1)-2(1-1)=0,-\frac{p(x)^v x^u}{N^v}=-\frac{p(x)}{N}\)
\(\displaystyle j=2,v=floor(\frac{k+j-1}{k})=floor(\frac{3}{2})=1,u=(j-1)-k(v-1)=(2-1)-2(1-1)=1,-\frac{p(x)^v x^u}{N^v}=-\frac{p(x)x}{N}\)
\(\displaystyle j=3,v=floor(\frac{k+j-1}{k})=floor(2)=2,u=(j-1)-k(v-1)=(3-1)-2(2-1)=0,-\frac{p(x)^v x^u}{N^v}=-\frac{p(x)^2}{N^2}\)
\(\displaystyle j=4,v=floor(\frac{k+j-1}{k})=floor(\frac{5}{2})=2,u=(j-1)-k(v-1)=(4-1)-2(2-1)=1,-\frac{p(x)^v x^u}{N^v}=-\frac{p(x)^2x}{N^2}\)
(%o21) \(\displaystyle \left[1,x,x^2,x^3,x^4,x^5,\frac{-x^2-14x-19}{35},-\frac{x(x^2+14x+19)}{35},-\frac{(x^2+14x+19)^2}{1225},-\frac{x(x^2+14x+19)^2}{1225}\right]\)

計算\(r(x)H_1^{-1}\)
(%i22) rxH1_inv:args(rx.H1_inv)[1];
(rxH1_inv) \(\displaystyle [1,x,\frac{-x^2-14x-19}{35},-\frac{x(x^2+14*x+19)}{35},-\frac{(x^2+14x+19)^2}{1225},-\frac{x(x^2+14x+19)^2}{1225},0,\)
      \(x^3-x(x^2+14x+19)+14x^2+19x,\)
      \(-(x^2+14x+19)^2+x^4+28x^3+234x^2+532x+361,\)
      \(-x(x^2+14x+19)^2+x^5+28x^4+234x^3+532x^2+361x]\)

其中\(r(x)H_1^{-1}\)後面化簡為0
(%i23) rxH1_inv:ratsimp(rxH1_inv);
(rxH1_inv) \(\displaystyle \left[1,x,-\frac{x^2+14x+19}{35},-\frac{x^3+14x^2+19x}{35},-\frac{x^4+28x^3+234x^2+532x+361}{1225},-\frac{x^5+28x^4+234x^3+532x^2+361x}{1225},0,0,0,0\right]\)

縮短\(r(x)H_1^{-1}\)長度
(%i24) rxH1_inv_short:rest(rxH1_inv,-(h*k-k));
(rxH1_inv_short) \(\displaystyle \left[1,x,-\frac{x^2+14x+19}{35},-\frac{x^3+14x^2+19x}{35},-\frac{x^4+28x^3+234x^2+532x+361}{1225},-\frac{x^5+28x^4+234x^3+532x^2+361x}{1225}\right]\)

得到左上角矩陣\(\widehat{M}\)
(%i25) M_hat:genmatrix(lambda([i,j],M_tilde[i,j]),n,n);
(M_hat) \(\left[\matrix{\displaystyle
1&0&-\frac{19}{4}&\frac{133}{4}&-\frac{3363}{16}&\frac{10507}{8}\cr
0&\frac{1}{2}&-\frac{7}{2}&\frac{177}{8}&-\frac{553}{4}&\frac{27605}{32}\cr
0&0&-\frac{35}{4}&\frac{245}{4}&-\frac{2765}{8}&\frac{3675}{2}\cr
0&0&0&-\frac{35}{8}&\frac{245}{4}&-\frac{9625}{16}\cr
0&0&0&0&-\frac{1225}{16}&\frac{8575}{8}\cr
0&0&0&0&0&-\frac{1225}{32}}\right]\)

\(\widehat{M}\)乘32倍變成整數
(%i26) M_hat:M_hat*1/delta*X^(n-1);
(M_hat) \(\left[\matrix{\displaystyle
32&0&-152&1064&-6726&42028\cr
0&16&-112&708&-4424&27605\cr
0&0&-280&1960&-11060&58800\cr
0&0&0&-140&1960&-19250\cr
0&0&0&0&-2450&34300\cr
0&0&0&0&0&-1225}\right]\)

LLL化簡
(%i27) B2: LLL(M_hat);
(B2) \(\left[\matrix{\displaystyle
0&160&0&-60&0&-100\cr
-64&-64&-88&80&-72&-51\cr
64&-48&32&4&-180&16\cr
128&-80&-48&16&116&-13\cr
-32&-96&-16&-132&90&-108\cr
-64&-32&248&96&-30&-141}\right]\)

計算矩陣\(H_2^{-1}=\widehat{M}B_2^{-1}\)
(%i28) H2_inv:M_hat.invert(B2);
(H2_inv) \(\left[\matrix{\displaystyle
-166&-125&-9&-111&-73&-70\cr
-109&-82&-6&-73&-48&-46\cr
-231&-171&-7&-157&-104&-98\cr
77&60&8&50&32&32\cr
-138&-109&-18&-88&-56&-57\cr
5&4&1&3&2&2}\right]\)

取矩陣\(H_2^{-1}\)最後一行
(%i29) H2_inv_lastcolumn:transpose(col(H2_inv,n));
(H2_inv_lastcolumn) \([\matrix{-70&-46&-98&32&-57&2}]\)

將\([r(x)H_1^{-1}]_{sh}\cdot ((H_2^{-1})_{hk})^T\)相乘
(%i30) hx:rxH1_inv_short.H2_inv_lastcolumn;
(hx) \(\displaystyle -\frac{2(x^5+28x^4+234x^3+532x^2+361x)}{1225}+\frac{57(x^4+28x^3+234x^2+532x+361)}{1225}-\frac{32(x^3+14x^2+19x)}{35}+\frac{14(x^2+14x+19)}{5}-46x-70\)

將\(h(x)\)因式分解
(%i31) factor(hx);
(%o31) \(\displaystyle -\frac{(x-3)(2x-1)(x^3+3x^2+5x+1)}{1225}\)

得到\(h(x)\)的解
(%i32) x:3;
(x) 3

驗證答案
(%i33) ev(mod(px,N),x=3);
(%o33) 0
作者: bugmens    時間: 2021-6-19 18:16

解三次同餘方程式\(p(x)=x^3-4x^2-3x-10\pmod{1131}\)。

參考資料
Finding Small Roots of Polynomial Equations Using Lattice Basis Reduction
https://ntnuopen.ntnu.no/ntnu-xm ... e=1&isAllowed=y



請下載LLL.zip,解壓縮後將LLL.mac放到C:\maxima-5.45.0\share\maxima\5.45.0\share目錄下
要先載入LLL.mac才能使用LLL指令

(%i1) load("LLL.mac");
(%o1) C:/maxima-5.45.0/share/maxima/5.45.0/share/LLL.mac

同餘方程式\(p(x)\)
(%i2) px:x^3-4*x^2-3*x-10;
(px) \(x^3-4x^2-3x-10\)

\(p(x)\equiv 0\pmod{N}\)
(%i3) N:1131;
(N) 1131

\(p(x)\)的次數\(k\)
(%i4) k:hipow(px,x);
(k) 3

設誤差值\(\epsilon=0.1\)
(%i5) epsilon:0.1;
(epsilon) 0.1

參數\(h\)
(%i6) h:ceiling(max(7/k,(k+epsilon*k-1)/(epsilon*k^2)));
(h) 3

\(\widehat{M}\)的維度\(n=hk\)
(%i7) n:h*k;
(n) 9

參數\(\delta\),按照公式應該是\(\displaystyle \delta=\frac{1}{3}\),本範例\(\displaystyle \delta=\frac{1}{9}\)
(%i9)
delta:1/sqrt(h*k);
delta:1/9;

(delta) \(\displaystyle \frac{1}{3}\)
(delta) \(\displaystyle \frac{1}{9}\)

希望能找到\(\displaystyle |\;x|\;<X=\frac{1}{2}N^{1/k}\),\(p(x)\equiv 0\pmod{N}\)
按照公式應該是5,本範例\(X=6\)

(%i11)
X:floor(1/2*N^(1/k));
X:6;

(X) 5
(X) 6

產生矩陣\(M\)
(%i14)
kill(genlattice)$
genlattice[i,j]:=(
v:floor((k+j-h*k-1)/k),
u: (j-h*k-1)-k*(v-1),
if i<=h*k and j<=h*k then if i=j then delta*X^(1-i) else 0/*左上角矩陣*/
else if i<=h*k and j>h*k then (coeff(expand(x^u*px^v),x,i-1))/*右上角矩陣*/
else if i>h*k and j<=h*k then 0/*左下角矩陣*/
else if i>h*k and j>h*k then if i=j then N^v else 0)$/*右下角矩陣*/
M:genmatrix(genlattice,2*h*k-k,2*h*k-k);

(M) \(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&0&0&0&0&0&0&-10&0&0&100&0&0\cr
0&\frac{1}{54}&0&0&0&0&0&0&0&-3&-10&0&60&100&0\cr
0&0&\frac{1}{324}&0&0&0&0&0&0&-4&-3&-10&89&60&100\cr
0&0&0&\frac{1}{1944}&0&0&0&0&0&1&-4&-3&4&89&60\cr
0&0&0&0&\frac{1}{11664}&0&0&0&0&0&1&-4&10&4&89\cr
0&0&0&0&0&\frac{1}{69984}&0&0&0&0&0&1&-8&10&4\cr
0&0&0&0&0&0&\frac{1}{419904}&0&0&0&0&0&1&-8&10\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&0&0&0&0&0&1&-8\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1\cr
0&0&0&0&0&0&0&0&0&1131&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&1131&0&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&1131&0&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&1279161&0&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&1279161&0\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&0&1279161}\right]\)

將矩陣\(M\)複製成另一個矩陣\(\widetilde{M}\)
(%i15) M_tilde:copymatrix(M)$

矩陣\(\widetilde{M}\)進行矩陣列運算
(%i17)
for i:n thru k+1 step -1 do
  (for j:1 thru i-1 do
      (M_tilde:rowop(M_tilde,j,i,M_tilde[j,i+n-k])),/*消掉右上角*/
   j:i+n-k,
   M_tilde:rowop(M_tilde,j,i,M_tilde[j,j]),/*消掉右下角N^v*/
   M_tilde:rowswap(M_tilde,i,j)/*列交換*/
   )$
M_tilde;

(%o17) \(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}&0&0&0&0&0&0\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}&0&0&0&0&0&0\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}&0&0&0&0&0&0\cr
0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}&0&0&0&0&0&0\cr
0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}&0&0&0&0&0&0\cr
0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}&0&0&0&0&0&0\cr
0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}&0&0&0&0&0&0\cr
0&0&0&0&0&0&0&0&-\frac{142129}{1679616}&0&0&0&0&0&0\cr
0&0&0&\frac{1}{1944}&\frac{1}{2916}&\frac{19}{69984}&\frac{1}{3888}&\frac{569}{2519424}&\frac{745}{3779136}&1&0&0&0&0&0\cr
0&0&0&0&\frac{1}{11664}&\frac{1}{17496}&\frac{11}{209952}&\frac{11}{209952}&\frac{731}{15116544}&0&1&0&0&0&0\cr
0&0&0&0&0&\frac{1}{69984}&\frac{1}{52488}&\frac{1}{46656}&\frac{29}{1259712}&0&0&1&0&0&0\cr
0&0&0&0&0&0&\frac{1}{419904}&\frac{1}{314928}&\frac{1}{279936}&0&0&0&1&0&0\cr
0&0&0&0&0&0&0&\frac{1}{2519424}&\frac{1}{1889568}&0&0&0&0&1&0\cr
0&0&0&0&0&0&0&0&\frac{1}{15116544}&0&0&0&0&0&1}\right]\)

計算矩陣\(H_1^{-1}=M\widetilde{M}^{-1}\)
(%i18) H1_inv:M.invert(M_tilde);
(H1_inv) \(\left[\matrix{\displaystyle
1&0&0&0&0&0&0&0&0&-10&0&0&100&0&0\cr
0&1&0&0&0&0&0&0&0&-3&-10&0&60&100&0\cr
0&0&1&0&0&0&0&0&0&-4&-3&-10&89&60&100\cr
0&0&0&0&0&0&0&0&0&1&-4&-3&4&89&60\cr
0&0&0&0&0&0&0&0&0&0&1&-4&10&4&89\cr
0&0&0&0&0&0&0&0&0&0&0&1&-8&10&4\cr
0&0&0&0&0&0&0&0&0&0&0&0&1&-8&10\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&1&-8\cr
0&0&0&0&0&0&0&0&0&0&0&0&0&0&1\cr
0&0&0&1&0&0&0&0&0&1131&0&0&0&0&0\cr
0&0&0&0&1&0&0&0&0&0&1131&0&0&0&0\cr
0&0&0&0&0&1&0&0&0&0&0&1131&0&0&0\cr
0&0&0&0&0&0&1&0&0&0&0&0&1279161&0&0\cr
0&0&0&0&0&0&0&1&0&0&0&0&0&1279161&0\cr
0&0&0&0&0&0&0&0&1&0&0&0&0&0&1279161}\right]\)

產生\(r(x)\)
(%i19) rx:create_list(x^i,i,0,h*k-1);
(rx) \([1,x,x^2,x^3,x^4,x^5,x^6,x^7,x^8]\)

產生\(r(x)\)
(%i21)
for j:1 thru h*k-k do
  (print("j=",j,
           ",v=floor(","k+j-1"/"k",")=floor(",(k+j-1)/k,")=",v:floor((k+j-1)/k),
            ",u=(j-1)-k(v-1)=(",j,"-1)-",k,"(",v,"-1)","=",u: (j-1)-k*(v-1),
            ",-","x"^"u"*"p(x)"^"v"/"N"^"v","=","-","x"^u*"p(x)"^v/"N"^v),
   rx:append(rx,[-x^u*px^v/N^v])
  )$
rx;

\(\displaystyle j=1,v=floor(\frac{k+j-1}{k})=floor(1)=1,u=(j-1)-k(v-1)=(1-1)-3(1-1)=0,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)}{N}\)
\(\displaystyle j=2,v=floor(\frac{k+j-1}{k})=floor(4/3)=1,u=(j-1)-k(v-1)=(2-1)-3(1-1)=1,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)x}{N}\)
\(\displaystyle j=3,v=floor(\frac{k+j-1}{k})=floor(5/3)=1,u=(j-1)-k(v-1)=(3-1)-3(1-1)=2,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)x^2}{N}\)
\(\displaystyle j=4,v=floor(\frac{k+j-1}{k})=floor(2)=2,u=(j-1)-k(v-1)=(4-1)-3(2-1)=0,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)^2}{N^2}\)
\(\displaystyle j=5,v=floor(\frac{k+j-1}{k})=floor(7/3)=2,u=(j-1)-k(v-1)=(5-1)-3(2-1)=1,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)^2x}{N^2}\)
\(\displaystyle j=6,v=floor(\frac{k+j-1}{k})=floor(8/3)=2,u=(j-1)-k(v-1)=(6-1)-3(2-1)=2,-\frac{p(x)^vx^u}{N^v}=-\frac{p(x)^2*x^2}{N^2}\)
(%o21) \(\displaystyle [1,x,x^2,x^3,x^4,x^5,x^6,x^7,x^8,\frac{-x^3+4x^2+3x+10}{1131},-\frac{x(x^3-4x^2-3x-10)}{1131},-\frac{x^2(x^3-4x^2-3x-10)}{1131},\)
     \(\displaystyle -\frac{(x^3-4x^2-3x-10)^2}{1279161},-\frac{x(x^3-4x^2-3x-10)^2}{1279161},-\frac{x^2(x^3-4x^2-3x-10)^2}{1279161}]\)

計算\(r(x)H_1^{-1}\)
(%i22) rxH1_inv:args(rx.H1_inv)[1];
(rxH1_inv) \(\displaystyle [1,x,x^2,\frac{-x^3+4x^2+3x+10}{1131},-\frac{x(x^3-4x^2-3x-10)}{1131},-\frac{x^2(x^3-4x^2-3x-10)}{1131},-\frac{(x^3-4x^2-3x-10)^2}{1279161},-\frac{x(x^3-4x^2-3x-10)^2}{1279161},-\frac{x^2(x^3-4x^2-3x-10)^2}{1279161},0,\)
     \(x^4-x(x^3-4x^2-3x-10)-4x^3-3x^2-10x,\)
     \(x^5-4x^4-x^2(x^3-4x^2-3x-10)-3x^3-10x^2,\)
     \(-(x^3-4x^2-3x-10)^2+x^6-8x^5+10x^4+4x^3+89x^2+60x+100,\)
     \(-x(x^3-4x^2-3x-10)^2+x^7-8x^6+10x^5+4x^4+89x^3+60x^2+100x,\)
     \(-x^2(x^3-4x^2-3x-10)^2+x^8-8x^7+10x^6+4x^5+89x^4+60x^3+100x^2]\)

其中\(r(x)H_1^{-1}\)後面化簡為0
(%i23) rxH1_inv:ratsimp(rxH1_inv);
(rxH1_inv) \(\displaystyle \left[1,x,x^2,\frac{-x^3+4x^2+3x+10}{1131},-\frac{x(x^3-4x^2-3x-10)}{1131},-\frac{x^2(x^3-4x^2-3x-10)}{1131},-\frac{(x^3-4x^2-3x-10)^2}{1279161},-\frac{x(x^3-4x^2-3x-10)^2}{1279161},-\frac{x^2(x^3-4x^2-3x-10)^2}{1279161},0,0,0,0,0,0\right]\)

縮短\(r(x)H)_1^{-1}\)長度
(%i24) rxH1_inv_short:rest(rxH1_inv,-(h*k-k));
(rxH1_inv_short) \(\displaystyle \left[1,x,x^2,\frac{-x^3+4x^2+3x+10}{1131},-\frac{x(x^3-4x^2-3x-10)}{1131},-\frac{x^2(x^3-4x^2-3x-10)}{1131},-\frac{(x^3-4x^2-3x-10)^2}{1279161},-\frac{x(x^3-4x^2-3x-10)^2}{1279161},-\frac{x^2(x^3-4x^2-3x-10)^2}{1279161}\right]\)

得到左上角矩陣\(\widehat{M}\)
(%i25) M_hat:genmatrix(lambda([i,j],M_tilde[i,j]),n,n);
(M_hat) \(\left[\matrix{\displaystyle
\frac{1}{9}&0&0&\frac{5}{972}&\frac{5}{1458}&\frac{95}{34992}&\frac{245}{104976}&\frac{815}{419904}&\frac{1525}{944784}\cr
0&\frac{1}{54}&0&\frac{1}{648}&\frac{11}{5832}&\frac{97}{69984}&\frac{121}{104976}&\frac{2447}{2519424}&\frac{2035}{2519424}\cr
0&0&\frac{1}{324}&\frac{1}{486}&\frac{19}{11664}&\frac{49}{34992}&\frac{163}{139968}&\frac{305}{314928}&\frac{4069}{5038848}\cr
0&0&0&-\frac{377}{648}&-\frac{377}{972}&-\frac{7163}{23328}&-\frac{377}{1296}&-\frac{214513}{839808}&-\frac{280865}{1259712}\cr
0&0&0&0&-\frac{377}{3888}&-\frac{377}{5832}&-\frac{4147}{69984}&-\frac{4147}{69984}&-\frac{275587}{5038848}\cr
0&0&0&0&0&-\frac{377}{23328}&-\frac{377}{17496}&-\frac{377}{15552}&-\frac{10933}{419904}\cr
0&0&0&0&0&0&-\frac{142129}{46656}&-\frac{142129}{34992}&-\frac{142129}{31104}\cr
0&0&0&0&0&0&0&-\frac{142129}{279936}&-\frac{142129}{209952}\cr
0&0&0&0&0&0&0&0&-\frac{142129}{1679616}}\right]\)

\(\widehat{M}\)乘1679616變成整數
(%i26) M_hat:M_hat*1/delta*X^(n-1);
(M_hat) \(\left[\matrix{\displaystyle
1679616&0&0&77760&51840&41040&35280&29340&24400\cr
0&279936&0&23328&28512&20952&17424&14682&12210\cr
0&0&46656&31104&24624&21168&17604&14640&12207\cr
0&0&0&-8794656&-5863104&-4641624&-4397328&-3861234&-3370380\cr
0&0&0&0&-1465776&-977184&-895752&-895752&-826761\cr
0&0&0&0&0&-244296&-325728&-366444&-393588\cr
0&0&0&0&0&0&-46049796&-61399728&-69074694\cr
0&0&0&0&0&0&0&-7674966&-10233288\cr
0&0&0&0&0&0&0&0&-1279161}\right]\)

LLL化簡
(%i27) B2: LLL(M_hat);
(B2) \(\left[\matrix{\displaystyle
0&0&46656&31104&24624&21168&17604&14640&12207\cr
0&279936&-46656&-7776&3888&-216&-180&42&3\cr
0&0&186624&124416&98496&-159624&-255312&-307884&-344760\cr
0&0&-46656&-31104&-24624&223128&308124&351804&-897780\cr
0&0&513216&342144&-1194912&-255744&-50652&-1824&94692\cr
1679616&0&-46656&46656&27216&19872&17676&14700&12193\cr
0&0&-513216&-342144&-270864&2210112&3063636&-4171566&-35880\cr
0&559872&3825792&-6197472&610416&67608&-231696&55866&135297\cr
0&0&-559872&-373248&-4692816&20511144&-17352684&1982268&-265239}\right]\)

計算矩陣\(H_2^{-1}=\widehat{M}B_2^{-1}\)
(%i28) H2_inv:M_hat.invert(B2);
(H2_inv) \(\left[\matrix{\displaystyle
1&0&0&0&0&1&0&0&0\cr
1&1&0&0&0&0&0&0&0\cr
1&0&0&0&0&0&0&0&0\cr
-141&-2&6&0&3&0&0&1&0\cr
-19&0&2&0&1&0&0&0&0\cr
-4&0&1&0&0&0&0&0&0\cr
-477&0&145&14&-3&0&4&0&1\cr
-44&0&15&5&0&0&1&0&0\cr
-3&0&1&1&0&0&0&0&0}\right]\)

取矩陣\(H_2^{-1}\)最後一行
(%i29) H2_inv_lastcolumn:transpose(col(H2_inv,n));
(H2_inv_lastcolumn) \([\matrix{0&0&0&0&0&0&1&0&0}]\)

將\([r(x)H_1^{-1}]_{sh}\cdot ((H_2^{-1})_{hk})^T\)相乘
(%i30) hx:rxH1_inv_short.H2_inv_lastcolumn;
(hx) \(\displaystyle -\frac{x^6-8x^5+10x^4+4x^3+89x^2+60x+100}{1279161}\)

將\(h(x)\)因式分解
(%i31) factor(hx);
(%o31) \(\displaystyle -\frac{(x-5)^2(x^2+x+2)^2}{1279161}\)

得到\(h(x)\)的解
(%i32) x:5;
(x) 5

驗證答案
(%i33) ev(mod(px,N),x=5);
(%o33) 0




歡迎光臨 Math Pro 數學補給站 (https://math.pro/db/) 論壇程式使用 Discuz! 6.1.0