Team - Anonymous Level 6

You see the following written on the panel: n = 10628901681304595437504805072281745025198783740324152673826

676630804129595965704260761607525181044859765222866482 2222602938005564194836047871412113293603679433548079513

73714507134561572735822176513802865630676107450267173622722 2549538655637382149527573292390900027506022621838298229357799846819824421748752963

Anonymous: This door has RSA encryption with exponent 5 and the password is: 93358282649848187430044661903775419

443484025504563418969885601622922714 457181843318602008947766891951649 809852254236170346608009317628470

644231659079327275403101815122890514710083 9566518488210707247066989991357952817 3477319008729364090589747421945827527925241323

4260397162620126840971046085009283983530207432

Press c to continue>

0.1 Coppersmith method:

Finally as taught in class, when e is small we proceed with lattice theory construction using coppersmith method.Total bits = 704 bitsKnown bits = 608 bitsfrom these

ε = 0.1363636

0.1.1 polynomial construction:

Here m = a ∗ 2ε|n| + x

where a and ε are known to us. In this case (1− ε) ∗ |n| bits of m are known to us. And given that e is 5 so ciphertext will be

c = (a ∗ 2ε|n| + x)5(mod n)

Letc = (x5 + α ∗ x4 + β ∗ x3 + γ ∗ x2 + δ ∗ x+ z)(mod n)

which givesp(x) = (x5 + α ∗ x4 + β ∗ x3 + γ ∗ x2 + δ ∗ x+ z − c)

Hence we have to find the root of above polynomial mod n where α, β, γ, δ, z, c are known.

0.1.2 Lattice Construction

Letqi(x) = nxi for i = 0 to 4

qi(x) = xi−5 ∗ p(x) for i = 5, 6, 7

Lattice A =

1

Team - Anonymous Level 6

Now by Minkowski theorem:

λ(L) <=√b(det(A))1/b where b = dimension of lattice

<= sqrt(8) ∗ n5/8

By LLL theorem we can get a vector r in polynomial time such that its length

|r| <= 2(b−1)/2 ∗ λ(L) = 25 ∗ n5/8

Let r(x) be the polynomial associated with r, each coefficient of r(x) <= 25 ∗ n5/8 Further

r(x) =7∑i=0

ζi ∗ qi(x)

taking r(x)(mod n)r(x) = (ζ5 ∗ p(x) + ζ6 ∗ x ∗ p(x) + ζ7 ∗ x2 ∗ p(x))(mod n)

Clearly roots of p(x)(mod n) are roots of r(x)(mod n), we need to find root x0 r(x) such that x0 ≤ nε Let

r(x) = η0 + η1 ∗ x+ η2 ∗ x2 + η3x3 + η4 ∗ x4 + η5 ∗ x5 + η6 ∗ x6 + η7x

7

Then

|r(x0)| = |η0|+ |η1| ∗ |x0|+ |η2| ∗ |x0|2 + |η3| ∗ |x0|3 + |η4| ∗ |x0|4 + |η5| ∗ |x0|5 + |η6| ∗ |x0|6 + |η7| ∗ |x0|7

By putting maximum value of coefficients and max value of x0 we found that -

|r(x0)| ≤ 25 ∗ n(64ε+5)/8

here we need power of n should be less than 1, so

64 ∗ ε+ 5 ≤ 8

ε ≤ 3/64

2

Team - Anonymous Level 6

which is not as per our expectation so this polynomial will not work. So from this we can deduce 32 bits onlyhowever unknown bits are 96 so this polynomial will not work.

Another Lattice: We tried following lattices as well:

λ(L) ≤√

7 ∗ n

|r| ≤ 23 ∗√

7 ∗ n5/7

ε ≤ 2/49

We tried using degree 9 polynomial as well

qi = n ∗ xi for i = 0, 1, 2, 3, 4

qi = xi−5p(x) for i = 5, 6, 7, 9

but with that as well we got ε ≤ 1/20 which again gives only 36 bits roughly so we can’t proceed with this aswell.

3