1. Team - Anonymous Level 6
You see the following written on the panel: n = 10628901681304595437504805072281745025198783740324152673826
676630804129595965704260761607525181044859765222866482 2222602938005564194836047871412113293603679433548079513
73714507134561572735822176513802865630676107450267173622722 2549538655637382149527573292390900027506022621838298229357799846819824421748752963
Anonymous: This door has RSA encryption with exponent 5 and the password is: 93358282649848187430044661903775419
443484025504563418969885601622922714 457181843318602008947766891951649 809852254236170346608009317628470
644231659079327275403101815122890514710083 9566518488210707247066989991357952817 3477319008729364090589747421945827527925241323
4260397162620126840971046085009283983530207432
Press c to continue>
0.1 Coppersmith method:
Finally as taught in class, when e is small we proceed with lattice theory construction using coppersmith method.
Total bits = 704 bits
Known bits = 608 bits
from these
= 0:1363636
0.1.1 polynomial construction:
Here m = a 2jnj + x
where a and are known to us. In this case (1) jnj bits of m are known to us. And given that e is 5 so cipher
text will be
c = (a 2jnj + x)
5
(mod n)
Let
c = (x5 + x4 +

2. x3 +
x2 + x + z)(mod n)
which gives
p(x) = (x5 + x4 +

3. x3 +
x2 + x + z c)
Hence we have to

4. nd the root of above polynomial mod n where ;

5. ;
; ; z; c are known.
0.1.2 Lattice Construction
Let
qi(x) = nxi for i = 0 to 4
qi(x) = xi5 p(x) for i = 5; 6; 7
Lattice A =
1

6. Team - Anonymous Level 6
Now by Minkowski theorem:
(L) =
p
b(det(A))1=b where b = dimension of lattice
= sqrt(8) n5=8
By LLL theorem we can get a vector r in polynomial time such that its length
jrj = 2(b1)=2 (L) = 25 n5=8
Let r(x) be the polynomial associated with r, each coecient of r(x) = 25 n5=8 Further
r(x) =
X7
i=0
i qi(x)
taking r(x)(mod n)
r(x) = (5 p(x) + 6 x p(x) + 7 x2 p(x))(mod n)
Clearly roots of p(x)(mod n) are roots of r(x)(mod n), we need to

7. nd root x0 r(x) such that x0 n Let
r(x) = 0 + 1 x + 2 x2 + 3x3 + 4 x4 + 5 x5 + 6 x6 + 7x7
Then
jr(x0)j = j0j + j1j jx0j + j2j jx0j2 + j3j jx0j3 + j4j jx0j4 + j5j jx0j5 + j6j jx0j6 + j7j jx0j7
By putting maximum value of coecients and max value of x0 we found that -
jr(x0)j 25 n(64+5)=8
here we need power of n should be less than 1, so
64 + 5 8
3=64
2

8. Team - Anonymous Level 6
which is not as per our expectation so this polynomial will not work. So from this we can deduce 32 bits only
however unknown bits are 96 so this polynomial will not work.
Another Lattice: We tried following lattices as well:
(L)
p
7 n
jrj 23
p
7 n5=7
2=49
We tried using degree 9 polynomial as well
qi = n xi for i = 0; 1; 2; 3; 4
qi = xi5p(x) for i = 5; 6; 7; 9
but with that as well we got 1=20 which again gives only 36 bits roughly so we can't proceed with this as
well.
3