This document discusses using the Coppersmith method to decrypt an RSA ciphertext with a small exponent of 5. It constructs a polynomial based on the ciphertext equation and uses lattice reduction to find a short vector with a root modulo n that reveals plaintext bits. However, the method is unable to recover enough unknown plaintext bits from the given ciphertext due to the lattice dimensions being too large. Multiple polynomial constructions are attempted but none achieve the necessary root size bound to reveal 96 unknown plaintext bits.

1. Team - Anonymous Level 6
You see the following written on the panel: n = 10628901681304595437504805072281745025198783740324152673826
676630804129595965704260761607525181044859765222866482 2222602938005564194836047871412113293603679433548079513
73714507134561572735822176513802865630676107450267173622722 2549538655637382149527573292390900027506022621838298229357799846819824421748752963
Anonymous: This door has RSA encryption with exponent 5 and the password is: 93358282649848187430044661903775419
443484025504563418969885601622922714 457181843318602008947766891951649 809852254236170346608009317628470
644231659079327275403101815122890514710083 9566518488210707247066989991357952817 3477319008729364090589747421945827527925241323
4260397162620126840971046085009283983530207432
Press c to continue>
0.1 Coppersmith method:
Finally as taught in class, when e is small we proceed with lattice theory construction using coppersmith method.
Total bits = 704 bits
Known bits = 608 bits
from these
= 0:1363636
0.1.1 polynomial construction:
Here m = a 2jnj + x
where a and are known to us. In this case (1) jnj bits of m are known to us. And given that e is 5 so cipher
text will be
c = (a 2jnj + x)
5
(mod n)
Let
c = (x5 + x4 +

2. x3 +
x2 + x + z)(mod n)
which gives
p(x) = (x5 + x4 +

3. x3 +
x2 + x + z c)
Hence we have to