3 ms·
Not so simple. You forgot about the fact that it wraps around the modulus. Say c is the 65537th power of m. You try a guess m' and find that its 65537th power
by doomrobo 4y ago
Not so simple. You forgot about the fact that it wraps around the modulus.
Say c is the 65537th power of m. You try a guess m' and find that its 65537th power is c + 10 (mod N). Will you choose your next guess m'' to be greater than m' or less than m'? It could be either.
- jwilk 4y agoWhat's N? There was no N or modulo in the sentence I quoted.
- doomrobo 4y agoOh, my bad I misunderstood. Yes, you could just construct a system of 65537 equations in 65537 variables. You can't do a binary search though. Remember, all you have access to is c (mod p_i) for i = 1, ..., 65537. To do a binary search, you'd need the integer c (not mod anything).
- jwilk 4y agoBut the gist of this attack is that you can recover integer c with Chinese Remainder Theorem. Then you can use binary search (or another root-finding algorithm) to get m.