We show how to solve a polynomial equation (mod N) of degree k in a single variable x, as long as there is a solution smaller than N
1/k. We give two applications to RSA encryption with exponent 3. First, knowledge of all the ciphertext and 2/3 of the plaintext bits for a single message reveals that message. Second, if messages are padded with truly random padding and then encrypted with an exponent 3, then two encryptions of the same message (with different padding) will reveal the message, as long as the padding is less than 1/9 of the length of N. With several encryptions, another technique can (heuristically) tolerate padding up to about 1/6 of the length of N.
- Lattice Element
- Short Vector
- Small Exponent
- Basis Reduction Method
- Integer Linear Combination
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.