dissertacao.pdf

There is a generalized version of this result:
Theorem 6. Let N be an integer of unknown factorization which has a divisor
b ≥ N β , for 0 < β ≤ 1, and f(x) be a univariate monic polynomial of degree k.
Then we can find all solutions x0 of f(x) ∼ = 0 (mod b), satisfying |x0| ≤ cN β2
k ,
in time polynomial in log(N), c and the number of roots.
For these theorems to result in algorithms that run, in practice, in polynomial
time in the size of the input, we generally need to make two assumptions:
Conjecture 1. The Coppersmith’s method assumptions are:
1. The polynomials with a known small solution, either over Z or ZN, have
only one small solution.
2. The polynomials obtained from the LLL-reduced basis vectors are all al-
gebraically independent.
Though these assumptions usually hold, there is some reported cases where
they do not. Deeper knowledge regarding these two assumptions would greatly
improve the security of RSA.
13