Se la versione del tuo Python SageMath è precedente alla 3.9.0, alcune funzionalità in alcuni script potrebbero non funzionare.

## Utilizzo
I test unitari si trovano nella directory `test` e possono essere eseguiti tramite il modulo `unittest` o usando `pytest`. Non dovrebbe richiedere molto tempo, forse qualche minuto a seconda della macchina.

Per eseguire un attacco specifico, devi aggiungere il codice al file appropriato prima di eseguirlo.

### Esempio

Ad esempio, vuoi attaccare RSA usando l'attacco Boneh-Durfee, con i seguenti parametri (tratti da [test_rsa.py](https://github.com/jvdsn/crypto-attacks/blob/HEAD/test/test_rsa.py)):```python
N = 88320836926176610260238895174120738360949322009576866758081671082752401596826820274141832913391890604999466444724537056453777218596634375604879123818123658076245218807184443147162102569631427096787406420042132112746340310992380094474893565028303466135529032341382899333117011402408049370805729286122880037249
e = 36224751658507610673165956970793195381480143363550601971796688201449789736497322700382657163240771111376677180786660893671085854060092736865293791299460933460067267613023891500397200389824179925263846148644777638774319680682025117466596019474987378275216579013846855328009375540444176771945272078755317168511

Poi puoi semplicemente eseguire il file usando Sage. Non importa da dove lo esegui, il percorso Python viene impostato automaticamente (puoi anche richiamare gli attacchi da altri file Python, ma in tal caso dovrai sistemare il percorso Python da solo):```commandline
[crypto-attacks]$ sage -python attacks/rsa/boneh_durfee.py
INFO:root:Trying m = 3, t = 1...
DEBUG:root:Generating shifts...
DEBUG:root:Creating a lattice with 11 shifts (order = 'invlex', sort_shifts_reverse = False, sort_monomials_reverse = False)...
DEBUG:root:Reducing a 11 x 11 lattice...
DEBUG:root:Reconstructing polynomials (divide_original = True, modulus_bound = False, divide_gcd = True)...
DEBUG:root:Polynomial at row 8 is constant, ignoring...
DEBUG:root:Reconstructed polynomial has gcd 1312232632720549890113031660369306919929075823824696839212183146130434668203517349691252841557097914064120078389640402109017308806168467714230057403815071456395553717020189622129706447677967264344568789118172311850383406340547579993263937406518074980025897726255316031512238322022839331135299265704052474541497687419350763703993630899191179705015113329644753599872380152055902238937889027950089072598069861391599563222633064848996619752054685734260976071760984100109990150069201501748622288840900421607423175114026653242500476408861976142751384898489130281755466581359057847077651502734556259387442296763474369957121 with polynomial at 8, dividing...
DEBUG:root:Reconstructed 10 polynomials
DEBUG:root:Computing pairwise gcds to find trivial roots...
DEBUG:root:Using Groebner basis method to find roots...
DEBUG:root:Sequence length: 10, Groebner basis length: 1
DEBUG:root:Sequence length: 9, Groebner basis length: 1
DEBUG:root:Sequence length: 8, Groebner basis length: 1
DEBUG:root:Sequence length: 7, Groebner basis length: 2
DEBUG:root:Found Groebner basis with length 2, trying to find roots...
Found p = 7866790440964395011005623971351568677139336343167390105188826934257986271072664643571727955882500173182140478082778193338086048035817634545367411924942763 and q = 11227048386374621771175649743442169526805922745751610531569607663416378302561807690656370394330458335919244239976798600743588701676542461805061598571009923

* Implementa una versione di debug dell'attacco che stai cercando di utilizzare (con risultati noti) e determina il valore di `m` che produce buoni vettori del reticolo. Quindi chiama direttamente il metodo dell'attacco con il valore `m` corretto.


## Attacchi implementati
### Divisore comune approssimato
* [x] [Attacco polinomiale multivariato](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/acd/mp.py) [^acd_mp]
* [x] [Attacco basato sul reticolo ortogonale](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/acd/ol.py) [^acd_ol]
* [x] [Attacco basato sull'approssimazione diofantea simultanea](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/acd/sda.py) [^acd_sda]

### CBC
* [x] [Attacco di bit flipping](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc/bit_flipping.py)
* [x] [Attacco di recupero dell'IV](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc/iv_recovery.py)
* [x] [Attacco tramite oracolo di padding](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc/padding_oracle.py)

### CBC + CBC-MAC
* [x] [Attacco di riuso della chiave (encrypt-and-MAC)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc_and_cbc_mac/eam_key_reuse.py)
* [x] [Attacco di riuso della chiave (encrypt-then-MAC)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc_and_cbc_mac/etm_key_reuse.py)
* [x] [Attacco di riuso della chiave (MAC-then-encrypt)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc_and_cbc_mac/mte_key_reuse.py)

### CBC-MAC
* [x] [Attacco di estensione della lunghezza](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc_mac/length_extension.py)

### CTR
* [x] [Attacco di bit flipping](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ctr/bit_flipping.py)
* [x] [Attacco CRIME](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ctr/crime.py)
* [x] [Attacco tramite oracolo separatore](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ctr/separator_oracle.py)

### ECB
* [x] [Attacco di recupero del testo in chiaro](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecb/plaintext_recovery.py)
* [x] [Attacco di recupero del testo in chiaro (variante più difficile)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecb/plaintext_recovery_harder.py)
* [x] [Attacco di recupero del testo in chiaro (variante difficilissima)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecb/plaintext_recovery_hardest.py)

### Crittografia a curve ellittiche
* [x] [Attacco di riuso del nonce ECDSA](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/ecdsa_nonce_reuse.py)
* [x] [Attacco di Frey-Ruck](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/frey_ruck_attack.py) [^ecc_frey_ruck_attack]
* [x] [Attacco MOV](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/mov_attack.py) [^ecc_mov_attack]
* [x] [Recupero dei parametri](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/parameter_recovery.py)
* [x] [Attacco alle curve singolari](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/singular_curve.py)
* [x] [Attacco di Smart (con curve su campi di estensione)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/smart_attack.py) [^ecc_smart_attack1] [^ecc_smart_attack2]

### Crittografia ElGamal
* [x] [Attacco di riuso del nonce](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/elgamal_encryption/nonce_reuse.py)
* [x] [Attacco tramite generatore non sicuro](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/elgamal_encryption/unsafe_generator.py)

### Firma ElgGamal
* [ ] Attacco di Bleichenbacher
* [ ] Attacco di Khadir
* [x] [Attacco di riuso del nonce](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/elgamal_signature/nonce_reuse.py)

### Fattorizzazione
* [x] [Fattorizzazione tramite conversione di base](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/base_conversion.py)
* [x] [Attacco branch and prune](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/branch_and_prune.py) [^factorization_branch_and_prune]
* [x] [Fattorizzazione tramite moltiplicazione complessa (curve ellittiche)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/complex_multiplication.py) [^factorization_complex_multiplication]
* [x] [Fattorizzazione di Coppersmith](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/coppersmith.py)
* [x] [Fattorizzazione di Fermat](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/fermat.py)
* [x] [Attacco di Ghafar-Ariffin-Asbullah](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/gaa.py) [^factorization_gaa]
* [x] [Fattorizzazione implicita](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/implicit.py) [^factorization_implicit]
* [x] [Fattorizzazione con phi noto](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/known_phi.py) [^factorization_known_phi]
* [x] [ROCA](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/roca.py) [^factorization_roca]
* [x] [Algoritmo di Shor (classico)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/shor.py) [^factorization_shor]
* [x] [Fattorizzazione di primi gemelli](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/twin_primes.py)
* [x] [Fattorizzazione di moduli sbilanciati](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/unbalanced.py) [^factorization_unbalanced]

### GCM
* [x] [Attacco forbidden](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/gcm/forbidden_attack.py) [^gcm_forbidden_attack]

### Problema del numero nascosto
Con applicazioni all'esposizione parziale del nonce (EC)DSA.
* [x] [Problema del numero nascosto esteso](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/hnp/extended_hnp.py) [^hnp_extended_hnp]
* [ ] Attacco tramite analisi di Fourier
* [x] [Attacco basato su reticoli](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/hnp/lattice_attack.py)

### IGE
* [x] [Attacco tramite oracolo di padding](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ige/padding_oracle.py)

### Crittosistemi a zaino
* [x] [Attacco a bassa densità](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/knapsack/low_density.py) [^knapsack_low_density]

### Generatori lineari congruenziali

* [x] [Recupero dei parametri LCG](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/lcg/parameter_recovery.py)
* [x] [Recupero dei parametri LCG troncato](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/lcg/truncated_parameter_recovery.py) [^lcg_truncated_parameter_recovery]
* [x] [Recupero dello stato LCG troncato](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/lcg/truncated_state_recovery.py) [^lcg_truncated_state_recovery]

### Learning With Errors

* [x] [Attacco di Arora-Ge](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/lwe/arora_ge.py) [^lwe_arora_ge]
* [ ] Attacco di Blum-Kalai-Wasserman
* [ ] Attacco di riduzione del reticolo

### Mersenne Twister

* [x] [Recupero dello stato](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/mersenne_twister/state_recovery.py)

### One-time Pad

* [x] [Riuso della chiave](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/otp/key_reuse.py)

### Pseudoprimi

* [x] [Generazione di pseudoprimi di Miller-Rabin](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/pseudoprimes/miller_rabin.py) [^pseudoprimes_miller_rabin]

### RC4

* [x] [Attacco di Fluhrer-Mantin-Shamir](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rc4/fms.py)

### RSA

* [x] [Attacco di Bleichenbacher](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/bleichenbacher.py) [^rsa_bleichenbacher]
* [x] [Attacco di falsificazione della firma di Bleichenbacher](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/bleichenbacher_signature_forgery.py)
* [x] [Attacco di Boneh-Durfee](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/boneh_durfee.py) [^rsa_boneh_durfee]
* [x] [Attacco di Cherkaoui-Semmouni](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/cherkaoui_semmouni.py) [^rsa_cherkaoui_semmouni]
* [x] [Attacco del modulo comune](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/common_modulus.py)
* [x] [Attacco tramite fault CRT](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/crt_fault_attack.py)
* [x] [Attacco tramite fault su d](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/d_fault_attack.py)
* [x] [Attacco di Desmedt-Odlyzko (falsificazione selettiva)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/desmedt_odlyzko.py) [^rsa_desmedt_odlyzko]
* [x] [Attacco esteso di Wiener](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/extended_wiener_attack.py) [^rsa_extended_wiener_attack]
* [x] [Attacco broadcast di Hastad](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/hastad_attack.py)
* [x] [Attacco con esponenti CRT noti](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/known_crt_exponents.py) [^rsa_known_crt_exponents]
* [x] [Attacco con esponenti CRT parzialmente noti](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/known_crt_exponents.py) [^rsa_partial_known_crt_exponents]
* [x] [Attacco con esponente privato noto](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/known_d.py)
* [x] [Attacco con esponente pubblico basso](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/low_exponent.py)
* [x] [Attacco tramite oracolo LSB (oracolo di parità)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/lsb_oracle.py)
* [x] [Attacco di Manger](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/manger.py) [^rsa_manger]
* [x] [Attacco CRT-RSA di Nitaj](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/nitaj_crt_rsa.py) [^rsa_nitaj_crt_rsa]
* [x] [Attacco con esponente pubblico non coprimo](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/non_coprime_exponent.py) [^rsa_non_coprime_exponent]
* [x] [Esposizione parziale della chiave](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/partial_key_exposure.py) [^rsa_partial_key_exposure1] [^rsa_partial_key_exposure2] [^rsa_partial_key_exposure3] 
* [x] [Attacco con messaggi correlati](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/related_message.py)
* [x] [Attacco con messaggio stereotipato](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/stereotyped_message.py)
* [x] [Attacco di Wiener](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/wiener_attack.py)
* [x] [Attacco di Wiener per RSA a primi comuni](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/wiener_attack_common_prime.py) [^rsa_wiener_attack_common_prime]
* [x] [Attacco di Wiener (variante euristica basata su reticoli)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/wiener_attack_lattice.py) [^rsa_wiener_attack_lattice] [^rsa_wiener_attack_lattice_extended] [^small_roots_aono]

### Condivisione segreta di Shamir
* [x] [Coefficienti deterministici](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/shamir_secret_sharing/deterministic_coefficients.py)
* [x] [Falsificazione delle share](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/shamir_secret_sharing/share_forgery.py)

## Altre implementazioni interessanti
* [x] [Metodo di estrazione della radice di Adleman-Manders-Miller](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/__init__.py) [^adleman_manders_miller]
* [x] [CRT veloce tramite divide et impera](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/crt.py)
* [x] [Inversi modulari veloci](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/__init__.py)
* [x] [Sollevamento di Hensel lineare](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/hensel.py)
* [ ] Sollevamento di Hensel quadratico
* [x] [Algoritmo del piano più vicino di Babai](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/lattice.py)
* [x] [Logaritmo discreto per matrici](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/matrices.py)
* [x] [Logaritmo discreto per matrici (equazione)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/matrices.py)
* [x] [PartialInteger](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/partial_integer.py)
* [x] [MCD polinomiale veloce tramite half GCD](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/polynomial.py)

### Generazione di curve ellittiche
* [x] [Moltiplicazione complessa](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)
* [x] [Curve anomale](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)
* [x] [Curve MNT](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)
* [x] [Ordine prescritto](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)
* [x] [Traccia prescritta](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)
* [x] [Curve supersingolari](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)

### Radici piccole
* [x] [Radici polinomiali tramite basi di Groebner](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/__init__.py)
* [x] [Radici polinomiali tramite risultanti](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/__init__.py)
* [x] [Radici polinomiali tramite varietà di Sage (decomposizione triangolare)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/__init__.py)
* [x] [Metodo di Aono (reticolo somma di Minkowski)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/aono.py) [^small_roots_aono]
* [x] [Metodo di Blomer-May](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/blomer_may.py) [^small_roots_blomer_may]
* [x] [Metodo di Boneh-Durfee](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/boneh_durfee.py) [^rsa_boneh_durfee]
* [x] [Metodo di Coron](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/coron.py) [^small_roots_coron]
* [x] [Metodo di Coron (diretto)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/coron_direct.py) [^small_roots_coron_direct]
* [x] [Metodi di Ernst et al.](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/ernst.py) [^rsa_partial_key_exposure2]
* [x] [Metodo di Herrmann-May (linearizzazione districata)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/herrmann_may.py) [^small_roots_herrmann_may]
* [x] [Metodo di Herrmann-May (multivariato modulare)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/herrmann_may_multivariate.py) [^small_roots_herrmann_may_multivariate]
* [x] [Metodo di Howgrave-Graham](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/howgrave_graham.py) [^small_roots_howgrave_graham]
* [x] [Metodo di Jochemsz-May (radici modulari)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/jochemsz_may_modular.py) [^small_roots_jochemsz_may_modular]
* [x] [Metodo di Jochemsz-May (radici intere)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/jochemsz_may_integer.py) [^small_roots_jochemsz_may_integer]
* [x] [Metodo di Nitaj-Fouotsa](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/nitaj_fouotsa.py) [^small_roots_nitaj_fouotsa]

[^acd_mp]: Galbraith D. S. et al., "Algorithms for the Approximate Common Divisor Problem" (Sezione 5)
[^acd_ol]: Galbraith D. S. et al., "Algorithms for the Approximate Common Divisor Problem" (Sezione 4)
[^acd_sda]: Galbraith D. S. et al., "Algorithms for the Approximate Common Divisor Problem" (Sezione 3)

[^ecc_frey_ruck_attack]: Harasawa R. et al., "Comparing the MOV and FR Reductions in Elliptic Curve Cryptography" (Sezione 3)
[^ecc_mov_attack]: Harasawa R. et al., "Comparing the MOV and FR Reductions in Elliptic Curve Cryptography" (Sezione 2)
[^ecc_smart_attack1]: Smart N. P., "The Discrete Logarithm Problem on Elliptic Curves of Trace One"
[^ecc_smart_attack2]: Hofman S. J., "The Discrete Logarithm Problem on Anomalous Elliptic Curves"

[^factorization_branch_and_prune]: Heninger N., Shacham H., "Reconstructing RSA Private Keys from Random Key Bits"
[^factorization_complex_multiplication]: Sedlacek V. et al., "I want to break square-free: The 4p - 1 factorization method and its RSA backdoor viability"
[^factorization_gaa]: Ghafar AHA. et al., "A New LSB Attack on Special-Structured RSA Primes"
[^factorization_implicit]: Nitaj A., Ariffin MRK., "Implicit factorization of unbalanced RSA moduli"
[^factorization_known_phi]: Hinek M. J., Low M. K., Teske E., "On Some Attacks on Multi-prime RSA" (Sezione 3)
[^factorization_roca]: Nemec M. et al., "The Return of Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli"
[^factorization_shor]: M. Johnston A., "Shor’s Algorithm and Factoring: Don’t Throw Away the Odd Orders"
[^factorization_unbalanced]: Brier E. et al., "Factoring Unbalanced Moduli with Known Bits" (Sezione 4)

[^gcm_forbidden_attack]: Joux A., "Authentication Failures in NIST version of GCM"

[^hnp_extended_hnp]: Hlavac M., Rosa T., "Extended Hidden Number Problem and Its Cryptanalytic Applications" (Sezione 4)

[^knapsack_low_density]: Coster M. J. et al., "Improved low-density subset sum algorithms"

[^lcg_truncated_parameter_recovery]: Contini S., Shparlinski I. E., "On Stern's Attack Against Secret Truncated Linear Congruential Generators"
[^lcg_truncated_state_recovery]: Frieze, A. et al., "Reconstructing Truncated Integer Variables Satisfying Linear Congruences"

[^lwe_arora_ge]: ["The Learning with Errors Problem: Algorithms"](https://people.csail.mit.edu/vinodv/6876-Fall2018/lecture2.pdf) (Sezione 1)

[^pseudoprimes_miller_rabin]: R. Albrecht M. et al., "Prime and Prejudice: Primality Testing Under Adversarial Conditions"

[^rsa_bleichenbacher]: Bleichenbacher D., "Chosen Ciphertext Attacks Against Protocols Based on the RSA Encryption Standard PKCS #1"
[^rsa_boneh_durfee]: Boneh D., Durfee G., "Cryptanalysis of RSA with Private Key d Less than N^0.292"
[^rsa_cherkaoui_semmouni]: Cherkaoui-Semmouni M. et al., "Cryptanalysis of RSA Variants with Primes Sharing Most Significant Bits"
[^rsa_desmedt_odlyzko]: Coron J. et al., "Practical Cryptanalysis of ISO 9796-2 and EMV Signatures (Sezione 3)"
[^rsa_extended_wiener_attack]: Dujella A., "Continued fractions and RSA with small secret exponent"
[^rsa_known_crt_exponents]: Campagna M., Sethi A., "Key Recovery Method for CRT Implementation of RSA"
[^rsa_partial_known_crt_exponents]: May A., Nowakowski J., Sarkar S., "Approximate Divisor Multiples - Factoring with Only a Third of the Secret CRT-Exponents"
[^rsa_manger]: Manger J., "A Chosen Ciphertext Attack on RSA Optimal Asymmetric Encryption Padding (OAEP) as Standardized in PKCS #1 v2.0"
[^rsa_nitaj_crt_rsa]: Nitaj A., "A new attack on RSA and CRT-RSA"
[^rsa_non_coprime_exponent]: Shumow D., "Incorrectly Generated RSA Keys: How To Recover Lost Plaintexts"
[^rsa_partial_key_exposure1]: Boneh D., Durfee G., Frankel Y., "An Attack on RSA Given a Small Fraction of the Private Key Bits"
[^rsa_partial_key_exposure2]: Ernst M. et al., "Partial Key Exposure Attacks on RSA Up to Full Size Exponents"
[^rsa_partial_key_exposure3]: Blomer J., May A., "New Partial Key Exposure Attacks on RSA"
[^rsa_wiener_attack_common_prime]: Jochemsz E., May A., "A Strategy for Finding Roots of Multivariate Polynomials with New Applications in Attacking RSA Variants" (Sezione 5)
[^rsa_wiener_attack_lattice]: Nguyen P. Q., "Public-Key Cryptanalysis"
[^rsa_wiener_attack_lattice_extended]: Howgrave-Graham N., Seifert J., "Extending Wiener’s Attack in the Presence of Many Decrypting Exponents"

[^adleman_manders_miller]: Cao Z. et al., "Adleman-Manders-Miller Root Extraction Method Revisited" (Sezione 5)

[^small_roots_aono]: Aono Y., "Minkowski sum based lattice construction for multivariate simultaneous Coppersmith's technique and applications to RSA" (Sezione 4)
[^small_roots_blomer_may]: Blomer J., May A., "New Partial Key Exposure Attacks on RSA" (Sezione 6)
[^small_roots_coron]: Coron J., "Finding Small Roots of Bivariate Integer Polynomial Equations Revisited"
[^small_roots_coron_direct]: Coron J., "Finding Small Roots of Bivariate Integer Polynomial Equations: a Direct Approach"
[^small_roots_herrmann_may]: Herrmann M., May A., "Maximizing Small Root Bounds by Linearization and Applications to Small Secret Exponent RSA"
[^small_roots_herrmann_may_multivariate]: Herrmann M., May A., "Solving Linear Equations Modulo Divisors: On Factoring Given Any Bits" (Sezioni 3 e 4)
[^small_roots_howgrave_graham]: May A., "New RSA Vulnerabilities Using Lattice Reduction Methods" (Sezione 3.2)
[^small_roots_jochemsz_may_modular]: Jochemsz E., May A., "A Strategy for Finding Roots of Multivariate Polynomials with New Applications in Attacking RSA Variants" (Sezione 2.1)
[^small_roots_jochemsz_may_integer]: Jochemsz E., May A., "A Strategy for Finding Roots of Multivariate Polynomials with New Applications in Attacking RSA Variants" (Sezione 2.2)
[^small_roots_nitaj_fouotsa]: Nitaj A., Fouotsa E., "A New Attack on RSA and Demytko's Elliptic Curve Cryptosystem"