SageMath の Python バージョンが 3.9.0 より古い場合、一部のスクリプトの一部の機能が動作しないことがあります。

## 使用方法
単体テストは `test` ディレクトリにあり、`unittest` モジュールまたは `pytest` を使用して実行できます。それほど時間はかからず、マシンによっては数分程度です。

特定の攻撃を実行するには、実行する前にコードを適切なファイルに追加する必要があります。

### 例

たとえば、次のパラメータ（[test_rsa.py](https://github.com/jvdsn/crypto-attacks/blob/HEAD/test/test_rsa.py) から取得）を使用して、Boneh-Durfee 攻撃で RSA を攻撃するとします。```python
N = 88320836926176610260238895174120738360949322009576866758081671082752401596826820274141832913391890604999466444724537056453777218596634375604879123818123658076245218807184443147162102569631427096787406420042132112746340310992380094474893565028303466135529032341382899333117011402408049370805729286122880037249
e = 36224751658507610673165956970793195381480143363550601971796688201449789736497322700382657163240771111376677180786660893671085854060092736865293791299460933460067267613023891500397200389824179925263846148644777638774319680682025117466596019474987378275216579013846855328009375540444176771945272078755317168511

その後、Sageを使用してファイルを実行するだけです。どこから実行しても問題ありません。Pythonパスは自動的に設定されます（他のPythonファイルから攻撃を呼び出すこともできますが、その場合はPythonパスを自分で修正する必要があります）：```commandline
[crypto-attacks]$ sage -python attacks/rsa/boneh_durfee.py
INFO:root:Trying m = 3, t = 1...
DEBUG:root:Generating shifts...
DEBUG:root:Creating a lattice with 11 shifts (order = 'invlex', sort_shifts_reverse = False, sort_monomials_reverse = False)...
DEBUG:root:Reducing a 11 x 11 lattice...
DEBUG:root:Reconstructing polynomials (divide_original = True, modulus_bound = False, divide_gcd = True)...
DEBUG:root:Polynomial at row 8 is constant, ignoring...
DEBUG:root:Reconstructed polynomial has gcd 1312232632720549890113031660369306919929075823824696839212183146130434668203517349691252841557097914064120078389640402109017308806168467714230057403815071456395553717020189622129706447677967264344568789118172311850383406340547579993263937406518074980025897726255316031512238322022839331135299265704052474541497687419350763703993630899191179705015113329644753599872380152055902238937889027950089072598069861391599563222633064848996619752054685734260976071760984100109990150069201501748622288840900421607423175114026653242500476408861976142751384898489130281755466581359057847077651502734556259387442296763474369957121 with polynomial at 8, dividing...
DEBUG:root:Reconstructed 10 polynomials
DEBUG:root:Computing pairwise gcds to find trivial roots...
DEBUG:root:Using Groebner basis method to find roots...
DEBUG:root:Sequence length: 10, Groebner basis length: 1
DEBUG:root:Sequence length: 9, Groebner basis length: 1
DEBUG:root:Sequence length: 8, Groebner basis length: 1
DEBUG:root:Sequence length: 7, Groebner basis length: 2
DEBUG:root:Found Groebner basis with length 2, trying to find roots...
Found p = 7866790440964395011005623971351568677139336343167390105188826934257986271072664643571727955882500173182140478082778193338086048035817634545367411924942763 and q = 11227048386374621771175649743442169526805922745751610531569607663416378302561807690656370394330458335919244239976798600743588701676542461805061598571009923

* 使用しようとしている攻撃のデバッグ版（結果が既知のもの）を実装し、良好な格子ベクトルが得られる`m`の値を決定します。その後、正しい`m`値で攻撃メソッドを直接呼び出します。


## 実装済みの攻撃
### 近似共通約数
* [x] [多変数多項式攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/acd/mp.py) [^acd_mp]
* [x] [直交格子に基づく攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/acd/ol.py) [^acd_ol]
* [x] [同時ディオファントス近似攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/acd/sda.py) [^acd_sda]

### CBC
* [x] [ビットフリッピング攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc/bit_flipping.py)
* [x] [IV復元攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc/iv_recovery.py)
* [x] [パディングオラクル攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc/padding_oracle.py)

### CBC + CBC-MAC
* [x] [鍵再利用攻撃（encrypt-and-MAC）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc_and_cbc_mac/eam_key_reuse.py)
* [x] [鍵再利用攻撃（encrypt-then-MAC）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc_and_cbc_mac/etm_key_reuse.py)
* [x] [鍵再利用攻撃（MAC-then-encrypt）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc_and_cbc_mac/mte_key_reuse.py)

### CBC-MAC
* [x] [長さ拡張攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc_mac/length_extension.py)

### CTR
* [x] [ビットフリッピング攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ctr/bit_flipping.py)
* [x] [CRIME攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ctr/crime.py)
* [x] [セパレータオラクル攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ctr/separator_oracle.py)

### ECB
* [x] [平文復元攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecb/plaintext_recovery.py)
* [x] [平文復元攻撃（より難しい変種）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecb/plaintext_recovery_harder.py)
* [x] [平文復元攻撃（最も難しい変種）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecb/plaintext_recovery_hardest.py)

### 楕円曲線暗号
* [x] [ECDSAナンス再利用攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/ecdsa_nonce_reuse.py)
* [x] [Frey-Ruck攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/frey_ruck_attack.py) [^ecc_frey_ruck_attack]
* [x] [MOV攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/mov_attack.py) [^ecc_mov_attack]
* [x] [パラメータ復元](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/parameter_recovery.py)
* [x] [特異曲線攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/singular_curve.py)
* [x] [Smart攻撃（拡大体上の曲線）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/smart_attack.py) [^ecc_smart_attack1] [^ecc_smart_attack2]

### ElGamal暗号
* [x] [ナンス再利用攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/elgamal_encryption/nonce_reuse.py)
* [x] [安全でない生成元攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/elgamal_encryption/unsafe_generator.py)

### ElgGamal署名
* [ ] Bleichenbacher攻撃
* [ ] Khadir攻撃
* [x] [ナンス再利用攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/elgamal_signature/nonce_reuse.py)

### 素因数分解
* [x] [基数変換による素因数分解](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/base_conversion.py)
* [x] [分枝・刈り込み攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/branch_and_prune.py) [^factorization_branch_and_prune]
* [x] [虚数乗法（楕円曲線）による素因数分解](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/complex_multiplication.py) [^factorization_complex_multiplication]
* [x] [Coppersmith素因数分解](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/coppersmith.py)
* [x] [Fermat素因数分解](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/fermat.py)
* [x] [Ghafar-Ariffin-Asbullah攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/gaa.py) [^factorization_gaa]
* [x] [暗黙的素因数分解](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/implicit.py) [^factorization_implicit]
* [x] [既知のφによる素因数分解](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/known_phi.py) [^factorization_known_phi]
* [x] [ROCA](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/roca.py) [^factorization_roca]
* [x] [Shorのアルゴリズム（古典的）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/shor.py) [^factorization_shor]
* [x] [双子素数による素因数分解](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/twin_primes.py)
* [x] [不均衡な法の素因数分解](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/unbalanced.py) [^factorization_unbalanced]

### GCM
* [x] [Forbidden攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/gcm/forbidden_attack.py) [^gcm_forbidden_attack]

### 隠れ数問題
部分的な(EC)DSAナンス露呈への応用。
* [x] [拡張隠れ数問題](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/hnp/extended_hnp.py) [^hnp_extended_hnp]
* [ ] フーリエ解析攻撃
* [x] [格子に基づく攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/hnp/lattice_attack.py)

### IGE
* [x] [パディングオラクル攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ige/padding_oracle.py)

### ナップサック暗号
* [x] [低密度攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/knapsack/low_density.py) [^knapsack_low_density]

### 線形合同法

* [x] [LCGパラメータ復元](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/lcg/parameter_recovery.py)
* [x] [Truncated LCGパラメータ復元](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/lcg/truncated_parameter_recovery.py) [^lcg_truncated_parameter_recovery]
* [x] [Truncated LCG状態復元](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/lcg/truncated_state_recovery.py) [^lcg_truncated_state_recovery]

### 誤差付き学習

* [x] [Arora-Ge攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/lwe/arora_ge.py) [^lwe_arora_ge]
* [ ] Blum-Kalai-Wasserman攻撃
* [ ] 格子簡約攻撃

### メルセンヌ・ツイスタ

* [x] [状態復元](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/mersenne_twister/state_recovery.py)

### ワンタイムパッド

* [x] [鍵再利用](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/otp/key_reuse.py)

### 擬素数

* [x] [Miller-Rabin擬素数の生成](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/pseudoprimes/miller_rabin.py) [^pseudoprimes_miller_rabin]

### RC4

* [x] [Fluhrer-Mantin-Shamir攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rc4/fms.py)

### RSA

* [x] [Bleichenbacher攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/bleichenbacher.py) [^rsa_bleichenbacher]
* [x] [Bleichenbacherの署名偽造攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/bleichenbacher_signature_forgery.py)
* [x] [Boneh-Durfee攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/boneh_durfee.py) [^rsa_boneh_durfee]
* [x] [Cherkaoui-Semmouni攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/cherkaoui_semmouni.py) [^rsa_cherkaoui_semmouni]
* [x] [共通法攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/common_modulus.py)
* [x] [CRTフォールト攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/crt_fault_attack.py)
* [x] [dフォールト攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/d_fault_attack.py)
* [x] [Desmedt-Odlyzko攻撃（選択的偽造）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/desmedt_odlyzko.py) [^rsa_desmedt_odlyzko]
* [x] [拡張Wiener攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/extended_wiener_attack.py) [^rsa_extended_wiener_attack]
* [x] [Hastadのブロードキャスト攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/hastad_attack.py)
* [x] [既知CRT指数攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/known_crt_exponents.py) [^rsa_known_crt_exponents]
* [x] [部分既知CRT指数攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/known_crt_exponents.py) [^rsa_partial_known_crt_exponents]
* [x] [既知の秘密指数攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/known_d.py)
* [x] [低公開指数攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/low_exponent.py)
* [x] [LSBオラクル（パリティオラクル）攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/lsb_oracle.py)
* [x] [Manger攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/manger.py) [^rsa_manger]
* [x] [NitajのCRT-RSA攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/nitaj_crt_rsa.py) [^rsa_nitaj_crt_rsa]
* [x] [非互いに素な公開指数攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/non_coprime_exponent.py) [^rsa_non_coprime_exponent]
* [x] [部分鍵露呈](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/partial_key_exposure.py) [^rsa_partial_key_exposure1] [^rsa_partial_key_exposure2] [^rsa_partial_key_exposure3] 
* [x] [関連メッセージ攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/related_message.py)
* [x] [定型メッセージ攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/stereotyped_message.py)
* [x] [Wiener攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/wiener_attack.py)
* [x] [Common Prime RSAに対するWiener攻撃](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/wiener_attack_common_prime.py) [^rsa_wiener_attack_common_prime]
* [x] [Wiener攻撃（発見的格子変種）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/wiener_attack_lattice.py) [^rsa_wiener_attack_lattice] [^rsa_wiener_attack_lattice_extended] [^small_roots_aono]

### Shamirの秘密分散
* [x] [決定的係数](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/shamir_secret_sharing/deterministic_coefficients.py)
* [x] [シェア偽造](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/shamir_secret_sharing/share_forgery.py)

## その他の興味深い実装
* [x] [Adleman-Manders-Miller根抽出法](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/__init__.py) [^adleman_manders_miller]
* [x] [分割統治法による高速CRT](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/crt.py)
* [x] [高速モジュラ逆元](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/__init__.py)
* [x] [線形Hensel持ち上げ](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/hensel.py)
* [ ] 二次Hensel持ち上げ
* [x] [Babaiの最近平面アルゴリズム](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/lattice.py)
* [x] [行列離散対数](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/matrices.py)
* [x] [行列離散対数（方程式）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/matrices.py)
* [x] [PartialInteger](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/partial_integer.py)
* [x] [half GCDを用いた高速多項式GCD](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/polynomial.py)

### 楕円曲線生成
* [x] [虚数乗法](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)
* [x] [異常曲線](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)
* [x] [MNT曲線](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)
* [x] [位数指定](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)
* [x] [トレース指定](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)
* [x] [超特異曲線](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)

### 小さい根
* [x] [Groebner基底を用いた多項式の根](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/__init__.py)
* [x] [終結式を用いた多項式の根](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/__init__.py)
* [x] [Sageのvariety（三角分解）を用いた多項式の根](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/__init__.py)
* [x] [Aono法（ミンコフスキー和格子）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/aono.py) [^small_roots_aono]
* [x] [Blomer-May法](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/blomer_may.py) [^small_roots_blomer_may]
* [x] [Boneh-Durfee法](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/boneh_durfee.py) [^rsa_boneh_durfee]
* [x] [Coron法](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/coron.py) [^small_roots_coron]
* [x] [Coron法（直接法）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/coron_direct.py) [^small_roots_coron_direct]
* [x] [Ernstらの方法](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/ernst.py) [^rsa_partial_key_exposure2]
* [x] [Herrmann-May法（unravelled linearization）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/herrmann_may.py) [^small_roots_herrmann_may]
* [x] [Herrmann-May法（モジュラ多変数）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/herrmann_may_multivariate.py) [^small_roots_herrmann_may_multivariate]
* [x] [Howgrave-Graham法](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/howgrave_graham.py) [^small_roots_howgrave_graham]
* [x] [Jochemsz-May法（モジュラ根）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/jochemsz_may_modular.py) [^small_roots_jochemsz_may_modular]
* [x] [Jochemsz-May法（整数根）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/jochemsz_may_integer.py) [^small_roots_jochemsz_may_integer]
* [x] [Nitaj-Fouotsa法](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/nitaj_fouotsa.py) [^small_roots_nitaj_fouotsa]

[^acd_mp]: Galbraith D. S. et al., "Algorithms for the Approximate Common Divisor Problem"（第5節）
[^acd_ol]: Galbraith D. S. et al., "Algorithms for the Approximate Common Divisor Problem"（第4節）
[^acd_sda]: Galbraith D. S. et al., "Algorithms for the Approximate Common Divisor Problem"（第3節）

[^ecc_frey_ruck_attack]: Harasawa R. et al., "Comparing the MOV and FR Reductions in Elliptic Curve Cryptography"（第3節）
[^ecc_mov_attack]: Harasawa R. et al., "Comparing the MOV and FR Reductions in Elliptic Curve Cryptography"（第2節）
[^ecc_smart_attack1]: Smart N. P., "The Discrete Logarithm Problem on Elliptic Curves of Trace One"
[^ecc_smart_attack2]: Hofman S. J., "The Discrete Logarithm Problem on Anomalous Elliptic Curves"

[^factorization_branch_and_prune]: Heninger N., Shacham H., "Reconstructing RSA Private Keys from Random Key Bits"
[^factorization_complex_multiplication]: Sedlacek V. et al., "I want to break square-free: The 4p - 1 factorization method and its RSA backdoor viability"
[^factorization_gaa]: Ghafar AHA. et al., "A New LSB Attack on Special-Structured RSA Primes"
[^factorization_implicit]: Nitaj A., Ariffin MRK., "Implicit factorization of unbalanced RSA moduli"
[^factorization_known_phi]: Hinek M. J., Low M. K., Teske E., "On Some Attacks on Multi-prime RSA"（第3節）
[^factorization_roca]: Nemec M. et al., "The Return of Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli"
[^factorization_shor]: M. Johnston A., "Shor’s Algorithm and Factoring: Don’t Throw Away the Odd Orders"
[^factorization_unbalanced]: Brier E. et al., "Factoring Unbalanced Moduli with Known Bits"（第4節）

[^gcm_forbidden_attack]: Joux A., "Authentication Failures in NIST version of GCM"

[^hnp_extended_hnp]: Hlavac M., Rosa T., "Extended Hidden Number Problem and Its Cryptanalytic Applications"（第4節） 

[^knapsack_low_density]: Coster M. J. et al., "Improved low-density subset sum algorithms"

[^lcg_truncated_parameter_recovery]: Contini S., Shparlinski I. E., "On Stern's Attack Against Secret Truncated Linear Congruential Generators"
[^lcg_truncated_state_recovery]: Frieze, A. et al., "Reconstructing Truncated Integer Variables Satisfying Linear Congruences"

[^lwe_arora_ge]: ["The Learning with Errors Problem: Algorithms"](https://people.csail.mit.edu/vinodv/6876-Fall2018/lecture2.pdf)（第1節）

[^pseudoprimes_miller_rabin]: R. Albrecht M. et al., "Prime and Prejudice: Primality Testing Under Adversarial Conditions"

[^rsa_bleichenbacher]: Bleichenbacher D., "Chosen Ciphertext Attacks Against Protocols Based on the RSA Encryption Standard PKCS #1"
[^rsa_boneh_durfee]: Boneh D., Durfee G., "Cryptanalysis of RSA with Private Key d Less than N^0.292"
[^rsa_cherkaoui_semmouni]: Cherkaoui-Semmouni M. et al., "Cryptanalysis of RSA Variants with Primes Sharing Most Significant Bits"
[^rsa_desmedt_odlyzko]: Coron J. et al., "Practical Cryptanalysis of ISO 9796-2 and EMV Signatures (Section 3)"
[^rsa_extended_wiener_attack]: Dujella A., "Continued fractions and RSA with small secret exponent"
[^rsa_known_crt_exponents]: Campagna M., Sethi A., "Key Recovery Method for CRT Implementation of RSA"
[^rsa_partial_known_crt_exponents]: May A., Nowakowski J., Sarkar S., "Approximate Divisor Multiples - Factoring with Only a Third of the Secret CRT-Exponents"
[^rsa_manger]: Manger J., "A Chosen Ciphertext Attack on RSA Optimal Asymmetric Encryption Padding (OAEP) as Standardized in PKCS #1 v2.0"
[^rsa_nitaj_crt_rsa]: Nitaj A., "A new attack on RSA and CRT-RSA"
[^rsa_non_coprime_exponent]: Shumow D., "Incorrectly Generated RSA Keys: How To Recover Lost Plaintexts"
[^rsa_partial_key_exposure1]: Boneh D., Durfee G., Frankel Y., "An Attack on RSA Given a Small Fraction of the Private Key Bits"
[^rsa_partial_key_exposure2]: Ernst M. et al., "Partial Key Exposure Attacks on RSA Up to Full Size Exponents"
[^rsa_partial_key_exposure3]: Blomer J., May A., "New Partial Key Exposure Attacks on RSA"
[^rsa_wiener_attack_common_prime]: Jochemsz E., May A., "A Strategy for Finding Roots of Multivariate Polynomials with New Applications in Attacking RSA Variants"（第5節）
[^rsa_wiener_attack_lattice]: Nguyen P. Q., "Public-Key Cryptanalysis"
[^rsa_wiener_attack_lattice_extended]: Howgrave-Graham N., Seifert J., "Extending Wiener’s Attack in the Presence of Many Decrypting Exponents"

[^adleman_manders_miller]: Cao Z. et al., "Adleman-Manders-Miller Root Extraction Method Revisited"（第5節）

[^small_roots_aono]: Aono Y., "Minkowski sum based lattice construction for multivariate simultaneous Coppersmith's technique and applications to RSA"（第4節）
[^small_roots_blomer_may]: Blomer J., May A., "New Partial Key Exposure Attacks on RSA"（第6節）
[^small_roots_coron]: Coron J., "Finding Small Roots of Bivariate Integer Polynomial Equations Revisited"
[^small_roots_coron_direct]: Coron J., "Finding Small Roots of Bivariate Integer Polynomial Equations: a Direct Approach"
[^small_roots_herrmann_may]: Herrmann M., May A., "Maximizing Small Root Bounds by Linearization and Applications to Small Secret Exponent RSA"
[^small_roots_herrmann_may_multivariate]: Herrmann M., May A., "Solving Linear Equations Modulo Divisors: On Factoring Given Any Bits"（第3節および第4節）
[^small_roots_howgrave_graham]: May A., "New RSA Vulnerabilities Using Lattice Reduction Methods"（第3.2節）
[^small_roots_jochemsz_may_modular]: Jochemsz E., May A., "A Strategy for Finding Roots of Multivariate Polynomials with New Applications in Attacking RSA Variants"（第2.1節）
[^small_roots_jochemsz_may_integer]: Jochemsz E., May A., "A Strategy for Finding Roots of Multivariate Polynomials with New Applications in Attacking RSA Variants"（第2.2節）
[^small_roots_nitaj_fouotsa]: Nitaj A., Fouotsa E., "A New Attack on RSA and Demytko's Elliptic Curve Cryptosystem"