SageMath Python 버전이 3.9.0보다 오래된 경우 일부 스크립트의 일부 기능이 작동하지 않을 수 있습니다.

## 사용법
단위 테스트는 `test` 디렉터리에 있으며, `unittest` 모듈이나 `pytest`를 사용하여 실행할 수 있습니다. 오래 걸리지 않으며, 시스템에 따라 몇 분 정도 걸릴 수 있습니다.

특정 공격을 실행하려면 코드를 실행하기 전에 해당 파일에 코드를 추가해야 합니다.

### 예제
예를 들어, Boneh-Durfee 공격을 사용해 RSA를 공격하고자 하며, 다음 매개변수는 [test_rsa.py](https://github.com/jvdsn/crypto-attacks/blob/HEAD/test/test_rsa.py)에서 가져온 것입니다:```python
N = 88320836926176610260238895174120738360949322009576866758081671082752401596826820274141832913391890604999466444724537056453777218596634375604879123818123658076245218807184443147162102569631427096787406420042132112746340310992380094474893565028303466135529032341382899333117011402408049370805729286122880037249
e = 36224751658507610673165956970793195381480143363550601971796688201449789736497322700382657163240771111376677180786660893671085854060092736865293791299460933460067267613023891500397200389824179925263846148644777638774319680682025117466596019474987378275216579013846855328009375540444176771945272078755317168511

그런 다음 Sage를 사용하여 해당 파일을 그냥 실행하면 됩니다. 어디에서 실행하든 상관없습니다. Python 경로는 자동으로 설정됩니다(다른 Python 파일에서 공격을 호출할 수도 있지만, 그러면 Python 경로를 직접 수정해야 합니다):```commandline
[crypto-attacks]$ sage -python attacks/rsa/boneh_durfee.py
INFO:root:Trying m = 3, t = 1...
DEBUG:root:Generating shifts...
DEBUG:root:Creating a lattice with 11 shifts (order = 'invlex', sort_shifts_reverse = False, sort_monomials_reverse = False)...
DEBUG:root:Reducing a 11 x 11 lattice...
DEBUG:root:Reconstructing polynomials (divide_original = True, modulus_bound = False, divide_gcd = True)...
DEBUG:root:Polynomial at row 8 is constant, ignoring...
DEBUG:root:Reconstructed polynomial has gcd 1312232632720549890113031660369306919929075823824696839212183146130434668203517349691252841557097914064120078389640402109017308806168467714230057403815071456395553717020189622129706447677967264344568789118172311850383406340547579993263937406518074980025897726255316031512238322022839331135299265704052474541497687419350763703993630899191179705015113329644753599872380152055902238937889027950089072598069861391599563222633064848996619752054685734260976071760984100109990150069201501748622288840900421607423175114026653242500476408861976142751384898489130281755466581359057847077651502734556259387442296763474369957121 with polynomial at 8, dividing...
DEBUG:root:Reconstructed 10 polynomials
DEBUG:root:Computing pairwise gcds to find trivial roots...
DEBUG:root:Using Groebner basis method to find roots...
DEBUG:root:Sequence length: 10, Groebner basis length: 1
DEBUG:root:Sequence length: 9, Groebner basis length: 1
DEBUG:root:Sequence length: 8, Groebner basis length: 1
DEBUG:root:Sequence length: 7, Groebner basis length: 2
DEBUG:root:Found Groebner basis with length 2, trying to find roots...
Found p = 7866790440964395011005623971351568677139336343167390105188826934257986271072664643571727955882500173182140478082778193338086048035817634545367411924942763 and q = 11227048386374621771175649743442169526805922745751610531569607663416378302561807690656370394330458335919244239976798600743588701676542461805061598571009923

* 사용하려는 공격의 디버그 버전을 구현하고(결과를 알고 있는 상태에서) 좋은 격자 벡터를 생성하는 `m` 값을 결정하세요. 그런 다음 올바른 `m` 값으로 공격 메서드를 직접 호출하세요.

## 구현된 공격
### 근사 공통 약수
* [x] [다변수 다항식 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/acd/mp.py) [^acd_mp]
* [x] [직교 기반 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/acd/ol.py) [^acd_ol]
* [x] [동시 디오판토스 근사 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/acd/sda.py) [^acd_sda]

### CBC
* [x] [비트 플리핑 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc/bit_flipping.py)
* [x] [IV 복구 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc/iv_recovery.py)
* [x] [패딩 오라클 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc/padding_oracle.py)

### CBC + CBC-MAC
* [x] [키 재사용 공격 (encrypt-and-MAC)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc_and_cbc_mac/eam_key_reuse.py)
* [x] [키 재사용 공격 (encrypt-then-MAC)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc_and_cbc_mac/etm_key_reuse.py)
* [x] [키 재사용 공격 (MAC-then-encrypt)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc_and_cbc_mac/mte_key_reuse.py)

### CBC-MAC
* [x] [길이 확장 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc_mac/length_extension.py)

### CTR
* [x] [비트 플리핑 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ctr/bit_flipping.py)
* [x] [CRIME 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ctr/crime.py)
* [x] [구분자 오라클 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ctr/separator_oracle.py)

### ECB
* [x] [평문 복구 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecb/plaintext_recovery.py)
* [x] [평문 복구 공격 (더 어려운 변형)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecb/plaintext_recovery_harder.py)
* [x] [평문 복구 공격 (가장 어려운 변형)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecb/plaintext_recovery_hardest.py)

### 타원 곡선 암호
* [x] [ECDSA nonce 재사용 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/ecdsa_nonce_reuse.py)
* [x] [Frey-Ruck 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/frey_ruck_attack.py) [^ecc_frey_ruck_attack]
* [x] [MOV 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/mov_attack.py) [^ecc_mov_attack]
* [x] [매개변수 복구](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/parameter_recovery.py)
* [x] [특이 곡선 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/singular_curve.py)
* [x] [Smart 공격 (확장체 위의 곡선)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/smart_attack.py) [^ecc_smart_attack1] [^ecc_smart_attack2]

### ElGamal 암호화
* [x] [nonce 재사용 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/elgamal_encryption/nonce_reuse.py)
* [x] [안전하지 않은 생성자 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/elgamal_encryption/unsafe_generator.py)

### ElgGamal 서명
* [ ] Bleichenbacher 공격
* [ ] Khadir 공격
* [x] [nonce 재사용 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/elgamal_signature/nonce_reuse.py)

### 인수분해
* [x] [진법 변환 인수분해](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/base_conversion.py)
* [x] [분기 및 가지치기 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/branch_and_prune.py) [^factorization_branch_and_prune]
* [x] [복소 곱셈 (타원 곡선) 인수분해](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/complex_multiplication.py) [^factorization_complex_multiplication]
* [x] [Coppersmith 인수분해](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/coppersmith.py)
* [x] [페르마 인수분해](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/fermat.py)
* [x] [Ghafar-Ariffin-Asbullah 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/gaa.py) [^factorization_gaa]
* [x] [암시적 인수분해](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/implicit.py) [^factorization_implicit]
* [x] [알려진 phi 인수분해](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/known_phi.py) [^factorization_known_phi]
* [x] [ROCA](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/roca.py) [^factorization_roca]
* [x] [Shor 알고리즘 (고전적)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/shor.py) [^factorization_shor]
* [x] [쌍둥이 소수 인수분해](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/twin_primes.py)
* [x] [불균형 모듈러스 인수분해](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/unbalanced.py) [^factorization_unbalanced]

### GCM
* [x] [Forbidden 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/gcm/forbidden_attack.py) [^gcm_forbidden_attack]

### 숨은 수 문제
부분 (EC)DSA nonce 노출에 대한 응용.
* [x] [확장된 숨은 수 문제](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/hnp/extended_hnp.py) [^hnp_extended_hnp]
* [ ] 푸리에 분석 공격
* [x] [격자 기반 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/hnp/lattice_attack.py)

### IGE
* [x] [패딩 오라클 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ige/padding_oracle.py)

### 배낭 암호 시스템
* [x] [저밀도 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/knapsack/low_density.py) [^knapsack_low_density]

### 선형 합동 생성기

* [x] [LCG 매개변수 복구](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/lcg/parameter_recovery.py)
* [x] [절단 LCG 매개변수 복구](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/lcg/truncated_parameter_recovery.py) [^lcg_truncated_parameter_recovery]
* [x] [절단 LCG 상태 복구](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/lcg/truncated_state_recovery.py) [^lcg_truncated_state_recovery]

### 오류 기반 학습

* [x] [Arora-Ge 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/lwe/arora_ge.py) [^lwe_arora_ge]
* [ ] Blum-Kalai-Wasserman 공격
* [ ] 격자 축소 공격

### Mersenne Twister

* [x] [상태 복구](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/mersenne_twister/state_recovery.py)

### 일회용 패드

* [x] [키 재사용](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/otp/key_reuse.py)

### 유사소수

* [x] [Miller-Rabin 유사소수 생성](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/pseudoprimes/miller_rabin.py) [^pseudoprimes_miller_rabin]

### RC4

* [x] [Fluhrer-Mantin-Shamir 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rc4/fms.py)

### RSA

* [x] [Bleichenbacher 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/bleichenbacher.py) [^rsa_bleichenbacher]
* [x] [Bleichenbacher 서명 위조 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/bleichenbacher_signature_forgery.py)
* [x] [Boneh-Durfee 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/boneh_durfee.py) [^rsa_boneh_durfee]
* [x] [Cherkaoui-Semmouni 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/cherkaoui_semmouni.py) [^rsa_cherkaoui_semmouni]
* [x] [공통 모듈러스 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/common_modulus.py)
* [x] [CRT 오류 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/crt_fault_attack.py)
* [x] [d 오류 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/d_fault_attack.py)
* [x] [Desmedt-Odlyzko 공격 (선택 위조)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/desmedt_odlyzko.py) [^rsa_desmedt_odlyzko]
* [x] [확장된 Wiener 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/extended_wiener_attack.py) [^rsa_extended_wiener_attack]
* [x] [Hastad 브로드캐스트 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/hastad_attack.py)
* [x] [알려진 CRT 지수 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/known_crt_exponents.py) [^rsa_known_crt_exponents]
* [x] [부분적으로 알려진 CRT 지수 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/known_crt_exponents.py) [^rsa_partial_known_crt_exponents]
* [x] [알려진 개인 지수 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/known_d.py)
* [x] [작은 공개 지수 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/low_exponent.py)
* [x] [LSB 오라클 (패리티 오라클) 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/lsb_oracle.py)
* [x] [Manger 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/manger.py) [^rsa_manger]
* [x] [Nitaj의 CRT-RSA 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/nitaj_crt_rsa.py) [^rsa_nitaj_crt_rsa]
* [x] [비서로소 공개 지수 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/non_coprime_exponent.py) [^rsa_non_coprime_exponent]
* [x] [부분 키 노출](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/partial_key_exposure.py) [^rsa_partial_key_exposure1] [^rsa_partial_key_exposure2] [^rsa_partial_key_exposure3] 
* [x] [관련 메시지 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/related_message.py)
* [x] [정형화된 메시지 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/stereotyped_message.py)
* [x] [Wiener 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/wiener_attack.py)
* [x] [Common Prime RSA에 대한 Wiener 공격](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/wiener_attack_common_prime.py) [^rsa_wiener_attack_common_prime]
* [x] [Wiener 공격 (휴리스틱 격자 변형)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/wiener_attack_lattice.py) [^rsa_wiener_attack_lattice] [^rsa_wiener_attack_lattice_extended] [^small_roots_aono]

### Shamir 비밀 분산
* [x] [결정론적 계수](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/shamir_secret_sharing/deterministic_coefficients.py)
* [x] [셰어 위조](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/shamir_secret_sharing/share_forgery.py)

## 기타 흥미로운 구현
* [x] [Adleman-Manders-Miller 근 추출 방법](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/__init__.py) [^adleman_manders_miller]
* [x] [분할 정복을 이용한 고속 CRT](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/crt.py)
* [x] [고속 모듈러 역원](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/__init__.py)
* [x] [선형 Hensel 리프팅](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/hensel.py)
* [ ] 이차 Hensel 리프팅
* [x] [Babai 최근접 평면 알고리즘](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/lattice.py)
* [x] [행렬 이산 로그](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/matrices.py)
* [x] [행렬 이산 로그 (방정식)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/matrices.py)
* [x] [PartialInteger](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/partial_integer.py)
* [x] [half GCD를 이용한 고속 다항식 GCD](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/polynomial.py)

### 타원 곡선 생성
* [x] [복소 곱셈](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)
* [x] [변칙 곡선](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)
* [x] [MNT 곡선](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)
* [x] [지정된 위수](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)
* [x] [지정된 트레이스](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)
* [x] [초특이 곡선](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)

### 작은 근
* [x] [Groebner 기저를 사용한 다항식 근](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/__init__.py)
* [x] [종결식을 사용한 다항식 근](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/__init__.py)
* [x] [Sage variety (삼각 분해)를 사용한 다항식 근](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/__init__.py)
* [x] [Aono 방법 (민코프스키 합 격자)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/aono.py) [^small_roots_aono]
* [x] [Blomer-May 방법](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/blomer_may.py) [^small_roots_blomer_may]
* [x] [Boneh-Durfee 방법](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/boneh_durfee.py) [^rsa_boneh_durfee]
* [x] [Coron 방법](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/coron.py) [^small_roots_coron]
* [x] [Coron 방법 (직접)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/coron_direct.py) [^small_roots_coron_direct]
* [x] [Ernst et al. 방법](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/ernst.py) [^rsa_partial_key_exposure2]
* [x] [Herrmann-May 방법 (풀린 선형화)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/herrmann_may.py) [^small_roots_herrmann_may]
* [x] [Herrmann-May 방법 (모듈러 다변수)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/herrmann_may_multivariate.py) [^small_roots_herrmann_may_multivariate]
* [x] [Howgrave-Graham 방법](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/howgrave_graham.py) [^small_roots_howgrave_graham]
* [x] [Jochemsz-May 방법 (모듈러 근)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/jochemsz_may_modular.py) [^small_roots_jochemsz_may_modular]
* [x] [Jochemsz-May 방법 (정수 근)](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/jochemsz_may_integer.py) [^small_roots_jochemsz_may_integer]
* [x] [Nitaj-Fouotsa 방법](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/nitaj_fouotsa.py) [^small_roots_nitaj_fouotsa]

[^acd_mp]: Galbraith D. S. et al., "Algorithms for the Approximate Common Divisor Problem" (Section 5)
[^acd_ol]: Galbraith D. S. et al., "Algorithms for the Approximate Common Divisor Problem" (Section 4)
[^acd_sda]: Galbraith D. S. et al., "Algorithms for the Approximate Common Divisor Problem" (Section 3)

[^ecc_frey_ruck_attack]: Harasawa R. et al., "Comparing the MOV and FR Reductions in Elliptic Curve Cryptography" (Section 3)
[^ecc_mov_attack]: Harasawa R. et al., "Comparing the MOV and FR Reductions in Elliptic Curve Cryptography" (Section 2)
[^ecc_smart_attack1]: Smart N. P., "The Discrete Logarithm Problem on Elliptic Curves of Trace One"
[^ecc_smart_attack2]: Hofman S. J., "The Discrete Logarithm Problem on Anomalous Elliptic Curves"

[^factorization_branch_and_prune]: Heninger N., Shacham H., "Reconstructing RSA Private Keys from Random Key Bits"
[^factorization_complex_multiplication]: Sedlacek V. et al., "I want to break square-free: The 4p - 1 factorization method and its RSA backdoor viability"
[^factorization_gaa]: Ghafar AHA. et al., "A New LSB Attack on Special-Structured RSA Primes"
[^factorization_implicit]: Nitaj A., Ariffin MRK., "Implicit factorization of unbalanced RSA moduli"
[^factorization_known_phi]: Hinek M. J., Low M. K., Teske E., "On Some Attacks on Multi-prime RSA" (Section 3)
[^factorization_roca]: Nemec M. et al., "The Return of Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli"
[^factorization_shor]: M. Johnston A., "Shor’s Algorithm and Factoring: Don’t Throw Away the Odd Orders"
[^factorization_unbalanced]: Brier E. et al., "Factoring Unbalanced Moduli with Known Bits" (Section 4)

[^gcm_forbidden_attack]: Joux A., "Authentication Failures in NIST version of GCM"

[^hnp_extended_hnp]: Hlavac M., Rosa T., "Extended Hidden Number Problem and Its Cryptanalytic Applications" (Section 4) 

[^knapsack_low_density]: Coster M. J. et al., "Improved low-density subset sum algorithms"

[^lcg_truncated_parameter_recovery]: Contini S., Shparlinski I. E., "On Stern's Attack Against Secret Truncated Linear Congruential Generators"
[^lcg_truncated_state_recovery]: Frieze, A. et al., "Reconstructing Truncated Integer Variables Satisfying Linear Congruences"

[^lwe_arora_ge]: ["The Learning with Errors Problem: Algorithms"](https://people.csail.mit.edu/vinodv/6876-Fall2018/lecture2.pdf) (Section 1)

[^pseudoprimes_miller_rabin]: R. Albrecht M. et al., "Prime and Prejudice: Primality Testing Under Adversarial Conditions"

[^rsa_bleichenbacher]: Bleichenbacher D., "Chosen Ciphertext Attacks Against Protocols Based on the RSA Encryption Standard PKCS #1"
[^rsa_boneh_durfee]: Boneh D., Durfee G., "Cryptanalysis of RSA with Private Key d Less than N^0.292"
[^rsa_cherkaoui_semmouni]: Cherkaoui-Semmouni M. et al., "Cryptanalysis of RSA Variants with Primes Sharing Most Significant Bits"
[^rsa_desmedt_odlyzko]: Coron J. et al., "Practical Cryptanalysis of ISO 9796-2 and EMV Signatures (Section 3)"
[^rsa_extended_wiener_attack]: Dujella A., "Continued fractions and RSA with small secret exponent"
[^rsa_known_crt_exponents]: Campagna M., Sethi A., "Key Recovery Method for CRT Implementation of RSA"
[^rsa_partial_known_crt_exponents]: May A., Nowakowski J., Sarkar S., "Approximate Divisor Multiples - Factoring with Only a Third of the Secret CRT-Exponents"
[^rsa_manger]: Manger J., "A Chosen Ciphertext Attack on RSA Optimal Asymmetric Encryption Padding (OAEP) as Standardized in PKCS #1 v2.0"
[^rsa_nitaj_crt_rsa]: Nitaj A., "A new attack on RSA and CRT-RSA"
[^rsa_non_coprime_exponent]: Shumow D., "Incorrectly Generated RSA Keys: How To Recover Lost Plaintexts"
[^rsa_partial_key_exposure1]: Boneh D., Durfee G., Frankel Y., "An Attack on RSA Given a Small Fraction of the Private Key Bits"
[^rsa_partial_key_exposure2]: Ernst M. et al., "Partial Key Exposure Attacks on RSA Up to Full Size Exponents"
[^rsa_partial_key_exposure3]: Blomer J., May A., "New Partial Key Exposure Attacks on RSA"
[^rsa_wiener_attack_common_prime]: Jochemsz E., May A., "A Strategy for Finding Roots of Multivariate Polynomials with New Applications in Attacking RSA Variants" (Section 5)
[^rsa_wiener_attack_lattice]: Nguyen P. Q., "Public-Key Cryptanalysis"
[^rsa_wiener_attack_lattice_extended]: Howgrave-Graham N., Seifert J., "Extending Wiener’s Attack in the Presence of Many Decrypting Exponents"

[^adleman_manders_miller]: Cao Z. et al., "Adleman-Manders-Miller Root Extraction Method Revisited" (Section 5)

[^small_roots_aono]: Aono Y., "Minkowski sum based lattice construction for multivariate simultaneous Coppersmith's technique and applications to RSA" (Section 4)
[^small_roots_blomer_may]: Blomer J., May A., "New Partial Key Exposure Attacks on RSA" (Section 6)
[^small_roots_coron]: Coron J., "Finding Small Roots of Bivariate Integer Polynomial Equations Revisited"
[^small_roots_coron_direct]: Coron J., "Finding Small Roots of Bivariate Integer Polynomial Equations: a Direct Approach"
[^small_roots_herrmann_may]: Herrmann M., May A., "Maximizing Small Root Bounds by Linearization and Applications to Small Secret Exponent RSA"
[^small_roots_herrmann_may_multivariate]: Herrmann M., May A., "Solving Linear Equations Modulo Divisors: On Factoring Given Any Bits" (Section 3 and 4)
[^small_roots_howgrave_graham]: May A., "New RSA Vulnerabilities Using Lattice Reduction Methods" (Section 3.2)
[^small_roots_jochemsz_may_modular]: Jochemsz E., May A., "A Strategy for Finding Roots of Multivariate Polynomials with New Applications in Attacking RSA Variants" (Section 2.1)
[^small_roots_jochemsz_may_integer]: Jochemsz E., May A., "A Strategy for Finding Roots of Multivariate Polynomials with New Applications in Attacking RSA Variants" (Section 2.2)
[^small_roots_nitaj_fouotsa]: Nitaj A., Fouotsa E., "A New Attack on RSA and Demytko's Elliptic Curve Cryptosystem"