密码学攻击与实用工具的 Python 实现。
你可以使用以下命令检查你的 SageMath Python 版本：``` $ sage -python --version Python 3.9.0
如果你的 SageMath Python 版本低于 3.9.0，某些脚本中的某些功能可能无法正常工作。
## 用法
单元测试位于 `test` 目录中，可以使用 `unittest` 模块或 `pytest` 来执行。这不会花费太长时间，具体取决于你的机器，可能需要几分钟。
要运行特定攻击，你必须在执行前将代码添加到相应的文件中。
### 示例
例如，你想使用 Boneh-Durfee 攻击来攻击 RSA，并使用以下参数（取自 [test_rsa.py](https://github.com/jvdsn/crypto-attacks/blob/HEAD/test/test_rsa.py)）：```python
N = 88320836926176610260238895174120738360949322009576866758081671082752401596826820274141832913391890604999466444724537056453777218596634375604879123818123658076245218807184443147162102569631427096787406420042132112746340310992380094474893565028303466135529032341382899333117011402408049370805729286122880037249
e = 36224751658507610673165956970793195381480143363550601971796688201449789736497322700382657163240771111376677180786660893671085854060092736865293791299460933460067267613023891500397200389824179925263846148644777638774319680682025117466596019474987378275216579013846855328009375540444176771945272078755317168511
在 boneh_durfee.py 文件的底部添加以下代码：```python import logging
logging.basicConfig(level=logging.DEBUG)
N = 88320836926176610260238895174120738360949322009576866758081671082752401596826820274141832913391890604999466444724537056453777218596634375604879123818123658076245218807184443147162102569631427096787406420042132112746340310992380094474893565028303466135529032341382899333117011402408049370805729286122880037249 e = 36224751658507610673165956970793195381480143363550601971796688201449789736497322700382657163240771111376677180786660893671085854060092736865293791299460933460067267613023891500397200389824179925263846148644777638774319680682025117466596019474987378275216579013846855328009375540444176771945272078755317168511 p_bits = 512 delta = 0.26
p, q = attack(N, e, p_bits, delta=delta, m=3) assert p * q == N print(f"Found {p = } and {q = }")
然后，你可以简单地使用 Sage 执行该文件。无论你从哪里执行它都没有关系，Python 路径会自动设置（你也可以从其他 Python 文件中调用这些攻击，但那样的话你必须自己修复 Python 路径）：```commandline
[crypto-attacks]$ sage -python attacks/rsa/boneh_durfee.py
INFO:root:Trying m = 3, t = 1...
DEBUG:root:Generating shifts...
DEBUG:root:Creating a lattice with 11 shifts (order = 'invlex', sort_shifts_reverse = False, sort_monomials_reverse = False)...
DEBUG:root:Reducing a 11 x 11 lattice...
DEBUG:root:Reconstructing polynomials (divide_original = True, modulus_bound = False, divide_gcd = True)...
DEBUG:root:Polynomial at row 8 is constant, ignoring...
DEBUG:root:Reconstructed polynomial has gcd 1312232632720549890113031660369306919929075823824696839212183146130434668203517349691252841557097914064120078389640402109017308806168467714230057403815071456395553717020189622129706447677967264344568789118172311850383406340547579993263937406518074980025897726255316031512238322022839331135299265704052474541497687419350763703993630899191179705015113329644753599872380152055902238937889027950089072598069861391599563222633064848996619752054685734260976071760984100109990150069201501748622288840900421607423175114026653242500476408861976142751384898489130281755466581359057847077651502734556259387442296763474369957121 with polynomial at 8, dividing...
DEBUG:root:Reconstructed 10 polynomials
DEBUG:root:Computing pairwise gcds to find trivial roots...
DEBUG:root:Using Groebner basis method to find roots...
DEBUG:root:Sequence length: 10, Groebner basis length: 1
DEBUG:root:Sequence length: 9, Groebner basis length: 1
DEBUG:root:Sequence length: 8, Groebner basis length: 1
DEBUG:root:Sequence length: 7, Groebner basis length: 2
DEBUG:root:Found Groebner basis with length 2, trying to find roots...
Found p = 7866790440964395011005623971351568677139336343167390105188826934257986271072664643571727955882500173182140478082778193338086048035817634545367411924942763 and q = 11227048386374621771175649743442169526805922745751610531569607663416378302561807690656370394330458335919244239976798600743588701676542461805061598571009923
输出日志中显示的参数 m 和 t 值得特别关注。这两个参数在许多基于格（小根）算法中用于调整格的大小。从概念上讲，m（有时称为 k）和 t 表示格中使用的“移位”数量，这大致等于或正比于行数。因此，增加 m 和 t 会增大格的规模，同时也会增加执行格归约（目前使用 LLL）所需的时间。另一方面，如果 m 和 t 过低，则格归约可能无法产生合适的向量，从而浪费归约所花费的时间。因此，这是一个权衡。
在当前版本的项目中，m 必须始终由用户提供（默认值为 1）。在某些情况下，t 可以根据攻击所使用的特定小根方法计算得出。不过，用户仍然可以对其进行调整。一般来说，使用这类参数有两种方式：
m = 1 开始循环，直到找到答案（示例如下）。这是一种简单的方法，但可能因格过小而浪费在无用的计算上。```
m = 1
while True:
res = attack(..., m=m)
if res is not None:
# The attack succeeded!
break
m += 1* 实现一个你打算使用的攻击的调试版本（使用已知结果），并确定能产生良好格向量的 `m` 值。然后直接使用正确的 `m` 值调用攻击方法。
## 已实现的攻击
### 近似公约数
* [x] [多元多项式攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/acd/mp.py) [^acd_mp]
* [x] [基于正交的攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/acd/ol.py) [^acd_ol]
* [x] [联立丢番图逼近攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/acd/sda.py) [^acd_sda]
### CBC
* [x] [比特翻转攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc/bit_flipping.py)
* [x] [IV 恢复攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc/iv_recovery.py)
* [x] [填充预言机攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc/padding_oracle.py)
### CBC + CBC-MAC
* [x] [密钥重用攻击（加密并 MAC）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc_and_cbc_mac/eam_key_reuse.py)
* [x] [密钥重用攻击（先加密后 MAC）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc_and_cbc_mac/etm_key_reuse.py)
* [x] [密钥重用攻击（先 MAC 后加密）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc_and_cbc_mac/mte_key_reuse.py)
### CBC-MAC
* [x] [长度扩展攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/cbc_mac/length_extension.py)
### CTR
* [x] [比特翻转攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ctr/bit_flipping.py)
* [x] [CRIME 攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ctr/crime.py)
* [x] [分隔符预言机攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ctr/separator_oracle.py)
### ECB
* [x] [明文恢复攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecb/plaintext_recovery.py)
* [x] [明文恢复攻击（较难变体）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecb/plaintext_recovery_harder.py)
* [x] [明文恢复攻击（最难变体）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecb/plaintext_recovery_hardest.py)
### 椭圆曲线密码学
* [x] [ECDSA nonce 重用攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/ecdsa_nonce_reuse.py)
* [x] [Frey-Ruck 攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/frey_ruck_attack.py) [^ecc_frey_ruck_attack]
* [x] [MOV 攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/mov_attack.py) [^ecc_mov_attack]
* [x] [参数恢复](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/parameter_recovery.py)
* [x] [奇异曲线攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/singular_curve.py)
* [x] [Smart 攻击（针对扩域上的曲线）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ecc/smart_attack.py) [^ecc_smart_attack1] [^ecc_smart_attack2]
### ElGamal 加密
* [x] [nonce 重用攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/elgamal_encryption/nonce_reuse.py)
* [x] [不安全生成元攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/elgamal_encryption/unsafe_generator.py)
### ElgGamal 签名
* [ ] Bleichenbacher 攻击
* [ ] Khadir 攻击
* [x] [nonce 重用攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/elgamal_signature/nonce_reuse.py)
### 因式分解
* [x] [进制转换因式分解](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/base_conversion.py)
* [x] [分支剪枝攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/branch_and_prune.py) [^factorization_branch_and_prune]
* [x] [复乘法（椭圆曲线）因式分解](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/complex_multiplication.py) [^factorization_complex_multiplication]
* [x] [Coppersmith 因式分解](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/coppersmith.py)
* [x] [费马因式分解](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/fermat.py)
* [x] [Ghafar-Ariffin-Asbullah 攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/gaa.py) [^factorization_gaa]
* [x] [隐式因式分解](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/implicit.py) [^factorization_implicit]
* [x] [已知 phi 因式分解](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/known_phi.py) [^factorization_known_phi]
* [x] [ROCA](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/roca.py) [^factorization_roca]
* [x] [Shor 算法（经典）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/shor.py) [^factorization_shor]
* [x] [孪生素数因式分解](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/twin_primes.py)
* [x] [不平衡模数因式分解](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/factorization/unbalanced.py) [^factorization_unbalanced]
### GCM
* [x] [Forbidden 攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/gcm/forbidden_attack.py) [^gcm_forbidden_attack]
### 隐藏数问题
应用于部分 (EC)DSA nonce 泄露。
* [x] [扩展隐藏数问题](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/hnp/extended_hnp.py) [^hnp_extended_hnp]
* [ ] 傅里叶分析攻击
* [x] [基于格的攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/hnp/lattice_attack.py)
### IGE
* [x] [填充预言机攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/ige/padding_oracle.py)
### 背包密码体制
* [x] [低密度攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/knapsack/low_density.py) [^knapsack_low_density]
### 线性同余生成器
* [x] [LCG 参数恢复](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/lcg/parameter_recovery.py)
* [x] [截断 LCG 参数恢复](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/lcg/truncated_parameter_recovery.py) [^lcg_truncated_parameter_recovery]
* [x] [截断 LCG 状态恢复](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/lcg/truncated_state_recovery.py) [^lcg_truncated_state_recovery]
### 带误差学习
* [x] [Arora-Ge 攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/lwe/arora_ge.py) [^lwe_arora_ge]
* [ ] Blum-Kalai-Wasserman 攻击
* [ ] 格归约攻击
### 梅森旋转算法
* [x] [状态恢复](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/mersenne_twister/state_recovery.py)
### 一次性密码本
* [x] [密钥重用](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/otp/key_reuse.py)
### 伪素数
* [x] [生成 Miller-Rabin 伪素数](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/pseudoprimes/miller_rabin.py) [^pseudoprimes_miller_rabin]
### RC4
* [x] [Fluhrer-Mantin-Shamir 攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rc4/fms.py)
### RSA
* [x] [Bleichenbacher 攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/bleichenbacher.py) [^rsa_bleichenbacher]
* [x] [Bleichenbacher 签名伪造攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/bleichenbacher_signature_forgery.py)
* [x] [Boneh-Durfee 攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/boneh_durfee.py) [^rsa_boneh_durfee]
* [x] [Cherkaoui-Semmouni 攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/cherkaoui_semmouni.py) [^rsa_cherkaoui_semmouni]
* [x] [公共模数攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/common_modulus.py)
* [x] [CRT 故障攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/crt_fault_attack.py)
* [x] [d 故障攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/d_fault_attack.py)
* [x] [Desmedt-Odlyzko 攻击（选择性伪造）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/desmedt_odlyzko.py) [^rsa_desmedt_odlyzko]
* [x] [扩展 Wiener 攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/extended_wiener_attack.py) [^rsa_extended_wiener_attack]
* [x] [Hastad 广播攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/hastad_attack.py)
* [x] [已知 CRT 指数攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/known_crt_exponents.py) [^rsa_known_crt_exponents]
* [x] [部分已知 CRT 指数攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/known_crt_exponents.py) [^rsa_partial_known_crt_exponents]
* [x] [已知私钥指数攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/known_d.py)
* [x] [低公钥指数攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/low_exponent.py)
* [x] [LSB 预言机（奇偶性预言机）攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/lsb_oracle.py)
* [x] [Manger 攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/manger.py) [^rsa_manger]
* [x] [Nitaj CRT-RSA 攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/nitaj_crt_rsa.py) [^rsa_nitaj_crt_rsa]
* [x] [非互素公钥指数攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/non_coprime_exponent.py) [^rsa_non_coprime_exponent]
* [x] [部分密钥泄露](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/partial_key_exposure.py) [^rsa_partial_key_exposure1] [^rsa_partial_key_exposure2] [^rsa_partial_key_exposure3]
* [x] [相关消息攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/related_message.py)
* [x] [模式化消息攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/stereotyped_message.py)
* [x] [Wiener 攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/wiener_attack.py)
* [x] [针对 Common Prime RSA 的 Wiener 攻击](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/wiener_attack_common_prime.py) [^rsa_wiener_attack_common_prime]
* [x] [Wiener 攻击（启发式格变体）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/rsa/wiener_attack_lattice.py) [^rsa_wiener_attack_lattice] [^rsa_wiener_attack_lattice_extended] [^small_roots_aono]
### Shamir 秘密共享
* [x] [确定性系数](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/shamir_secret_sharing/deterministic_coefficients.py)
* [x] [份额伪造](https://github.com/jvdsn/crypto-attacks/blob/HEAD/attacks/shamir_secret_sharing/share_forgery.py)
## 其他有趣的实现
* [x] [Adleman-Manders-Miller 根提取方法](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/__init__.py) [^adleman_manders_miller]
* [x] [使用分治的快速 CRT](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/crt.py)
* [x] [快速模逆](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/__init__.py)
* [x] [线性 Hensel 提升](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/hensel.py)
* [ ] 二次 Hensel 提升
* [x] [Babai 最近平面算法](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/lattice.py)
* [x] [矩阵离散对数](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/matrices.py)
* [x] [矩阵离散对数（方程）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/matrices.py)
* [x] [PartialInteger](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/partial_integer.py)
* [x] [使用 half GCD 的快速多项式 GCD](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/polynomial.py)
### 椭圆曲线生成
* [x] [复乘法](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)
* [x] [异常曲线](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)
* [x] [MNT 曲线](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)
* [x] [指定阶](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)
* [x] [指定迹](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)
* [x] [超奇异曲线](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/ecc.py)
### 小根
* [x] [使用 Groebner 基的多项式根](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/__init__.py)
* [x] [使用结式的多项式根](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/__init__.py)
* [x] [使用 Sage variety（三角分解）的多项式根](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/__init__.py)
* [x] [Aono 方法（Minkowski 和格）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/aono.py) [^small_roots_aono]
* [x] [Blomer-May 方法](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/blomer_may.py) [^small_roots_blomer_may]
* [x] [Boneh-Durfee 方法](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/boneh_durfee.py) [^rsa_boneh_durfee]
* [x] [Coron 方法](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/coron.py) [^small_roots_coron]
* [x] [Coron 方法（直接）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/coron_direct.py) [^small_roots_coron_direct]
* [x] [Ernst 等人的方法](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/ernst.py) [^rsa_partial_key_exposure2]
* [x] [Herrmann-May 方法（展开线性化）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/herrmann_may.py) [^small_roots_herrmann_may]
* [x] [Herrmann-May 方法（模多元）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/herrmann_may_multivariate.py) [^small_roots_herrmann_may_multivariate]
* [x] [Howgrave-Graham 方法](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/howgrave_graham.py) [^small_roots_howgrave_graham]
* [x] [Jochemsz-May 方法（模根）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/jochemsz_may_modular.py) [^small_roots_jochemsz_may_modular]
* [x] [Jochemsz-May 方法（整数根）](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/jochemsz_may_integer.py) [^small_roots_jochemsz_may_integer]
* [x] [Nitaj-Fouotsa 方法](https://github.com/jvdsn/crypto-attacks/blob/HEAD/shared/small_roots/nitaj_fouotsa.py) [^small_roots_nitaj_fouotsa]
[^acd_mp]: Galbraith D. S. et al., "Algorithms for the Approximate Common Divisor Problem" (Section 5)
[^acd_ol]: Galbraith D. S. et al., "Algorithms for the Approximate Common Divisor Problem" (Section 4)
[^acd_sda]: Galbraith D. S. et al., "Algorithms for the Approximate Common Divisor Problem" (Section 3)
[^ecc_frey_ruck_attack]: Harasawa R. et al., "Comparing the MOV and FR Reductions in Elliptic Curve Cryptography" (Section 3)
[^ecc_mov_attack]: Harasawa R. et al., "Comparing the MOV and FR Reductions in Elliptic Curve Cryptography" (Section 2)
[^ecc_smart_attack1]: Smart N. P., "The Discrete Logarithm Problem on Elliptic Curves of Trace One"
[^ecc_smart_attack2]: Hofman S. J., "The Discrete Logarithm Problem on Anomalous Elliptic Curves"
[^factorization_branch_and_prune]: Heninger N., Shacham H., "Reconstructing RSA Private Keys from Random Key Bits"
[^factorization_complex_multiplication]: Sedlacek V. et al., "I want to break square-free: The 4p - 1 factorization method and its RSA backdoor viability"
[^factorization_gaa]: Ghafar AHA. et al., "A New LSB Attack on Special-Structured RSA Primes"
[^factorization_implicit]: Nitaj A., Ariffin MRK., "Implicit factorization of unbalanced RSA moduli"
[^factorization_known_phi]: Hinek M. J., Low M. K., Teske E., "On Some Attacks on Multi-prime RSA" (Section 3)
[^factorization_roca]: Nemec M. et al., "The Return of Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli"
[^factorization_shor]: M. Johnston A., "Shor’s Algorithm and Factoring: Don’t Throw Away the Odd Orders"
[^factorization_unbalanced]: Brier E. et al., "Factoring Unbalanced Moduli with Known Bits" (Section 4)
[^gcm_forbidden_attack]: Joux A., "Authentication Failures in NIST version of GCM"
[^hnp_extended_hnp]: Hlavac M., Rosa T., "Extended Hidden Number Problem and Its Cryptanalytic Applications" (Section 4)
[^knapsack_low_density]: Coster M. J. et al., "Improved low-density subset sum algorithms"
[^lcg_truncated_parameter_recovery]: Contini S., Shparlinski I. E., "On Stern's Attack Against Secret Truncated Linear Congruential Generators"
[^lcg_truncated_state_recovery]: Frieze, A. et al., "Reconstructing Truncated Integer Variables Satisfying Linear Congruences"
[^lwe_arora_ge]: ["The Learning with Errors Problem: Algorithms"](https://people.csail.mit.edu/vinodv/6876-Fall2018/lecture2.pdf) (Section 1)
[^pseudoprimes_miller_rabin]: R. Albrecht M. et al., "Prime and Prejudice: Primality Testing Under Adversarial Conditions"
[^rsa_bleichenbacher]: Bleichenbacher D., "Chosen Ciphertext Attacks Against Protocols Based on the RSA Encryption Standard PKCS #1"
[^rsa_boneh_durfee]: Boneh D., Durfee G., "Cryptanalysis of RSA with Private Key d Less than N^0.292"
[^rsa_cherkaoui_semmouni]: Cherkaoui-Semmouni M. et al., "Cryptanalysis of RSA Variants with Primes Sharing Most Significant Bits"
[^rsa_desmedt_odlyzko]: Coron J. et al., "Practical Cryptanalysis of ISO 9796-2 and EMV Signatures (Section 3)"
[^rsa_extended_wiener_attack]: Dujella A., "Continued fractions and RSA with small secret exponent"
[^rsa_known_crt_exponents]: Campagna M., Sethi A., "Key Recovery Method for CRT Implementation of RSA"
[^rsa_partial_known_crt_exponents]: May A., Nowakowski J., Sarkar S., "Approximate Divisor Multiples - Factoring with Only a Third of the Secret CRT-Exponents"
[^rsa_manger]: Manger J., "A Chosen Ciphertext Attack on RSA Optimal Asymmetric Encryption Padding (OAEP) as Standardized in PKCS #1 v2.0"
[^rsa_nitaj_crt_rsa]: Nitaj A., "A new attack on RSA and CRT-RSA"
[^rsa_non_coprime_exponent]: Shumow D., "Incorrectly Generated RSA Keys: How To Recover Lost Plaintexts"
[^rsa_partial_key_exposure1]: Boneh D., Durfee G., Frankel Y., "An Attack on RSA Given a Small Fraction of the Private Key Bits"
[^rsa_partial_key_exposure2]: Ernst M. et al., "Partial Key Exposure Attacks on RSA Up to Full Size Exponents"
[^rsa_partial_key_exposure3]: Blomer J., May A., "New Partial Key Exposure Attacks on RSA"
[^rsa_wiener_attack_common_prime]: Jochemsz E., May A., "A Strategy for Finding Roots of Multivariate Polynomials with New Applications in Attacking RSA Variants" (Section 5)
[^rsa_wiener_attack_lattice]: Nguyen P. Q., "Public-Key Cryptanalysis"
[^rsa_wiener_attack_lattice_extended]: Howgrave-Graham N., Seifert J., "Extending Wiener’s Attack in the Presence of Many Decrypting Exponents"
[^adleman_manders_miller]: Cao Z. et al., "Adleman-Manders-Miller Root Extraction Method Revisited" (Section 5)
[^small_roots_aono]: Aono Y., "Minkowski sum based lattice construction for multivariate simultaneous Coppersmith's technique and applications to RSA" (Section 4)
[^small_roots_blomer_may]: Blomer J., May A., "New Partial Key Exposure Attacks on RSA" (Section 6)
[^small_roots_coron]: Coron J., "Finding Small Roots of Bivariate Integer Polynomial Equations Revisited"
[^small_roots_coron_direct]: Coron J., "Finding Small Roots of Bivariate Integer Polynomial Equations: a Direct Approach"
[^small_roots_herrmann_may]: Herrmann M., May A., "Maximizing Small Root Bounds by Linearization and Applications to Small Secret Exponent RSA"
[^small_roots_herrmann_may_multivariate]: Herrmann M., May A., "Solving Linear Equations Modulo Divisors: On Factoring Given Any Bits" (Section 3 and 4)
[^small_roots_howgrave_graham]: May A., "New RSA Vulnerabilities Using Lattice Reduction Methods" (Section 3.2)
[^small_roots_jochemsz_may_modular]: Jochemsz E., May A., "A Strategy for Finding Roots of Multivariate Polynomials with New Applications in Attacking RSA Variants" (Section 2.1)
[^small_roots_jochemsz_may_integer]: Jochemsz E., May A., "A Strategy for Finding Roots of Multivariate Polynomials with New Applications in Attacking RSA Variants" (Section 2.2)
[^small_roots_nitaj_fouotsa]: Nitaj A., Fouotsa E., "A New Attack on RSA and Demytko's Elliptic Curve Cryptosystem"