Factoring a RSA modulus given parts of a Factor

Question

e,N,c and around 2/3 of p are given and I need to get the whole p to decrypt c.

N: 8312149741330899916697224341696442173832983333033533868114357629528308275054077482978318344117569648871296807193083318973267987737598013362488984955294277970756713190518245146761371391587675454955082637006826012856729608493966736502617228877462056856823273067605902504231019234987127332821962808960666514201780150344606909668019219435601847838679933824248465229891162452865014330119992858093166264226453323049361942327198871869049373981121232039811404131276772192726522406874599003068013354509912595677390671605294783599094720012720875221186060024608980417392915879855779809393734926762248204438337017827468209125187
e: 65537
c: 4548927054812431942753138291825509028863262479437483329968538317507236876650157049844429198300955726158595597578794514475589500507898396004531366579992835390577287303579180298970616860726330511695356641852703562933324127585334767461012319316635473235419546870836189966269387090683550103754914172268226908765558390346676861135473565323287262707334833487258432307735265757336144624970408430332628490683163572608519051082954958043008880277189711916851139069205915687194284237406309267341840009327092905760192508718964261515940491888829885970729185261170698561522864863535262005763095399380356644363889100224795578038465
p: 4659317379689169125518326687347386403148007136775396706762929589917125557436490752403485896402728889????????????????????????????????????????????????????????????????????????????????????????????????????173135959017564532947337277095589806799507150118729620171020590555111518518052566156355995585616152373846473

"?" are the missing digits. I have already tried using this website: https://latticehacks.cr.yp.to/rsa.html but I only get errors (used SageMath for that) with those numbers but the example works.

What am I doing wrong and can anyone help me find the whole factor to get the key?

Does this answer your question? Factoring an RSA modulus given high bits of a factor — user93353, Oct 07 '21 at 15:31
You could take a look at the very nice tutorial Recovering cryptographic keys from partial information, by example by Gabrielle De Micheli and Nadia Heninger. — j.p., Oct 08 '21 at 07:12
I'd expect that you can use Coppersmith's method directly as there is only one chunk of bits unknown. Multivariate you need only for several chunks. I didn't work out the details, but I'd be surprised if an adaption of the ideas in sections 4.2.2 and 4.2.3 to your case wouldn't be possible. — j.p., Oct 09 '21 at 08:07

score 7 · Accepted Answer · edited Aug 24 '22 at 10:12

The problem here is that you have a divisor $p$ of $n$ of the form $$ p_h \cdot 10^{208} + p_m\cdot 10^{108} + p_l\,, $$ where you know $p_h$ and $p_l$, but not $p_m < 10^{100} \lessapprox n^{0.16}$.

Clearly, the polynomial $f(x) = x\cdot 10^{108} + p_h \cdot 10^{208} + p_l$ will be $0$ modulo $p$ for the right $x = p_m$, which is known to be small. So we can apply here the GCD generalization of the Coppersmith theorem with $\beta \approx 0.5$:

sage: p_h = 4659317379689169125518326687347386403148007136775396706762929589917125557436490752403485896402728889
sage: p_l = 173135959017564532947337277095589806799507150118729620171020590555111518518052566156355995585616152373846473
sage: n = 8312149741330899916697224341696442173832983333033533868114357629528308275054077482978318344117569648871296807193083318973267987737598013362488984955294277970756713190518245146761371391587675454955082637006826012856729608493966736502617228877462056856823273067605902504231019234987127332821962808960666514201780150344606909668019219435601847838679933824248465229891162452865014330119992858093166264226453323049361942327198871869049373981121232039811404131276772192726522406874599003068013354509912595677390671605294783599094720012720875221186060024608980417392915879855779809393734926762248204438337017827468209125187
sage: P.<x> = Zmod(n)[]
sage: f = x*10^108 + p_h*10^208 + p_l
sage: f = (x*10^108 + p_h*10^208 + p_l)/10^108 # Make the polynomial monic
sage: f.small_roots(beta=0.49)
[5522478054151238940535570449483225331805673615385824425037231887410525550513912774871851607819037115]

Factoring a RSA modulus given parts of a Factor

1 Answers1