# Tag Info

Yes, it is possible. Like SEJPM suggested, you can use a variant of the Franklin-Reiter related-message attack to accomplish this. Let $\Delta = r_2 - r_1$. Compute $\gcd(X^{e} - c_e, (X + \Delta)^{s} - c_s)$ over $\mathbb{Z}/n\mathbb{Z}[X]$, which yields the linear polynomial $X - (m + r_1)$. Recovering $m$ is now trivial. This, of course, will only be ...