# Finding Small Roots of Multivariate Polynomial Modulo an Integer in Sage (Coppersmith's Attack on RSA)

I am trying to implement Coppersmith's attack to find small roots of an example bivariate polynomial.

$f(x,y) = (8x+7)(8y+7) - N \pmod{8}$

In this example, the results should be $x = 2$ and $y = 8$ (obviously you could brute force it, but that's besides the point).

For univariate polynomials, Coppersmith's attack is implemented via the .small_roots() function. However, it is to my understanding that finding small roots of a multivariate polynomial modulo an integer is not implemented in Sage. Is there any workaround code / method that will allow for small root finding of multivariate polynomials?

Relevant papers:

http://honors.cs.umd.edu/reports/lowexprsa.pdf

http://www.jscoron.fr/publications/bivariate.pdf

Thanks, and your time and effort are greatly appreciated.

• How is this related to RSA? Are you having some sort of unknown padding, hence the second variable? If your question is purely about "how to use Sage to do..." then I think you'll find more help on SO. – Lery Jun 30 '17 at 22:54
• A further search led me to this very interesting paper, which I added to my "to read" list (the ever-growing one), and which seems to explain in details how one can do what you're trying to do. And it even happens to have been implemented for PlaidCTF using Sage. – Lery Jun 30 '17 at 23:11
• Thanks for your comment. Looks like there's no easy way around the issue. I'll have to read more before I attempt to figure out what's going on in that code. – user3089196 Jul 1 '17 at 2:32

If you calculate modulo $8$, your polynomial becomes constant: $f(x, y) = 1-N \pmod{8}$