# ROCA Implementation, Coppersmith Algorithm does not return roots

We are currently trying to reproduce the implementation of the ROCA-Paper. Therefore we calculated $$M'$$ from $$M$$ and $$Order_M'$$ from $$Order_M$$ to reduce the search space, but when we hand these values to the coppersmith algorithm as described in Algorithm 1 of the paper, this algorithm does not find any roots.vIt only finds "potential" roots, which are fractional numbers and result in float numbers between $$0$$ and $$1$$.

These Roots have the form:

• 7903163834028830451137438186485015861/17304344567133368654502628603056098610,
• 213501605850162343745788742125935233/17304344567133368654502628603056098610, ...

Our Implementation can be found on Github

Does anybody have an idea, why the coppersmith algorithm does not return correct roots?

if gcd(modulus, result) >= modulus ^ beta:

You created $f$ as $$f(x) = x + (M'^{-1} \bmod N)(65537^{a'}\bmod M),$$ so when you put $\mathrm{result} = f(\mathrm{root[0]})$, you do not get $p$ or a multiple of $p$, so the gcd makes no sense (and if ever you get a gcd greater than 1, you may have a factor of $N$).