# Factoring a RSA modulus given parts of a Factor

e,N,c and around 2/3 of p are given and I need to get the whole p to decrypt c.

N: 8319209622572147564013826542514259498682642243858419574823720424163091461701501360015982209990033336520746744572035014978885083880306655150878826112698449183627604378591045476163815683140601440141181336500755042065319357073688047689369842069576880590382907166998622533395350509313527264108988375924505750514907811200521771091619671861896277515872762861803861776874814818759550176763409337645914659855794895018341028254707583446748584671147839997360735893784761893682319714306096295255392779139228496862261602629668021770766403895493829479280751919607803462139336221636202936115853250410851992088076115853781819064537
e: 65537
c: 4953284236047971172578832583499377493178200304479143209550787249372461101728658773670930238470955483017914105971816965742510454042292225833646213980243990906909055183035487729211063154361995845063984656265718117973811054592839102686638618059351593068564821438986641302188691512194069434490636627580791763494578169497869477621620646090488263145323524094255076603309311346040499379850098705597815946140397825326676093352260642665202907180660054018022276329942694463490417145273018047785653000749283804947161814490990395826461165462311565059508939959327500584807568342952319675042226613334756078721555811790191840438113
p: 4657466126792836973364876345509106305470210556754730583762574018947035473615496183374863999868029162????????????????????????????????????????????????????????????????????????????????????????????????????509718954507298459183080086410468930318128642354235212531127396991917151481316220676314043160415859389810007


"?" are the missing digits. I have already tried using this website: https://latticehacks.cr.yp.to/rsa.html but I only get errors (used SageMath for that) with those numbers but the example works.

What am I doing wrong and can anyone help me find the whole factor to get the key?

• Does this answer your question? Factoring an RSA modulus given high bits of a factor Oct 7 '21 at 15:31
• That doesnt solve it as that method/algorithm only works if you have more than the half of the factor I think (the first half). In my case, I am missing the middle of the factor so I have a third of the beginning digits and a third of the end digits. Oct 7 '21 at 15:39
• What is the number $c$? Oct 7 '21 at 18:13
• c is the encrypted message Oct 7 '21 at 18:16
• You could take a look at the very nice tutorial Recovering cryptographic keys from partial information, by example by Gabrielle De Micheli and Nadia Heninger.
– j.p.
Oct 8 '21 at 7:12

The problem here is that you have a divisor $$p$$ of $$n$$ of the form $$p_h \cdot 10^{208} + p_m\cdot 10^{108} + p_l\,,$$ where you know $$p_h$$ and $$p_l$$, but not $$p_m < 10^{100} \lessapprox n^{0.16}$$.

Clearly, the polynomial $$f(x) = x\cdot 10^{108} + p_h \cdot 10^{208} + p_l$$ will be $$0$$ modulo $$p$$ for the right $$x = p_m$$, which is known to be small. So we can apply here the GCD generalization of the Coppersmith theorem with $$\beta \approx 0.5$$:

sage: p_h = 4657466126792836973364876345509106305470210556754730583762574018947035473615496183374863999868029162
sage: p_l = 509718954507298459183080086410468930318128642354235212531127396991917151481316220676314043160415859389810007
sage: n = 8319209622572147564013826542514259498682642243858419574823720424163091461701501360015982209990033336520746744572035014978885083880306655150878826112698449183627604378591045476163815683140601440141181336500755042065319357073688047689369842069576880590382907166998622533395350509313527264108988375924505750514907811200521771091619671861896277515872762861803861776874814818759550176763409337645914659855794895018341028254707583446748584671147839997360735893784761893682319714306096295255392779139228496862261602629668021770766403895493829479280751919607803462139336221636202936115853250410851992088076115853781819064537
sage: P.<x> = Zmod(n)[]
sage: f = x*10^108 + p_h*10^208 + p_l
sage: f = (x*10^108 + p_h*10^208 + p_l)/10^108 # Make the polynomial monic
sage: f.small_roots(beta=0.49)
[4555790634870609108348440239954454001363406634260834115187291781797769149826662476501530037286859856]