Understanding the Franklin–Reiter Attack
Recovering RSA Plaintext with Polynomial GCDs
Series
RSA/Coppersmith-Attacks
A Blog series on general Coppersmith Attack and a few Coppersmith-based attacks. Includes math, Python/Sage based implementation.
Posts in this series
Coppersmith's Attack: When Knowing a Little Is Enough to Break RSA
How lattice reduction helps recover small unknowns hidden inside RSA's mathematical structure.
Coppersmith's Attack 2: The Short Pad Attack
How two messages, a little padding, and some lattice reduction can ruin your day. i.e., When Randomness Isn't Random Enough.
Coppersmith Attacks, Part 3: Factoring RSA When High Bits Are Known
You don't need to know the whole secret if you know enough of it.
