Hacker News Reader

Not so simple. You forgot about the fact that it wraps around the modulus.

Say c is the 65537th power of m. You try a guess m' and find that its 65537th power is c + 10 (mod N). Will you choose your next guess m'' to be greater than m' or less than m'? It could be either.

View on HN

What's N? There was no N or modulo in the sentence I quoted.

Oh, my bad I misunderstood. Yes, you could just construct a system of 65537 equations in 65537 variables. You can't do a binary search though. Remember, all you have access to is c (mod p_i) for i = 1, ..., 65537. To do a binary search, you'd need the integer c (not mod anything).

But the gist of this attack is that you can recover integer c with Chinese Remainder Theorem. Then you can use binary search (or another root-finding algorithm) to get m.

Reply on news.ycombinator.com