lattice-crypto-attacks

Lattice cryptanalysis recovers RSA secrets by applying Coppersmith's method to find small roots. You construct a lattice from the public parameters, apply LLL or BKZ reduction, and interpret the reduced basis to extract the private key candidates.

Exploiting DSA nonce bias involves formulating the Hidden Number Problem as a lattice. You construct a lattice embedding the biased nonce relationships, apply LLL reduction, and extract the secret signing key from the shortest vector in the reduced basis.

Yes, you need SageMath or Python libraries like fpylll to construct lattices and perform LLL and BKZ reductions. These environments provide the mathematical primitives required to build the lattice matrices and execute the reduction algorithms.

Coppersmith's method applies to both univariate and multivariate small roots in RSA. The approach constructs appropriate lattices for the polynomial equations, uses LLL to find small independent polynomials, and solves for the roots to recover hidden messages.

Breaking knapsack ciphers and NTRU involves constructing a lattice that encodes the subset sum or polynomial relationship, applying LLL or BKZ reduction to find short vectors, and interpreting the reduced basis to identify the secret key or message.

Use LLL for faster, approximate reductions when the lattice dimension is moderate and the target vector is sufficiently short. Apply BKZ when higher precision is needed for larger dimensions, as it provides stronger reductions by processing blocks of vectors.