Finding Small Roots of Bivariate Integer Polynomial Equations: a Direct Approach

Abstract. Coppersmith described at Eurocrypt 96 an algorithm for nding small roots of bivariate integer polynomial equations, based on lattice reduction. A simpler algorithm was later proposed in [9], but it was asymptotically less ecient than Coppersmith's algorithm. In this paper, we describe an analogous simplication but with the same asymptotic complexity as Coppersmith. We illustrate our new algorithm with the problem of factoring RSA moduli with high-order bits known; in practical experiments our method is several orders of magnitude faster than [9]. Key-words: Coppersmith's theorem, lattice reduction, cryptanalysis.