Solving modular cubic equations with Coppersmith's method

Abstract

Several cryptosystems based on Elliptic Curve Cryptography such as KMOV and Demytko process the message as a point $M=(x_0,y_0)$ of an elliptic curve with an equation of the form $y^2\equiv x^3+ax+b\left(\mathrm{mod}n\right)$ over a finite field when n is a prime number, or over a finite ring when $n=pq$ is an RSA modulus. Other systems use singular cubic curves such as $y^2\equiv x^3+a{x}^2\left(\mathrm{mod}n\right)$ and $y^2+axy\equiv x^3\left(\mathrm{mod}n\right)$. In this paper, we present a method to find the small solutions of the former modular cubic equations. Our method is based on Coppersmith's technique and enables one to find the solutions $(x_0,y_0)$ when $\left|x_0{|}^3\right|y_0{|}^2$ is smaller than the modulus.