= Solution
All calculations are in <modular arithmetic> modulo $n$. Expand the two expressions appearing in the proposed quotient:
$$
\begin{aligned}
c_2+2c_1-1&\equiv(m+1)^3+2m^3-1\\
&=3m^3+3m^2+3m,\\
c_2-c_1+2&\equiv(m+1)^3-m^3+2\\
&=3m^2+3m+3.
\end{aligned}
$$
The first is exactly $m$ times the second. Multiplication by the assumed <modular multiplicative inverse> therefore gives
$$
\boxed{m\equiv(c_2+2c_1-1)(c_2-c_1+2)^{-1}\pmod n.}
$$
The representative in $\{0,\ldots,n-1\}$ is the <plaintext>. This <RSA related-message attack> uses a relation between messages to turn two cubic equations into a linear equation; it does not recover the <private key> or factor $n$ in the invertible case.
Back to article page
