[格密码1]P7
用W_1,G_{1,2},W_1*W_2来构造格子
from Crypto.Util.number import *
from tqdm import tqdm
from libnum import *
n = 110697784133988071803253124431092603234028687101567047811203431433689306543322837414808117411806181193598553341878079973980865551938790090419082150555675782822484149943421418447579383449269148197087985041351210982545320569973241390962326458234562044133505940521052500278777242988196544039226173227204865907343
c = 3281096209929505523196793672137624804022934270452947405454462490250571524417033484978613243658208567511735641542935158434165363547355697159503378251318054879687577130170122911449101189974762808655638497967674004219512386442280269940950792767174561412932638740423542930763914255112354969122157915514816022159
e0 = 28562806554366667733480283991307446762365777397933141571728113235368201162305126722188842319240464207580134816039095093401651171977877327756351539588974913736802534970867173212883308325913939353140276201705478124488858328502643345172188729914731042179091733244225184522680724392375975935305371163502863968963
e1 = 28572469216883232254074869113744730984165641173439644880182528671699871929340616919028955398474678696802739685594548793470261306125219888911330937557582939811068530294470712859439149735950996866732508004061234613146407591546995439312326450834903885979660916965052092661398640105827442036234500556755520316031
a = 5/14
D = diagonal_matrix(ZZ, [1, int(n^(1+a)), int(n^(1/2)), n]) # 对角线矩阵 用来平衡
mat = [
[e0*e1, 0, 0, 0],
[-e1*n, e1, 0, 0],
[-e0*n, -e0, e0, 0],
[ n^2, 0, -n, 1]
]
M = Matrix(ZZ,mat)
M = M*D
hh = M.LLL()
L = vector(ZZ,hh[0])
x = L * M^(-1)
# print(x)
# x * M = L
phi = int((x[2]//x[3])*e0)
d = inverse_mod(65537, phi)
m = power_mod(c, d, n)
print(long_to_bytes(m))