Skip to Main Content
The equation of the title arose in the proposed signature scheme of Ong-Schnorr-Shamir. The large integers and are given and we are asked to find any solution . It was believed that this task was of similar difficulty to that of factoring the modulus we show that, on the contrary, a solution can easily be found if and are relatively prime to . Under the assumption of the generalized Riemann hypothesis, a solution can be found by a probabilistic algorithm in arithmetical steps on -bit integers. The algorithm can be extended to solve the equation for quadratic integers and to solve in integers the equation .