Understanding the "cube-root math" behind an RSA signature forgery
Look at it this way; consider the value of:

$(2^{1019} - N * 2^{34} / 3)^3$

Using the binomial expansion, we see that it equal to:

$(2^{1019})^3 - 3 * (2^{1019})^2 * N * 2^{34}/3 + 3 * 2^{1019} * (N * 2^{34} / 3)^2 - (N * 2^{34} / 3)^3$

or (simplifying):

$2^{3057} - N * 2^{2072} + G$

where $G = N^2/3 * 2^{1087} - N^3/27 * 2^{102} &lt; 2^{2072}$ for the value of $N$ we are interested in.

And, so, because the cube of $2^{1019} - N * 2^{34} / 3$ is $2^{3057} - N * 2^{2072} + G$, that means the cube root of $2^{3057} - N * 2^{2072} + G$ is $2^{1019} - N * 2^{34} / 3$