Understanding the "cube-root math" behind an RSA signature forgery I'm trying to understand the math outlined in this paper on a RSA signature forgery attack. I understand it except for one aspect of how the cube root (that makes the forged signature) is computed.

On page 8, it's shown that this expression (the forged block that needs to be cube-rooted):
$\sqrt[3]{2^{3057} - N*2^{2072} + G}$

is supposed to be equivalent this one after its simplified:
$2^{1019} - (N * 2^{34}/3)$

It's not clear to me how the $2^{34}$ was determined in the second expression. It looks like everything's being divided by 3, but since the exponent $2072$ doesn't divide perfectly by 3, something was done to it. Can anyone explain?
Look at it this way; consider the value of:

$(2^{1019} - N * 2^{34} / 3)^3$

Using the binomial expansion, we see that it equal to:

$(2^{1019})^3 - 3 * (2^{1019})^2 * N * 2^{34}/3 + 3 * 2^{1019} * (N * 2^{34} / 3)^2 - (N * 2^{34} / 3)^3$

or (simplifying):

$2^{3057} - N * 2^{2072} + G$

where $G = N^2/3 * 2^{1087} - N^3/27 * 2^{102} &lt; 2^{2072}$ for the value of $N$ we are interested in.

And, so, because the cube of $2^{1019} - N * 2^{34} / 3$ is $2^{3057} - N * 2^{2072} + G$, that means the cube root of $2^{3057} - N * 2^{2072} + G$ is $2^{1019} - N * 2^{34} / 3$