wedding date. we were careworn because ambe

This question is someway correlated to Breaking RSA with P,Q LSB bits but more specific.

I would like to use LLL to fully reconstruct P,Q given some LSB bits of P and Q in an arbitrary base B.

Let’s take RSA 100 and B=12 as example and sagemath as calculator:

# p,q solutions in base 10
# p = 37975227936943673922808872755445627854565536638199
# q = 40094690950920881030683735292761468389214899724061

# p,q solutions in base 12
# p = a47286415807831bb0a25b14a23454104019563226a61 
# q = ab6815aab9aba2042171397b1178227492a28b91b58025

# we have partial p,q LSB in base 12 (can be more digits if required)
p = a23454104019563226a61;
q = 178227492a28b91b58025;

# RSA-100
N = 1522605027922533360535618378132637429718068114961380688657908494580122963258952897654000350692006139;

a = p
# we have 21 known digits in base 12
X = 12^21
M = matrix([[X^2, 2*X*a, a^2], [0, X, a], [0, 0, N]])
B = M.LLL()
Q = B[0][0]*x^2/X^2+B[0][1]*x/X+B[0][2]
PR = a+Q.roots(ring=ZZ)[0][0]

where PR should be equal to P.

I’m not a sagemath or a lattice expert, but I would like to understand how to fix my calculations.

I guess that the lattice matrix is too small for the size of the problem and that something else should be adapted to let the calculation work for the Base 12.

I started from an example (https://latticehacks.cr.yp.to/rsa.html) that reconstruct a small number given the MSB.

Thanks in advance