The equation of the title arose in the proposed signature scheme of Ong-Schnorr-Shamir. The large integers

and

are given and we are asked to find any solution

. It was believed that this task was of similar difficulty to that of factoring the modulus

we show that, on the contrary, a solution can easily be found if

and

are relatively prime to

. Under the assumption of the generalized Riemann hypothesis, a solution can be found by a probabilistic algorithm in

arithmetical steps on

-bit integers. The algorithm can be extended to solve the equation

for quadratic integers
![K, M \\in {\\bf Z}[\\sqrt {d}]](/images/tex/5846.gif)
and to solve in integers the equation

.