Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I manually set the RSA private key, given the private exponent and modulus. When I use this key to decrypt a message encrypted using a public key (also set with public exponent and modulus) seems to fail with a: "Need public exponent" message in OpenSSL.

Should RSA private key also require the public exponent for decryption, or is this specific to OpenSSL?

share|improve this question
Most of the time the public exponent is a small value to aid the encryption speed. Common values I've seen are 3, 17 and 65537 (second and fourth number of Fermat) or sometimes any value under 0x10000. In such cases that case the public exponent should be easy to find. OpenSSL defaults to the fourth number of Fermat (0x010001) if I'm not mistaken. –  Maarten Bodewes - owlstead Sep 24 '13 at 17:07
yes you are right. It is indeed 0x10001 in OpenSSL case. –  user907810 Sep 25 '13 at 7:49

1 Answer 1

up vote 5 down vote accepted

There's nothing inherent in the RSA decryption operation that requires the public exponent; it's just:

$P = C^d \mod N$

(or a slightly more complex version involving the CRT parameters)

So, strictly speaking, OpenSSL doesn't have to insist on it.

On the other hand, there are some protections against side channel attacks that involve the public modulus:

  • If they blind the message before performing RSA, the standard way to do this is to break this up into these operations:

    • Select a random $r$ and $r^{-1} \bmod N$

    • Compute $C_{blind} = r^e C \bmod N$

    • Compute $P_{blind} = C_{blind} ^ d \bmod N$

    • Compute $P = r^{-1} P_{blind} \bmod N$

  • To protect against differential fault analysis attacks (where they deliberately attempt to induce an error, and attempt to deduce information from the erroneous result); the standard way to protect against this is:

    • Compute $P = C^d \bmod N$

    • Compute $C_2 = P^e \bmod N$

    • Check if $C = C_2$; if not, discard the result and signal error.

Both of the above use the public exponent $e$ in their computations; hence they need to know it.

OpenSSL is able to do message blinding; I suspect that's why they always insist on it.

share|improve this answer
Blinding is also commonly used on Smart Card implementations to deter fault injection attacks. OpenSSL is certainly not special in that regard. –  Maarten Bodewes - owlstead Sep 24 '13 at 17:10
@owlstead: I'm sorry if I implied that blinding or protection from DFA was OpenSSL specific; those are generic reasons why you might need the public exponent to perform the RSA private operation. –  poncho Sep 24 '13 at 18:06
I wasn't implying that, I just hinted that it is relatively common to the reader. And I +1'ed the answer and question of course. –  Maarten Bodewes - owlstead Sep 24 '13 at 19:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.