# RSA Decryption with Private Key but no public exponent

I manually set the RSA private key, given the private exponent and modulus. When I use this key to decrypt a message encrypted using a public key (also set with public exponent and modulus) seems to fail with a: "Need public exponent" message in OpenSSL.

Should RSA private key also require the public exponent for decryption, or is this specific to OpenSSL?

-
Most of the time the public exponent is a small value to aid the encryption speed. Common values I've seen are 3, 17 and 65537 (second and fourth number of Fermat) or sometimes any value under 0x10000. In such cases that case the public exponent should be easy to find. OpenSSL defaults to the fourth number of Fermat (0x010001) if I'm not mistaken. – Maarten Bodewes Sep 24 '13 at 17:07
yes you are right. It is indeed 0x10001 in OpenSSL case. – user907810 Sep 25 '13 at 7:49

There's nothing inherent in the RSA decryption operation that requires the public exponent; it's just:

$P = C^d \mod N$

(or a slightly more complex version involving the CRT parameters)

So, strictly speaking, OpenSSL doesn't have to insist on it.

On the other hand, there are some protections against side channel attacks that involve the public modulus:

• If they blind the message before performing RSA, the standard way to do this is to break this up into these operations:

• Select a random $r$ and $r^{-1} \bmod N$

• Compute $C_{blind} = r^e C \bmod N$

• Compute $P_{blind} = C_{blind} ^ d \bmod N$

• Compute $P = r^{-1} P_{blind} \bmod N$

• To protect against differential fault analysis attacks (where they deliberately attempt to induce an error, and attempt to deduce information from the erroneous result); the standard way to protect against this is:

• Compute $P = C^d \bmod N$

• Compute $C_2 = P^e \bmod N$

• Check if $C = C_2$; if not, discard the result and signal error.

Both of the above use the public exponent $e$ in their computations; hence they need to know it.

OpenSSL is able to do message blinding; I suspect that's why they always insist on it.

-
Blinding is also commonly used on Smart Card implementations to deter fault injection attacks. OpenSSL is certainly not special in that regard. – Maarten Bodewes Sep 24 '13 at 17:10
@owlstead: I'm sorry if I implied that blinding or protection from DFA was OpenSSL specific; those are generic reasons why you might need the public exponent to perform the RSA private operation. – poncho Sep 24 '13 at 18:06
I wasn't implying that, I just hinted that it is relatively common to the reader. And I +1'ed the answer and question of course. – Maarten Bodewes Sep 24 '13 at 19:55