Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working on attacks on RSA and came across the M. Weiner attack.

The limit for $d$ in order for the attack to apply is $d <= (\frac{1}{3})N^{0.25}$. The paper states that Boneh and Durfee improved this limit… but to what? What's the limit they reach for the attack to still apply?

share|improve this question
I'd expect you to do more research on your own before asking here (on this site we expect you to do a significant amount of research before asking). In the future, one way to answer this sort of thing on your own is to do a literature search. – D.W. May 31 '14 at 2:11
up vote 2 down vote accepted

Quoting the abstract:

Abstract: We show that if the private exponent d used in the RSA system is less than $N^{0.292}$ then the system is insecure. This is the first improvement of an old result of Wiener showing that when $d < N^{0.25}$ RSA is insecure. We hope our approach can be used to eventually improve the bound to $d < N^{0.5}$.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.