Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I've been looking at the weakness with plain/textbook RSA, where the same message is encrypted and sent to multiple destinations. In this case, it is possible to recover the message.

Given that an attacker then knows the values of $m$, $c$, $e$ and $n$ in the following equation, is there any extensions which allows them to recover $d$?

$c = m^e \mod n$

share|improve this question
add comment

1 Answer

No, an attack against RSA without padding that let one recover messages does not, as far as we know, degenerate into leaking a working private exponent $d$, or factoring $n$. In fact, even unlimited access to a decryption oracle performing $c\mapsto m=c^d\bmod n$ for any $c$ will not allow that either.

To back up the above, see this survey by Dan Boneh where it is Open Problem 1.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.