Return to Answer

First, you have a typo in your question. Wiener's attack works if $\log(d) < 0.25 \log(N)$. This is not the best possible attack. "Boneh and Durfee" improved the result to $\log(d) < 0.292 \log(N)$.

I'm not aware of any better result, but that does not mean such results do not exist. In particular, it is quite unclear whether it would help an attacker to know that the Hamming weight of the private key is small.

Generally, it is very risky to use these corner cutting techniques. There are countless proposals for speeding up RSA by generating the private key in a particular way that already.

A good overview over the topic is Alexander May's thesis. This thesis is a few years old, but does nicely show what kind of attacks are possible, and more importantly how complex this subject is.

I would recommend not to use any RSA implemenation that tries to optimize performance by fiddling with the secret key.

First, you have a typo in your question. Wiener's attack works if $\log(d) < 0.25 \log(N)$. This is not the best possible attack. "Boneh and Durfee" improved the result to $\log(d) < 0.292 \log(N)$.

I'm not aware of any better result, but that does not mean such results do not exist. In particular, it is quite unclear whether it would help an attacker to know that the Hamming weight of the private key is small.

Generally, it is very risky to use these corner cutting techniques. There are countless proposals for speeding up RSA by generating the private key in a particular way that already.

A good overview over the topic is Alexander May's thesis. This thesis is a few years old, but does nicely show what kind of attacks are possible, and more importantly how complex this subject is.

I would recommend not to use any RSA implemenation that tries to optimize performance by fiddling with the secret key.

First, you have a typo in your question. Wiener's attack works if log(d) < 0.25 log(N). This is not the best possible attack. "Boneh and Durfee" improved the result to log(d) < 0.292 log(N).

I'm not aware of any better result, but that does not mean such results do not exist. In particular, it is quite unclear whether it would help an attacker to know that the Hamming weight of the private key is small.

Generally, it is very risky to use these corner cutting techniques. There are countless proposals for speeding up RSA by generating the private key in a particular way that already.

A good overview over the topic is Alexander May's thesis. This thesis is a few years old, but does nicely show what kind of attacks are possible, and more importantly how complex this subject is.

I would recommend not to use any RSA implemenation that tries to optimize performance by fiddling with the secret key.

First, you have a typo in your question. Wiener's attack works if $\log(d) < 0.25 \log(N)$. This is not the best possible attack. "Boneh and Durfee" improved the result to $\log(d) < 0.292 \log(N)$.

I'm not aware of any better result, but that does not mean such results do not exist. In particular, it is quite unclear whether it would help an attacker to know that the Hamming weight of the private key is small.

Generally, it is very risky to use these corner cutting techniques. There are countless proposals for speeding up RSA by generating the private key in a particular way that already.

A good overview over the topic is Alexander May's thesis. This thesis is a few years old, but does nicely show what kind of attacks are possible, and more importantly how complex this subject is.

I would recommend not to use any RSA implemenation that tries to optimize performance by fiddling with the secret key.

First, you have a typo in your question. Wiener's attack works if log(d) < 0.25 log(N). This is not the best possible attack. Boneh and Durfee improved the result to log(d) < 0.292 log(N). I'm not aware of any better result, but that does not mean such results do not exist. In particular, it is quite unclear whether it would help an attacker to know that the Hamming weight of the private key is small.

Generally, it is very risky to use these corner cutting techniques. There are countless proposals for speeding up RSA by generating the private key in a particular way that already. A good overview over the topic is Alexander May's thesis. This thesis is a few years old, but does nicely show what kind of attacks are possible, and more importantly how complex this subject is.

I would recommend not to use any RSA implemenation that tries to optimize performance by fiddling with the secret key.

First, you have a typo in your question. Wiener's attack works if log(d) < 0.25 log(N). This is not the best possible attack. "Boneh and Durfee" improved the result to log(d) < 0.292 log(N).

I'm not aware of any better result, but that does not mean such results do not exist. In particular, it is quite unclear whether it would help an attacker to know that the Hamming weight of the private key is small.

Generally, it is very risky to use these corner cutting techniques. There are countless proposals for speeding up RSA by generating the private key in a particular way that already.

A good overview over the topic is Alexander May's thesis. This thesis is a few years old, but does nicely show what kind of attacks are possible, and more importantly how complex this subject is.

I would recommend not to use any RSA implemenation that tries to optimize performance by fiddling with the secret key.