5
$\begingroup$

Suppose we have $(n,e)$ and the ciphertext $c$ where the public exponent $e$ is of the same length, 1023-bit, as the modulus $n$. It is also assumed that the factors of $n$ are balanced. The message is decrypted using CRT with small exponents but unknown to us, attacker. Is it possible to decrypt $c$ in such a scenario?

I have checked the Wiener's attack on https://en.wikipedia.org/wiki/Wiener%27s_attack but the example requires those parameters that are not available to us in this situation.

Improve this question
$\endgroup$
2
  • $\begingroup$ Do you have an idea of how small are $d_p=d\bmod(p-1)$ and $d_q=d\bmod(q-1)$ ? $\endgroup$
    – fgrieu ♦
    Commented Feb 26, 2016 at 19:50
  • $\begingroup$ Unfortunately, it is not given that how small the private exponents are. $\endgroup$
    – user110219
    Commented Feb 26, 2016 at 21:15

1 Answer 1

Reset to default
3
$\begingroup$

There is a paper by Daniel Bleichenbacher and Alexander May called "New attacks on RSA with small secret CRT-Exponents" (you can find it under http://www.cits.rub.de/imperia/md/content/may/paper/crt.pdf). They are not quite able to break the RSA under your assumptions. I'm not aware of better results, but I didn't look at the list of articles citing this paper.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.