There's nothing inherent in the RSA decryption operation that requires the public exponent; it's just:
$P = C^d \mod N$
(or a slightly more complex version involving the CRT parameters)
So, strictly speaking, OpenSSL doesn't have to insist on it.
On the other hand, there are some protections against side channel attacks that involve the public modulus:
If they blind the message before performing RSA, the standard way to do this is to break this up into these operations:
Select a random $r$ and $r^{-1} \bmod N$
Compute $C_{blind} = r^e C \bmod N$
Compute $P_{blind} = C_{blind} ^ d \bmod N$
Compute $P = r^{-1} P_{blind} \bmod N$
To protect against differential fault analysis attacks (where they deliberately attempt to induce an error, and attempt to deduce information from the erroneous result); the standard way to protect against this is:
Compute $P = C^d \bmod N$
Compute $C_2 = P^e \bmod N$
Check if $C = C_2$; if not, discard the result and signal error.
Both of the above use the public exponent $e$ in their computations; hence they need to know it.
OpenSSL is able to do message blinding; I suspect that's why they always insist on it.
0x10000
. In such cases that case the public exponent should be easy to find. OpenSSL defaults to the fourth number of Fermat (0x010001
) if I'm not mistaken. $\endgroup$