RSA Decryption with Private Key but no public exponent

Question

I manually set the RSA private key, given the private exponent and modulus. When I use this key to decrypt a message encrypted using a public key (also set with public exponent and modulus) seems to fail with a: "Need public exponent" message in OpenSSL.

Should RSA private key also require the public exponent for decryption, or is this specific to OpenSSL?

Answer 1

There's nothing inherent in the RSA decryption operation that requires the public exponent; it's just:

$P = C^d \mod N$

(or a slightly more complex version involving the CRT parameters)

So, strictly speaking, OpenSSL doesn't have to insist on it.

On the other hand, there are some protections against side channel attacks that involve the public modulus:

• If they blind the message before performing RSA, the standard way to do this is to break this up into these operations:

  • Select a random $r$ and $r^{-1} \bmod N$

  • Compute $C_{blind} = r^e C \bmod N$

  • Compute $P_{blind} = C_{blind} ^ d \bmod N$

  • Compute $P = r^{-1} P_{blind} \bmod N$

• To protect against differential fault analysis attacks (where they deliberately attempt to induce an error, and attempt to deduce information from the erroneous result); the standard way to protect against this is:

  • Compute $P = C^d \bmod N$

  • Compute $C_2 = P^e \bmod N$

  • Check if $C = C_2$; if not, discard the result and signal error.

Both of the above use the public exponent $e$ in their computations; hence they need to know it.

OpenSSL is able to do message blinding; I suspect that's why they always insist on it.