I manually set the RSA private key, given the private exponent and modulus. When I use this key to decrypt a message encrypted using a public key (also set with public exponent and modulus) seems to fail with a: "Need public exponent" message in OpenSSL.

Should RSA private key also require the public exponent for decryption, or is this specific to OpenSSL?

  • 2
    $\begingroup$ Most of the time the public exponent is a small value to aid the encryption speed. Common values I've seen are 3, 17 and 65537 (second and fourth number of Fermat) or sometimes any value under 0x10000. In such cases that case the public exponent should be easy to find. OpenSSL defaults to the fourth number of Fermat (0x010001) if I'm not mistaken. $\endgroup$
    – Maarten Bodewes
    Commented Sep 24, 2013 at 17:07
  • $\begingroup$ yes you are right. It is indeed 0x10001 in OpenSSL case. $\endgroup$
    – user907810
    Commented Sep 25, 2013 at 7:49

1 Answer 1


There's nothing inherent in the RSA decryption operation that requires the public exponent; it's just:

$P = C^d \mod N$

(or a slightly more complex version involving the CRT parameters)

So, strictly speaking, OpenSSL doesn't have to insist on it.

On the other hand, there are some protections against side channel attacks that involve the public modulus:

  • If they blind the message before performing RSA, the standard way to do this is to break this up into these operations:

    • Select a random $r$ and $r^{-1} \bmod N$

    • Compute $C_{blind} = r^e C \bmod N$

    • Compute $P_{blind} = C_{blind} ^ d \bmod N$

    • Compute $P = r^{-1} P_{blind} \bmod N$

  • To protect against differential fault analysis attacks (where they deliberately attempt to induce an error, and attempt to deduce information from the erroneous result); the standard way to protect against this is:

    • Compute $P = C^d \bmod N$

    • Compute $C_2 = P^e \bmod N$

    • Check if $C = C_2$; if not, discard the result and signal error.

Both of the above use the public exponent $e$ in their computations; hence they need to know it.

OpenSSL is able to do message blinding; I suspect that's why they always insist on it.

  • $\begingroup$ Blinding is also commonly used on Smart Card implementations to deter fault injection attacks. OpenSSL is certainly not special in that regard. $\endgroup$
    – Maarten Bodewes
    Commented Sep 24, 2013 at 17:10
  • $\begingroup$ @owlstead: I'm sorry if I implied that blinding or protection from DFA was OpenSSL specific; those are generic reasons why you might need the public exponent to perform the RSA private operation. $\endgroup$
    – poncho
    Commented Sep 24, 2013 at 18:06
  • $\begingroup$ I wasn't implying that, I just hinted that it is relatively common to the reader. And I +1'ed the answer and question of course. $\endgroup$
    – Maarten Bodewes
    Commented Sep 24, 2013 at 19:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.