I found this recent paper The Wiener Attack on RSA Revisited: A Quest for the Exact Bound, which reported a new bound $d\le \frac 1 {\sqrt[4]{18}} N^\frac 1 4$. Is this well accepted in the cryptanalysis research community?

With a Python script, I personally verified the d revealed from the given (N,e) in Section 4 (page 392~395) of this paper, it worked indeed. The interesting thing is that even though this d was generated with $\lambda(N)=LCM(p-1,q-1)$, the Wiener Attack function could successfully reveal this d with the assumption of $ed = 1 \pmod {\phi(N)}$. How does this work?

import gmpy2

def solve_rsa_primes(s: int, m: int) -> tuple:
    """ Solve RSA prime numbers (p, q) from the quadratic equation
    p^2 - s * p + m = 0 with the formula p = s/2 +/- sqrt((s/2)^2 - m)

        s - sum of primes (p + q)
        m - product of primes (p * q)
    Return: (p, q)
    half_s = s >> 1
    tmp = gmpy2.isqrt(half_s ** 2 - m)
    return int(half_s + tmp), int(half_s - tmp)

def wiener_attack(n: int, e: int) -> (int, int, int):
    """ Wiener's Attack on RSA public key cryptosystem
        N - RSA modulus N = p*q
        e - RSA public exponent
        d - RSA private exponent

    cfe = cf_expansion(e, n) # Convert e/n into a continued fraction
    cvg = cf_convergent(cfe) # Get all of its convergents

    for k, d in cvg:
        # Check if k and d meet the requirements
        if k == 0 or d % 2 == 0 or (e * d) % k != 1:

        # assume ed ≡ 1 (mod ϕ(n))
        phi = (e * d - 1) // k 
        p, q = solve_rsa_primes(n - phi + 1, n)
        if n == p * q:
            return d

    return None

N = int(

e = int(

d = wiener_attack(N, e)
assert not d is None, "Wiener's attack failed!"
print("d =", d)

new_b = int(gmpy2.root(N, 4)/gmpy2.root(18, 4))
print("new_b =", new_b)
assert d <= new_b

old_b = int(gmpy2.root(N, 4)/3)
print("old_b =", old_b)
assert d > old_b

1 Answer 1


Is this $\frac 1{\sqrt[4]{18}}N^\frac1 4$ bound well accepted in the cryptanalysis research community?

I see no reason why there would be a doubt. However, the exact bound for Wiener's attack is not the subject of much scrutiny by the cryptanalysis research community, because:

  • Dan Boneh & Glenn Durfee's Cryptanalysis of RSA with Private Key $d$ Less than $N^{0.292}$ (in proceedings of Eurocrypt 1999) factors $N$ for $d$ significantly larger that Wiener's attack can, making Wiener's attack interesting only by it's relative simplicity.
  • Practice must use $d$ comfortably above these thresholds for security reasons. Thus it can only give a modest speed advantage compared to using the CRT method for the RSA private key operation, and then only if using this method, where essentially it lowers $d_p$ and $d_q$ (and, for two moduli of about equal size, makes $d_p=d_q$, which is far from reassuring from a security standpoint).
  • Practice uses small $e$ because it is widely considered safe and leads to fast public key operation, which is desirable. It follows $d$ is with practical certainty far above Wiener's $N^{0.25}$ and Boneh & Durfee's $N^{0.292}$ bound (unless we use a modulus with at least 4 prime factors and have these factors exactly one above some multiple of a large prime, with the later at least worrying from a security standpoint).

This does not answer the "how does this work" part of the Q.

  • $\begingroup$ Do you have answer to my 2nd question regarding using $\phi(N)$ to solve it but d was actually generated by $\lambda(N)$ ? $\endgroup$
    – Zixi Sean
    Nov 9, 2023 at 19:03
  • $\begingroup$ If it was used a small $d$ (which again, is never the case in practice), it would be $e$ that's generated from $d$ as $d^{-1}\bmodλ(N)$ or $d^{-1}\bmodϕ(N)$, not $d$ generated from $e$. With probability like $1/3$, $ϕ$ and $λ$ yield the same $e$, which would be a first reason why Wiener's attack works. That occurs because $ϕ(N)=gλ(N)$ with $g=\gcd(p-1,q-1)$ typically small (often $2$, $4$, $6$). I'm totally ready to believe Wiener's attack works more often than that, but sorry, I have no clear explanation of why. $\endgroup$
    – fgrieu
    Nov 9, 2023 at 22:00
  • $\begingroup$ "With probability like 1/3, ϕand λ yield the same 𝑒" - so in this case, we would get ed = 1 (mod ϕ) and ed = 1 (mod λ) , right? - where did this 1/3 come from? Any mathmatical proof? $\endgroup$
    – Zixi Sean
    Nov 9, 2023 at 22:50
  • 1
    $\begingroup$ For the lowest positive such $e$, yes. My $1/3$ estimate is derived from simulation over 1000 tests. We could find it mathematically. 1) Estimate the distribution of $g=\gcd(p-1,q-1)$ for large random primes $p$ and $q$ about the same size with $\gcd(p-1,d)=1=\gcd(q-1,d)$ for predetermined random odd $d$. $g=2$ is most common, followed by $4$ and $6$. 2) For given $g$, the probability that the values derived using $ϕ$ and $λ$ are equal is next to $1/g$. We sum these over the aforementioned distribution to find (a good estimate of) the probability that $ϕ$ and $λ$ yield the same $𝑒$. $\endgroup$
    – fgrieu
    Nov 10, 2023 at 8:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.