# Fault encryption attack on RSA [duplicate]

How to recover plaintext, if we know public key(RSA), correctly encrypted text and text encrypted with faulty public key, where one bit is changed?

• Do we have any information about what bit is changed, in particular if it lies in the public exponent, or the public modulus? – fgrieu Mar 10 '15 at 17:11
• @fgrieu, if the variation holds on a single bit of exponent, letting public modulus inchanged, the recovering the input message can be simplifyed. Observe $\frac{C^{'}}{C}=m^{e^{'}-e} \; mod \; N$ gives precious informations. – Robert NACIRI Mar 10 '15 at 20:19

## 1 Answer

It's interesting to mention another type of faulty attack on RSA public modulus. Up to now the majority of research papers are about how to break the system after a fault attack in regular or CRT mode.

An interesting approach (among all the surveys of fault attacks on RSA), is describerd in this paper http://www.normalesup.org/~tibouchi/papers/talk-modulusfault.pdf where the authors try to exploit the CRT combination after a faulty attack on the public modulus. The obtained system is solved by using basic Lattice reduction technics to recover the RSA secret parametrers, which is more powerfull.