CCA-attack is possible in RSA, but how the decryption key $d$ is known to anyone

CCA-attack is possible in text-book RSA, but how the decryption key $d$ is known to anyone, as it is kept secret with receiver.

• Could you describe, mathematically, the attack you are talking about? Also, are you talking textbook (unpadded) RSA? – mikeazo Mar 16 '15 at 14:19
• Are you talking about Bleichenbacher's ACCA attack? My understanding is that it's a padding oracle attack against PKCS#1, which inherently affects RSA, rather than an attack against RSA itself. – Polynomial Mar 16 '15 at 14:19
• In RSA, except for side channel attacks, there's no known way the decryption key $d$ (or some equivalent information) can leak, no matter how disastrous the padding or the attack model, including CCA. – fgrieu Mar 16 '15 at 15:31