How to attack RSA-CRT with large public exponent?

Suppose we have $(n,e)$ and the ciphertext $c$ where the public exponent $e$ is of the same length, 1023-bit, as the modulus $n$. It is also assumed that the factors of $n$ are balanced. The message is decrypted using CRT with small exponents but unknown to us, attacker. Is it possible to decrypt $c$ in such a scenario?

I have checked the Wiener's attack on https://en.wikipedia.org/wiki/Wiener%27s_attack but the example requires those parameters that are not available to us in this situation.

• Do you have an idea of how small are $d_p=d\bmod(p-1)$ and $d_q=d\bmod(q-1)$ ? – fgrieu Feb 26 '16 at 19:50
• Unfortunately, it is not given that how small the private exponents are. – user110219 Feb 26 '16 at 21:15

1 Answer

There is a paper by Daniel Bleichenbacher and Alexander May called "New attacks on RSA with small secret CRT-Exponents" (you can find it under http://www.cits.rub.de/imperia/md/content/may/paper/crt.pdf). They are not quite able to break the RSA under your assumptions. I'm not aware of better results, but I didn't look at the list of articles citing this paper.