# Attacks on RSA with partially known plaintext

I know modulus $N$, public exponent $e$ and have some crypted messages $c_i$, $c_i = m_i^e mod N$. I know something about each $m_i$: they have a sequence of bytes BAADF00D at offset $t$.

Is there any kind of attack which helps me to recover any $m_i$ or even $p$ and $q$ used to make $N$?

I thought about an Oracle attack, but the papers I read discussed Oracles with MSB or LSB bits. What with bits in the middle of a message?

• I would hope that finding $p$ and/or $q$ would be harder than finding $m$ :P But beside that I guess that this may not be solvable if BAADF00D can be prefixed or appended by any sufficiently random encoding that isn't vulnerable against Oracle attacks. Proving this for a particular (padding ) scheme is of course the Achilles heel if my assumption holds. – Maarten Bodewes May 27 '17 at 13:15