4
$\begingroup$

Are there any publicly available stats regarding how often are specific public exponents used for RSA keys?

Presumably, 65537 is the most commonly used of them, but I'd like to get some notion of which other values one should care about when testing for compatibility.

| improve this question | |
$\endgroup$
  • 2
    $\begingroup$ Since I asked this question, I discovered the censys.io project that provides statistics for server certificates. If my queries were correct, 98.7% of RSA certificates use the "65537" exponent, the second place is the "3" with 0.5%. I found that information useful, even though this obviously doesn't give a complete answer (and I personally was in fact more interested about client certificates). $\endgroup$ – Max Sep 29 '18 at 16:33
  • 1
    $\begingroup$ You might want to post that as an answer, even if it's not complete. $\endgroup$ – Ilmari Karonen Oct 28 '18 at 15:51
  • $\begingroup$ @Max How did you query? And please convert your comment into an answer. $\endgroup$ – kelalaka Oct 29 '18 at 20:27
  • $\begingroup$ Taking statistics from one application domain and using them in another is potentially risky, because the public exponent depends mainly on the software used to create the key and the selection of software used to create the key depends on the application the key will be used for. A single popular program making an unconventional choice of exponent can lead to that exponent being quite common in one application while remaining very uncommon in others. $\endgroup$ – Peter Green May 8 '19 at 2:22
1
$\begingroup$

I couldn't find any references to any statistics, however:

All Fermat primes $${3, 5, 17, 257, 65537, 4294967297, 18446744073709551617, … }$$ could be used while regarding the use a proper padding scheme. There is no known weakness for any short or long public exponent for RSA, as long as the public exponent is "correct" (i.e. relatively prime to p-1 for all primes p which divide the modulus).

So why is $ e = 65537$ used most commonly?

Using $e=65537$ (or higher) in RSA is an extra precaution against a variety of attacks that are possible when bad message padding is used. But it's not too large so that it would greatly impact performance speed ($e = 3$ is around 8x faster than $e = 65537$).

So in short: $e = 65537$ is most commonly used as a comprimise, because it's reasonably fast and secure.

Related answers for more details:

| improve this answer | |
$\endgroup$
  • $\begingroup$ since there is no known weakness, Fermat number's are selected because they require less modular multiplications. e.g. 65537=10000000000000001 $\endgroup$ – kelalaka Sep 28 '18 at 21:19
  • $\begingroup$ I'm not an expert, but I believe not all Fermat primes are equally good - the small ones are known to make some attacks much more realistic, especially "e=3". For example, see papers: [1] Daniel R. L. Brown "A Weak-Randomizer Attack on RSA-OAEP with e = 3" 2005; [2] Don Coppersmith "Small Solutions to Polynomial Equations, and Low Exponent RSA Vulnerabilities" 1997; [3] Dan Boneh "Exposing an RSA Private Key Given a Small Fraction of its Bits" 1998. AFAIK, all such attacks require some additional weaknesses besides just using a low public exponent, but still it's a warning sign I think. $\endgroup$ – Max Sep 29 '18 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.