I've been looking at the weakness with plain/textbook RSA, where the same message is encrypted and sent to multiple destinations. In this case, it is possible to recover the message.

Given that an attacker then knows the values of $m$, $c$, $e$ and $n$ in the following equation, is there any extensions which allows them to recover $d$?

$c = m^e \mod n$


1 Answer 1


No, an attack against RSA without padding that let one recover messages does not, as far as we know, degenerate into leaking a working private exponent $d$, or factoring $n$. In fact, even unlimited access to a decryption oracle performing $c\mapsto m=c^d\bmod n$ for any $c$ will not allow that either.

To back up the above, see this survey by Dan Boneh where it is Open Problem 1.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.