1
$\begingroup$

Say I selected two large primes p and q for RSA and computed my public key (e, n=pq) and my private key (d).

Now, I was careless and compromised my private key (d). p and q were not leaked. Taking into account that (e, n) were already public knowledge, would it be safe to generate a new key pair with the same p and q or are they somehow compromised by the leaking of the private key?

If it would not be safe, how could someone compute p and q from my public-private key pair?

Improve this question
$\endgroup$
  • 1
    $\begingroup$ In practice almost everything in this century uses PKCS1 privatekey format which stores p,q explicitly as well as d-mod-pm1, d-mod-qm1, qinv-mod-p for CRT, so they're already compromised. But that's an answer for security.SX not crypto.SX. $\endgroup$ – dave_thompson_085 Nov 27 '19 at 5:04
4
$\begingroup$

No, it is not safe.

There are several methods to compute $p$ and $q$ from $n$, $e$ and $d$. See appendix C of this document.

Improve this answer
$\endgroup$
  • 1
    $\begingroup$ Very useful link, thanks! For completeness I would quote the two mentioned methods in the answer, in case the link dies at any point in the future. $\endgroup$ – user2891462 Nov 26 '19 at 13:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.