The paper 'Why One Should Also Secure RSA Public Key Elements' describes an attack where an adversary can fully recover a private key by injecting faults into the modulus before exponentiation takes place in a signing operation. Two modes are described for this attack, one where the adversary has no knowledge of how the moduli are modified by a fault, requiring 60,000 faults for the recovery of a 2048-bit private exponent, and another one where they have a dictionary of possible moduli, reducing that number to at least 28 faults.
However, if the adversary was able to modify the modulus however they like instead of relying on random modifications from different faults, would it be possible for them to reduce that number even further? If so, how could they do that, for example, are there special values for moduli that make this attack recover more exponent bits at a time? Or would the attack largely be the same, only removing the need to guess what the faulty moduli are?
