0
$\begingroup$

I know Håstad's broadcast attack when e = 3, but what if e = getPrime(randint(350))?

$\endgroup$
  • $\begingroup$ Please indicate if Marc Ilugna's answer is acceptable to you (and accept it if it does). Currently there are some close votes for this question, indicating that you should provide more detail (or indicate what you have done to solve the question yourself). You can edit the question if you have more information on that. $\endgroup$ – Maarten Bodewes Jul 5 at 11:59
1
$\begingroup$

If you have $e$ ciphertexts for the same message, then the attack is the same, you just have to apply the CRT with $e$ values, then computing the $e$'th root of the resulting value might need some work. And this is assuming that all moduli are relatively prime of course. If that's not the case, there is $i,j$ and $gcd(N_i, N_j) \neq 1$. So you can factor one of $N_i$ or $N_j$ and decrypt the message. Lastly, depending on the size of $e$ and that of the $N_i$ you might want to investigate attacks on "small private exponents" such as Wiener's attack or from Boneh et al.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.