0
$\begingroup$

starting from the fact that there are different attacks on RSA, based on the starting situation, for example there are different studies, on attacks that find the private key having the freedom of an original arbitration text. But I was wondering this, in this situation: you have several plaintext texts and their encryption, you also have the public key (because you use RSA to authenticate) is it possible some form of attack to find the private key?

$\endgroup$
1
  • 3
    $\begingroup$ "there are different studies on attacks that find the private key having the freedom of an original arbitration text"; do you have a reference of these studies? While there are published attacks that recover a plaintext from a ciphertext (based on a flaw in the padding), I haven't heard of such an attack being able to recover the private key. $\endgroup$
    – poncho
    Commented Sep 18, 2021 at 19:11

1 Answer 1

2
$\begingroup$

you have several plaintext texts and their encryption, you also have the public key, is it possible some form of attack to find the private key?

It depends in particular on how the plaintexts/ciphertexts pairs are chosen. As an extreme example, if a plaintext is the private exponent $d$ (which the statement does not forbid), then yes it's possible to find the private key $(n,d)$ from the public key $(n,e)$ and that plaintext $d$.

On the other hand, for whatever secure asymmetric encryption scheme, if the plaintexts are prepared independently of the key¹, then no it's not possible to find the private key². Argument: In a secure asymmetric scheme, it's impossible to find a working private key from the public key alone. And since adversaries knowing the public key can construct plaintexts/ciphertexts pairs with any plaintexts prepared independently of the key they see fit, giving them such plaintexts/ciphertexts pairs in addition of the public key can't help them much.

The above argument applies to RSA encryption as practiced, which is secure. It's conclusion also holds for textbook RSA encryption $m\mapsto m^e\bmod n$ with secure choice of the key (even though it's not a secure asymmetric encryption scheme), because in all forms of RSA with secure choice of the key it's impossible to find a working private key from the public key alone, and the rest of the argument applies.

Thus in RSA with secure choice of the key, if the plaintexts in the question are prepared independently of the key¹, then it's not possible to find the private key².


¹ This can be generalized to: independently of portions of the key other than the public key.

² Or more generally a working private key.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.