[Wiener's result][1] ([doi][2], announced in [proceedings of crypto 1989][3]) has [been][4] [improved][5] [several][2] [times][6], and it is hard to tell how big the private exponent must be to be safe from further progress.

Also, the proposed technique, assuming $d>n^{1/3}$, requires a minimum of ${1\over3}\cdot\log_2(n)$ modular multiplications for the sparsest $d$ conceivable (a power of two), compared to say ${7\over6} \cdot\log_2(n)$ for classical RSA using [sliding window exponentiation][7].

Thus, when not using the [Chinese Remainder Theorem][8], the technique allows a speedup of a factor of $7\over2$ at best, which is less than the factor of nearly 4 allowed by the CRT; and when combining the technique with the CRT, one of the saving in the CRT (halving the size of the exponents) vanishes, thus the speedup is by a factor like $7\over4$ compared to [classical RSA with CRT][9]. That's not a huge speedup.

This shows the technique is risky, for a moderate speedup of the private key function (and a huge slowdown of the public key function compared to low-public-exponent RSA). If that kind of speed compromise is desirable, likely ECDSA is a better choice.

But this leaves the question unanswered.


  [1]: http://jannaud.free.fr/Fichiers/Travail/wiener.pdf
  [2]: https://doi.org/10.1109/18.54902
  [3]: https://doi.org/10.1007/3-540-46885-4_36
  [4]: https://doi.org/10.1007/3-540-48910-X_1
  [5]: https://doi.org/10.1007/3-540-44670-2_2
  [6]: https://eprint.iacr.org/2008/315.pdf
  [7]: https://en.wikipedia.org/wiki/Exponentiation_by_squaring#Sliding_window_method
  [8]: https://en.wikipedia.org/wiki/Chinese_Remainder_Theorem
  [9]: https://www.di-mgt.com.au/crt_rsa.html