Abstract
A well-known attack on RSA with low secret-exponent d was given by Wiener about 15 years ago. Wiener showed that using continued fractions, one can efficiently recover the secret-exponent d from the public key (N,e) as long as d < N 1/4. Interestingly, Wiener stated that his attack may sometimes also work when d is slightly larger than N 1/4. This raises the question of how much larger d can be: could the attack work with non-negligible probability for d=N 1/4 + ρ for some constant ρ > 0? We answer this question in the negative by proving a converse to Wiener’s result. Our result shows that, for any fixed ε > 0 and all sufficiently large modulus lengths, Wiener’s attack succeeds with negligible probability over a random choice of d < N δ (in an interval of size Ω(N δ)) as soon as δ > 1/4 + ε. Thus Wiener’s success bound d<N 1/4 for his algorithm is essentially tight. We also obtain a converse result for a natural class of extensions of the Wiener attack, which are guaranteed to succeed even when δ > 1/4. The known attacks in this class (by Verheul and Van Tilborg and Dujella) run in exponential time, so it is natural to ask whether there exists an attack in this class with subexponential run-time. Our second converse result answers this question also in the negative.
Chapter PDF
Similar content being viewed by others
Keywords
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.
References
Blömer, J., May, A.: Low secret exponent RSA revisited. In: Silverman, J.H. (ed.) CaLC 2001. LNCS, vol. 2146, pp. 110–125. Springer, Heidelberg (2001)
Boneh, D., Durfee, G.: Cryptanalysis of RSA with private key d less than N 0.292. IEEE Trans. on Info. Theory 46(4), 1339–1349 (2000)
Dujella, A.: Continued Fractions and RSA with Small Secret Exponents. Tatra Mt. Math. Publ. (to appear), Available at http://www.math.hr/duje/papers1.html (2004)
Hardy, G.H., Wright, E.M.: An Introduction to the Theory of Numbers. Oxford University Press, London (1965)
LeVeque, W.J.: Fundamentals of Number Theory. Dover Publications, New York (1996)
Lovász, L.: An Algorithmic Theory of Numbers, Graphs and Convexity. Society for Industrial and Applied Mathematics, Philadelphia (1986)
Rosser, J.B., Schoenfeld, L.: Approximate Formulas for Some Functions of Prime Numbers. Illinois. J. Math. 6, 64–94 (1962)
Verheul, E., van Tilborg, H.: Cryptanalysis of ‘Less Short’ RSA Secret Exponents. Applicable Algebra in Engineering, Communication and Computing 8, 425–435 (1997)
Vinogradov, I.M.: Elements of Number Theory. Dover Publications, New York (1954)
Wiener, M.J.: Cryptanalysis of Short RSA Secret Exponents. IEEE Trans. On Information Theory 36, 553–558 (1990)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2005 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Steinfeld, R., Contini, S., Wang, H., Pieprzyk, J. (2005). Converse Results to the Wiener Attack on RSA. In: Vaudenay, S. (eds) Public Key Cryptography - PKC 2005. PKC 2005. Lecture Notes in Computer Science, vol 3386. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-30580-4_13
Download citation
DOI: https://doi.org/10.1007/978-3-540-30580-4_13
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-24454-7
Online ISBN: 978-3-540-30580-4
eBook Packages: Computer ScienceComputer Science (R0)