New Partial Key Exposure Attacks on RSA

Abstract. In 1998, Boneh, Durfee and Frankel [4] presented several attacks on RSA when an adversary knows a fraction of the secret key bits. The motivation for these so-called partial key exposure attacks mainly arises from the study of side-channel attacks on RSA. With side channel attacks an adversary gets either most significant or least significant bits of the secret key. The polynomial time algorithms given in [4] only work provided that the public key e is smaller than N 1 2 . It was raised as an open question whether there are polynomial time attacks beyond this bound. We answer this open question in the present work both in the case of most and least significant bits. Our algorithms make use of Coppersmith’s heuristic method for solving modular multivariate polynomial equations [8]. For known most significant bits, we provide an algorithm that works for public exponents e in the interval [N 1 2 , N0.725 ]. Surprisingly, we get an even stronger result for known least signi...

• Type: Conference
• Year: 2003
• Where: CRYPTO
• Authors: Johannes Blömer, Alexander May
• Keywords: CRYPTO 2003, Key Exposure Attacks, Partial Key Exposure, Significant Bits