Cryptanalysis of Short Secret Exponents Modulo RSA Primes

Abstract

An attack on the short secret exponent dq modulo a larger RSA prime q is presented. When dq ＜(2q/3q)1/2 and e ＜ (pq)1/2, we can discover dq from the continued fraction of e/pq, where e and pq denote the public exponent and the modulus, respectively. Furthermore, the same attack on unbalanced RSA is also given. According to our analysis, unbalanced RSA will be broken if dq ＜(2/3)1/2q4/9.