Exposing an RSA Private Key Given a Small Fraction of its Bits

We show that for low public exponent rsa, given a quarter of the bits of the private keyan adversary can recover the entire private key. Similar results (though not as strong) areobtained for larger values of e. For instance, when e is a prime in the range [N1=4; N1=2],half the bits of the private key suffice to reconstruct the entire private key. Our resultspoint out the danger of partial key exposure in the rsa public key system.1 IntroductionLet N = pq be an rsa modulus...