A new attack on RSA with a composed decryption exponent

In this paper, we consider an RSA modulus N = pq, where the prime factors p, q are of the same size. We present an attack on RSA when the decryption exponent d is in the form d = Md1 + d0 where M is a given positive integer and d1 and d0 are two suitably small unknown integers. In 1999, Boneh and Durfee presented an attack on RSA when d < N. When d = Md1 + d0, our attack enables one to overcome Boneh and Durfee’s bound and to factor the RSA modulus.