New Partial Key Exposure Attacks on RSA Revisited

At CRYPTO 2003, Blömer and May presented new partial key exposure attacks against RSA. These were the first known polynomial-time partial key exposure attacks against RSA with public exponent e > N . Attacks for known most significant bits and known least significant bits were presented. In this work, we extend their attacks to multi-prime RSA. For r-prime RSA, these result in the first known partial key attacks for public exponent e > N. As with other attacks on RSA that have been extended to multi-prime RSA, we show that these attacks are weakened with each additional prime added to the RSA modulus. Some experimental bounds on the fraction of bits needed to mount the attacks are presented for some common RSA modulus sizes and small lattice dimensions. When using Coppersmith’s method for finding small roots of multivariate modular polynomials in cryptographic applications, it is often heuristically assumed that the polynomials resulting from the lattice basis reduction are algebraically independent. For some of Blömer and May’s attacks we have observed that this is not the case. Interestingly, even when the polynomials are algebraically dependent in these attacks we are still able to recover the private exponent by simply removing the common factors of the polynomials before computing any resultants.