Founding and Former Series Editors:

It is well-known that there is an efficient method for decrypt-ing/signing with RSA when the secret exponent d is small modulo p− 1and q − 1. We call such an exponent d a small CRT-exponent. It is one of the major open problems in attacking RSA whether there exists a polynomial time attack for small CRT-exponents, i.e. a result that can be considered as an equivalent to the Wiener and Boneh-Durfee bound for small d. At Crypto 2002, May presented a partial solution in the case of an RSA modulus N = pq with unbalanced prime factors p and q.Based on Coppersmith’s method, he showed that there is a polynomialtime attack provided that q < N. We will improve this bound toq < N . Thus, our result comes close to the desired normal RSA casewith balanced prime factors. We also present a second result for balanced RSA primes in the case that the public exponent e is significantly smaller than N . More precisely, we show that there is a polynomial time attack ifdp, dq ≤ min{(N/e) 5 , N 4 }. The method can be used to attack twofast RSA variants recently proposed by Galbraith, Heneghan, McKee,