Partial key exposure attacks on CRT-RSA: Better cryptanalysis to full size encryption exponents

Abstract

There have been several papers which studied the security of CRT-RSA when some bits of CRT-exponents dp and dq are known to attackers. At first, Blömer and May (Crypto 2003) proposed attacks which used the most or the least significant bits of either dp or dq. Next, Sarkar and Maitra (ACNS 2009) generalized the scenario and proposed an attack which used the most significant bits of both dp and dq. Recently, Lu et al. (ACNS 2014) proposed improved attacks for the same scenario as Blömer and May. These works showed that public RSA modulus can be factored when e