Small Private Exponent Partial Key-Exposure Attacks on Multiprime RSA

Given knowledge of one or more of the primes in a multiprime RSA modulus we show that the private exponent can be recovered provided it is sufficiently small. In particular, we present a simple and efficient method that given v of the u primes dividing the modulus N recovers any private exponent d satisfying d < Nv/u− . When only one prime is known, this bound can be increased to approximately N 2) using Boneh & Durfee’s techniques for small private exponent attacks on RSA. We also present experimental data which shows that the attack becomes more costly with increasing number of primes in the modulus and increasing modulus sizes.