2 ms·
Although I too am no cryptographer, I believe there is an additional constraint where the public exponent needs to be small. Also the paper I read says these co
by Godel_unicode 5y ago
Although I too am no cryptographer, I believe there is an additional constraint where the public exponent needs to be small. Also the paper I read says these conditions can lead to discovery of the key in "polynomial time" which doesn't necessarily mean fast.
- bawolff 5y agoI'm again talking out of my depth, so take this with salt, but my understanding is the small public exponent is for the sterotyped message version of that attack not the partial key recovery variant. Looking at this page https://www.cryptologie.net/article/222/implementation-of-coppersmith-attack-rsa-attack-using-lattice-reductions/ https://www.cryptologie.net/article/222/implementation-of-co... it looks like the exponent isn't even an input to the algorithm when doing key recovery