[Cryptography] Finding the least significant bit of RSA secret exponent from few signatures?
Georgi Guninski
guninski at guninski.com
Thu Sep 8 03:29:19 EDT 2016
I suppose this is well known and useless (if true).
The least significant bit of RSA secret exponent $d$ can be found
with high probability (and sometimes unconditionally) from signatures
of random stuff very fast. Get experimental support assuming H_i^d mod n are
the signatures, H_i is the padded hash (if this is not known from the
signature, ignore this mail).
Is this well known and useless?
More information about the cryptography
mailing list