Skip to content
All tools
Modern cryptoRuns locallyNo account

Wiener’s attack on small RSA private exponents

Recover a small private exponent d from n and e using continued fractions. Works whenever d is below roughly the fourth root of n.

Open in ctfpal

A small private exponent makes decryption fast, which is why someone might choose one. Wiener showed that when d < n^(1/4)/3, that choice leaks the key entirely - and the giveaway is visible in the public key, because a small d forces a correspondingly enormous e.

The continued fraction insight

From e*d = 1 mod phi(n) it follows that e/n is a very close approximation to d's counterpart over phi(n). The convergents of the continued fraction expansion of e/n therefore contain the correct k/d pair. Enumerate the convergents, test each candidate d by decrypting a known value or by checking that the implied phi yields integer roots for p and q, and stop at the one that works. There are only a few dozen convergents to try.

  • Precondition: e is large - typically comparable in magnitude to n rather than the usual 65537.
  • Bound: works for d < n^(1/4)/3. Boneh-Durfee extends this to roughly d < n^0.292 using lattice reduction.
  • Cost: milliseconds, regardless of key size.

Part of a module

5. RSA and the parameters that break it

Work the RSA decision tree - small modulus, close primes, tiny exponent, shared modulus - and learn to read a key for its weakness.

Practise on real challenges

Go deeper

  • The RSA attack decision treeRSA challenges are not solved by knowing every attack - they are solved by reading the parameters and picking the one attack that matches. A decision tree from e and n to Fermat, Wiener, Hastad, common modulus, and the oracle attacks.

Related tools