Abstract

This paper presents three new attacks on the RSA cryptosystem. The first two attacks work when k RSA public keys (N _i ,e _i ) are such that there exist k relations of the shape e _i x − y _i φ(N _i ) = z _i or of the shape e _i x _i  − yφ(N _i ) = z _i where N _i  = p _i q _i , φ(N _i ) = (p _i  − 1)(q _i  − 1) and the parameters x, x _i , y, y _i , z _i are suitably small in terms of the prime factors of the moduli. We show that our attacks enable us to simultaneously factor the k RSA moduli N _i . The third attack works when the prime factors p and q of the modulus N = pq share an amount of their least significant bits (LSBs) in the presence of two decryption exponents d ₁ and d ₂ sharing an amount of their most significant bits (MSBs). The three attacks improve the bounds of some former attacks that make RSA insecure.