A variant of Wiener's attack on RSA with small secret exponent

Abstract

To speed up the RSA decryption one may try to use small secret decryption exponent d. The choice of a small d is especially interesting when there is a large difference in computing power between two communicating devices. However, in 1990, Wiener showed that if d < n0.25, where n = pq is the modulus of the cryptosystem, then there exist a polynomial time attack on the RSA. He showed that d is the denominator of some convergent pm/qm of the continued fraction expansion of e/n, and therefore d can be computed efficiently from the public key (n, e) .