Provable Recovery of RSA Private Exponents below $N^{11/42-\varepsilon}$

본문 미리보기

Wiener's continued-fraction attack gives the classical provable bound \(d0\), balanced RSA with \(e=\Theta(N)\) can be factored deterministically in polynomial time whenever \(d\leq N^{11/42-\varepsilon}\).