Low-Exponent RSA with Related Messages

. In this paper we present a new class of attacks against RSA with low encrypting exponent. The attacks enable the recovery of plaintext messages from their ciphertexts and a known polynomial relationship among the messages, provided that the ciphertexts were created using the same RSA public key with low encrypting exponent. 1 Introduction In this paper we present a new class of attacks against RSA [8] with low encrypting exponent. The attacks enable the recovery of plaintext messages from their ciphertexts and a known polynomial relationship among the messages, provided that the ciphertexts were created using the same RSA public key with low encrypting exponent. Our attacks differ from the low-exponent attacks described by Moore [6] and Hastad [5] and the common modulus attack identified by Simmons [10], which pertain only to ciphertexts encrypted under different public keys. Given encryptions of k messages under the same RSA public key with exponent e, together with knowledge of a..