The Attack on RSA with Small Private Key and Primes Sharing Least-Significant Bits

Wiener M. Cryptanalysis of short RSA secret exponents[J].IEEE Trans. on Information Theory.1990, 36(3):553-558[2]Boneh D and Durfee G. Cryptanalysis of RSA with privatekey d less than N0[J].292. IEEE Trans. on Information Theory.2000, 46(4):1339-1349[3]Coppersmith D. Finding a small root of a univariatemodular equation. Eurocrypt 96, Saragossa, Spain, 1996,LNCS 1070: 155-165.[4]Coppersmith D. Finding a small root of a bivariate integerequation; factoring with high bits known. Eurocrypt 96,Saragossa, Spain, 1996, LNCS 1070: 178-189.[5]Coppersmith D. Finding small solutions to small degreepolynomials. CalC 2001, Providence, RI, USA, 2001, LNCS2146: 178-189.[6]Sun H M, Yang W C, and Laih C S. On the design of RSAwith short secret exponent. Asiscrypt 1999, Singapore, 1999,LNCS 1716: 150-164.[7]Durfee G and Nguyen P Q. Cryptanalysis of the RSAschemes with short secret exponent from Asiscrypt99.Asiscrypt 2000, Kyoto, Japan, 2000, LNCS 1976: 14-29.[8]Steinfeld R and Zheng Y L. An advantage of low-exponentRSA with modulus primes sharing least significantbits.CT-RSA 2001, San Francisco, CA, USA, 2001, LNCS2020: 52-62.[9]Steinfeld R and Zheng Y L. On the security of RSA withprimes sharing least significant bits[J].Applicable Algebra inEngineering Communication and Computing.2004, 15(3):179-200[10]Weger B D. Cryptanalysis of RSA with small primedifference. Applicable Algebra in EngineeringCommunication and Computing, 2003, 13: 17-28.[11]Lenstra A, Lenstra H, and Lovasz L. Factoring Polynomialswith rational coefficients[J].Mathematiche Annalen.1982, 261:515-534[12]Howgrave-Graham N. Finding small roots of univariatemodular equations revisited. Cryptography and Coding,UK, 1997, LNCS 1355: 131-142.