RSA Attacks

Common ways RSA goes wrong:

1. Small e + no padding: if m < n^(1/e), c = m^e is integer-cube-rootable. Famous Coppersmith. Modern e = 65537 makes this hard but not safe without padding.

2. Common modulus attack: if two parties share n with different e, an attacker who has both ciphertexts can recover m. NEVER share moduli.

3. Bleichenbacher's PKCS#1 v1.5 attack: padding oracle. Server says "valid" or "invalid" → attacker iteratively recovers plaintext. Modern fix: constant-time padding check + don't reveal padding errors.

4. Timing attacks: if exponentiation isn't constant-time, attacker measures time to deduce private key bits. Defenses: constant-time exponentiation, blinding (multiply by random factor before exponentiation).

5. Weak randomness: predictable primes → factorable n. 2012: researchers found ~0.4% of internet TLS keys shared a prime due to bad RNG seeding.

6. Side channels: power analysis, EM emanation. Smart cards mitigate via blinding + masking.

7. Quantum: Shor's algorithm breaks RSA in polynomial time on a sufficient quantum computer. Post-quantum: Kyber, Dilithium are NIST-standardized replacements (2024).

For new code: use Ed25519 / X25519 (faster, smaller, fewer footguns) or RSA-PSS-OAEP if you must.

Library guidance:

• Python: cryptography library
• Java: java.security
• Node: crypto
• Rust: rsa crate

Don't roll your own RSA in production. The math is simple; the implementation pitfalls are not.