Re: [Cfrg] e=3 a bad idea?

Hi Steve,

a BCP recommending RSA exponents sounds like a great idea to me.  I  
share your concerns with e=3, though I'm not an expert in that area -  
for all I know that exponent may be regarded as acceptable under some  
circumstances.   If so, it would be valuable to document those  
conditions, so I'm in favor of a BCP regardless.

FWIW, there was a question about e=3 last year about whether or not  
that parameter choice was OK to recommend for use in RFC 4359 (http:// 
www1.ietf.org/mail-archive/web/cfrg/current/msg00597.html).  It was  
mentioned that it might be OK to use e=3 with OAEP, but IIRC there  
was no discussion on this point (either for or against).

David

--

p.s. - a couple more attacks, which won't work against PKCS#1 AFAIK  
but which support your suggestion:

Don Coppersmith: Small Solutions to Polynomial Equations, and Low  
Exponent RSA Vulnerabilities. J. Cryptology 10(4): 233-260 (1997)

and

http://citeseer.ist.psu.edu/coppersmith96lowexponent.html

On Sep 19, 2006, at 8:21 AM, Steven M. Bellovin wrote:

> Is it worth having a short BCP suggesting that e=3 is in general a bad
> idea?  I've seen several different attacks that all work against low
> exponents, most recently Bleichenbacher's new attack on PKCS #1 v1.5.
> (Two others are
> http://www.rsasecurity.com/rsalabs/staff/bios/bkaliski/publications/ 
> hash-firewalls/kaliski-hash-firewalls-ct-rsa-2002.pdf
> and http://www.cs.ucdavis.edu/~franklin/pubs/low_rsa.ps ).  Yes,  
> all of
> these require other factors to be effective, but what's the next  
> attack?
>
> 		--Steven M. Bellovin, http://www.cs.columbia.edu/~smb
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@ietf.org
> https://www1.ietf.org/mailman/listinfo/cfrg

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg