PricingLoginStart free
Cryptology Academy · Lesson

Textbook RSA & Why It Is Insecure

Demonstrate malleability, small-exponent attacks, and e=3 vulnerabilities.

Lesson 1 of 413 steps

Textbook RSA & Why It Is Insecure is a free Cryptology Academy lesson on CoddyKit. This is lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, and your progress syncs across the web and the CoddyKit app. The Cryptology Academy course includes 4 lessons in total.

Welcome

Textbook RSA (raw modular exponentiation) has multiple critical vulnerabilities. In this lesson we explore each attack and understand why padding is not optional.

Determinism Attack

Textbook RSA is deterministic: Enc(M) always produces the same C. An attacker can encrypt candidate messages and compare with the target ciphertext. Breaks confidentiality of small message spaces.

Malleability

RSA is multiplicatively malleable: Enc(M1) × Enc(M2) = Enc(M1×M2) mod n. An attacker can multiply a ciphertext by Enc(2) = 2^e, forcing the plaintext to double — without knowing the key.

Small Message Attack (e=3)

If e=3 and M < n^(1/3): C = M^3 mod n = M^3 (no modular reduction). Taking the cube root of C gives M directly. Always use padded RSA and ensure M is large enough.

Coppersmith's Attack

Coppersmith showed: if e=3 and the attacker knows a large fraction of M (e.g., M = YYYY-MM-DD...[unknown portion]), polynomial factoring can recover the unknown bits. Short padded plaintexts are vulnerable.

Håstad's Broadcast Attack

If the same M is sent to 3 recipients each with e=3: by CRT, C1,C2,C3 determine M^3 mod (n1×n2×n3). Taking cube root directly gives M. Never encrypt the same plaintext with e=3 to multiple recipients.

Franklin-Reiter Related Message Attack

If two messages M1 and M2 are linearly related (M2 = aM1+b) and both encrypted with the same key, the relationship can be exploited to recover M1 and M2. Padding with random bytes prevents this.

Common Modulus Attack

If two servers share n but use different e1,e2 with GCD(e1,e2)=1, and both encrypt the same M: M can be recovered using extended Euclidean. Never share moduli between entities.

Timing Attack on RSA Decryption

RSA decryption time depends on the private key bits (square-and-multiply varies by bit). Kocher's 1996 timing attack measured decryption times to recover private keys. Solution: blinding.

RSA Blinding Defense

Before decryption: C' = C × r^e mod n (multiply by random blinding factor r^e). Compute M' = C'^d mod n. M = M' × r^(-1) mod n. Timing now depends on r, not M — attacker sees only noisy measurements.

The Fundamental Fix: Randomized Padding

All textbook RSA attacks share a common fix: randomized padding. PKCS#1 v1.5 added randomness. OAEP added provable security. With proper padding, none of the above attacks work.

Quick Check

What property of textbook RSA allows an attacker to test if a ciphertext contains a specific message?
Answer it in the interactive lesson

Recap

Textbook RSA is dangerously insecure. Next we study PKCS#1 v1.5 padding — its design, use, and the Bleichenbacher attack that broke it.
Free to start

Learn Cryptology Academy with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses
67
Lessons
261
Start learning freeView the full course

Frequently Asked Questions

Is the “Textbook RSA & Why It Is Insecure” lesson free?

Yes — the full text of “Textbook RSA & Why It Is Insecure” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO. The Cryptology Academy course includes 4 lessons in total.

What will I learn in “Textbook RSA & Why It Is Insecure”?

Demonstrate malleability, small-exponent attacks, and e=3 vulnerabilities. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 1 of 4.

How long does the “Textbook RSA & Why It Is Insecure” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Textbook RSA & Why It Is Insecure
  2. PKCS#1 v1.5 Padding & Bleichenbacher
  3. OAEP: Optimal Asymmetric Encryption Padding
  4. RSA-PSS for Digital Signatures
← Back to Cryptology Academy