RSA small-private-exponent problem

The problem asks how far RSA can remain vulnerable when its private exponent is small. A 2026 unrefereed preprint claims an unconditional recovery result reaching $N^{11/42-\varepsilon}$, beyond the previous provable boundary.

Known results

• Wiener’s continued-fraction attack recovers the private exponent below roughly $N^{1/4}$.
• Boneh–Durfee’s lattice-based bound reaches approximately $N^{0.292}$, but depends on a heuristic assumption rather than an unconditional proof.
• Practical lattice attacks reported in 2023 reach about $N^{0.285}$ to $N^{0.292}$ for tested moduli.

2026 claimed improvement

The ePrint paper Provable Recovery of RSA Private Exponents below $N^{11/42-\varepsilon}$ claims an unconditional theorem for the unrestricted small-private-exponent problem. The scan found no independent exposition, referee report, counterexample, or withdrawal, so the claimed resolution remains unverified.

Current status (as of August 2026): The $N^{11/42-\varepsilon}$ result is claimed in an unrefereed preprint, while the claim remains unverified and the true general boundary is open.