Converse results to the Wiener attack on RSA A wellknown attack on RSA with low secretexponent d was given by Wiener about 15 years ago. Wiener showed that using continued fractions, one can efficiently recover the secretexponent d from the public key (N,e) as long as d   0? We answer this question in the negative by proving a converse to Wienerxe2x80x99s result. Our result shows that, for any fixed e u003e 0 and all sufficiently large modulus lengths, Wienerxe2x80x99s attack succeeds with negligible probability over a random choice of d   14  e. Thus Wienerxe2x80x99s success bound d  14. The known attacks in this class (by Verheul and Van Tilborg and Dujella) run in exponential time, so it is natural to ask whether there exists an attack in this class with subexponential runtime. Our second converse result answers this question also in the negative.

Estimating Gaps in Martingales and Applications to CoinTossing: Constructions and Hardness Consider designing a distributed cointossing protocol for n processors such that the probability of heads is X0 in 0,1, and an adversary can reset one processor to change the distribution of the final outcome. For X012, in the noncryptographic setting, Blumu0027s majority protocol is frac1sqrt2pi n insecure. For computationally bounded adversaries and any X0 in 0,1, the protocol of Moran,Naor,Segev (2009) is only O(1n) insecure. In this paper, we study discretetime martingales (X0,X1,..,Xn) such that Xi in 0,1, for all i in 0,..,n, and Xn in 0,1. In particular, for any X0 in 0,1, we construct martingales that yield frac12sqrtfracX_0(1X_0)n insecure cointossing protocols with nbit communication; irrespective of the number of bits required to represent the output distribution. Note that for sufficiently small X0, we achieve higher security than Moran et alu0027s protocol even against computationally unbounded adversaries. For X012, our protocol requires only 40% of the processors to obtain the same security as the majority protocol. We introduce a new inductive technique that uses geometric transformations to estimate the large gaps in these martingales. For any X0 in 0,1, we show that there exists a stopping time T such that mathbbEX_TX_T1geqfrac2sqrt2n1cdot X_0(1X_0). The inductive technique also constructs martingales that demonstrate the optimality of our bound  we construct optimal martingales such that any T hasmathbbEX_TX_T1leqfrac1sqrtncdotsqrtX_0(1X_0). Our lowerbound holds for all X0 in 0,1; while the previous bound of Cleve,Impagliazzo (1993) exists only for positive constant X0. Our approach only employs elementary techniques and avoids the complex probabilistic tools inherent to the approaches of Cleve,Impagliazzo (1993) and Beimel,Haitner,Makriyannis,Omri (2018).