The public exponent e is the RSA parameter published with the modulus n. It drives modular exponentiation for encryption and signature verification, while the corresponding private exponent d remains secret. section 8.3.2 section 9.7
RSA key generation chooses e between 3 and φ(n) − 1 so that gcd(e, φ(n)) = 1, then computes d as the multiplicative inverse of e modulo φ(n). section 8.3.2
Equation 8.9
\[\begin{aligned} \begin{aligned} \text{PubKey}_{\text{Alice}} &= (n, e) \\ \text{PrivKey}_{\text{Alice}} &= (d) \end{aligned} \label{equation:alice-rsa-keypair} \end{aligned}\]The key-pair equation identifies (n, e) as the public key and d as the private key; encryption raises m to e modulo n. section 8.3.2
A worked RSA parameter choice
With p = 193 and q = 727, RSA obtains n = 140311 and φ(n) = 139392. Choosing e = 17653 and computing its modular inverse gives d = 77533. section 8.3.2
Treat the exponent as a security-sensitive configuration, not merely an optimization setting:
- Fixed Fermat-prime exponents such as 65537 speed exponentiation and generally ensure a sufficiently large private exponent. section 9.6 section 8.5
- An exponent of e = 3 is not automatically insecure, but it becomes dangerous when PKCS#1 v1.5 signature padding is insufficiently validated. section 9.6.2 section 9.7
- Verify every PKCS#1 v1.5 padding byte between the header and separator is FF; skipping this check enables signature forgery. section 9.6.2 section 9.7
