Can the user get the private key from the encrypted and the plaintext data or does it make it easier for an attacker?

  • Welcome! Nice question, but you should not accept an answer that quickly. Other answers might come in later and might be even better, but an accepted answer might discourage other users from contributing their own answer.
    – not2savvy
    Jan 9, 2021 at 16:09

2 Answers 2


No, that would make no sense.

If a person could get the private key from encrypted data, that would be akin to locking something and leaving the key in the lock. Likewise, the decrypted message is the same - bit for bit - as the message before any encryption took place. Therefore, the message has no relation to the private key at all.

A few more details

There are several attacks on RSA that could allow an attacker to recover the private key, such as the low exponent attack. These attacks are mitigated by using proper parameters for RSA. This should be seen as "if RSA is used incorrectly, an attacker can calculate the private key". It is not a "feature" of the encryption algorithm, nor is it something that is easily done with some openssl command.

  • Does not answer the aspect of a known plain text.
    – not2savvy
    Jan 9, 2021 at 10:23
  • @not2savvy The question did not ask about known plaintexts at all.
    – user163495
    Jan 9, 2021 at 15:33
  • I think it does: "... from the encrypted and the plaintext data ..." - see also kelalaka's answer.
    – not2savvy
    Jan 9, 2021 at 16:05
  • @not2savvy "Can you get the private key from the plaintext data?" means something entirely different to me. Same old rule applies: Ask better questions, get better answers.
    – user163495
    Jan 9, 2021 at 20:17
  • Could you please explain what it means to you then? I read it as: if an attacker had both plain text and its encryption, would this give him any advantage over not having the plain text?
    – not2savvy
    Jan 10, 2021 at 1:42

What you asking is known as Known-Plaintext Attack or in short KPA. When RSA has properly implemented the answer is NO!.

Actually, the attackers don't need to capture and access the plaintext in public-key cryptography. In public-key cryptography, the encryption is free, since you know the public key of the target, that is the pair (e,n), then you can encrypt as many pairs as you want. Formally we call this access to Encryption Oracle is free.

RSA encryption is proven to be semantically secure if OAEP padding is used.

Semantic security

it must be infeasible for a computationally bounded adversary to derive significant information about a message (plaintext) when given only its ciphertext and the corresponding public encryption key.

The semantic security is equal to Ind-CPA ( indistinguishability under chosen-plaintext attack) and this is a stronger assumption than KPA.

In a chosen-plaintext attack the adversary can (possibly adaptively) ask for the ciphertexts of arbitrary plaintext messages

Of course, there were attacks on the RSA other than the factoring over the years. This article covers many of them;

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .