A new attack on RSA with two or three decryption exponents

Let N=pq be an RSA modulus, i.e. the product of two large unknown primes of equal bit-size. In this paper, we describe an attack on RSA in the presence of two or three exponents e _i with the same modulus N and satisfying equations e _i x _i ??(N)y _i =z _i , where ?(N)=(p?1)(q?1) and x _i , y _i , z _i are unknown parameters. The new attack is an extension of Guo’s continued fraction attack as well as the Blömer and May lattice-reduction basis attack.