Comment on “Efficient and Secure Outsourcing Scheme for RSA Decryption in Internet of Things”

Internet-of-Things (IoT) devices have grown in popularity over the past few years. The RSA public-key cryptographic primitive is time consuming for resource-constrained IoT. Recently, Zhang et al. proposed a two-party outsourcing protocol between a client and a server for RSA decryption in IoT. It relies on the Chinese remainder theorem as proposed by Quisquater and Couvreur in 1982 and is very efficient. We show that their protocol does not achieve the claimed security guarantees: 1) the (secret) decryption exponent, the plaintext, and the factorization of the RSA modulus are revealed to a passive adversary and 2) a malicious server can make the client accept an (invalid) value of its choice as the result of the delegated computation.