What is the minimum and maximum value of an RSA private exponent?
In summary:


Modern practice is to fix a small public exponent $e$ such as $e=2^{(2^4)}+1=65537$, then choose a public modulus $N$ of $\text{nlen}$ bits (the key size) with large random prime factors compatible with $e$, then compute the RSA private exponent $d$ from that. With near certainty, that $d$ will be at least $\text{nlen}/2$-bit. That can be used as a minimum for other methods. For RSA1024, that's $d$ at least 512-bit.
If given a choice, compute $d=e^{-1}\bmod\lambda(N)$, and it's bit size will be strictly lower than the key size. For RSA1024, that's $d$ at most 1023-bit. See Carmichael function for the definition of $\lambda(N)$.
Otherwise, it is still recommendable to keep $d&lt;N$ for compatibility with common software. For RSA1024, that implies $d$ at most 1024-bit.


Note: by the mathematical definition, a positive integer $m$ is $b$-bit when $2^{b-1}\le m&lt;2^b$. Computer implementations often measure the size of integers differently: adding one for sign, or/and rounding up to the next multiple of some power of two, or/and adding more overhead for headers.

Caveat: RSA1024 might be vulnerable right now to well-funded and competent adversaries. For new applications, it has been deprecated for a decade at least, and RSA2048 is considered OK only till 2020 or 2030, depending on source (see the Keylength website).



Minimum value

Negative $d$ work, but at the price of an extra inversion modulo $N$ at each use, thus have little practical interest. We exclude negative $d$ in the following.

When $e$ is fixed or chosen then $d$ computed (as is modern practice), the lower bound for $d$ is commonly $d&gt;2^{\text{nlen}/2}$ (e.g. in FIPS&nbsp;186-4), or $d&gt;0$, or just unspecified. In fact, $d$ will typically be few (if any) bit(s) less than $\text{nlen}$, and $d&lt;2^{\text{nlen}-64}$ should seldom occur. $d&gt;2^{\text{nlen}/2}$ is met with overwhelming probability for any sound key generation procedure that computes $d$ without attempt to minimize it, or in other words where:


$d$ is computed from the public exponent $e$ and the prime factors of the public modulus $N$ (these factors are noted $p$ and $q$ is the common case of $N=p\,q$; or more generally $r_i$, with $N=\prod r_i$, and $p=r_1$, $q=r_2$ ).
and $e$ and the $r_i$ are chosen independently of each others, except for meeting the requirements: the $r_i$ are suitably large random primes, $\gcd((r_i-1),e)=1$ (implying $e$ odd), and $e\ge3$.
Exceptions to the above:


Sometime it is additionally checked that the $r_i$ are suitably different from each others. For safely large $r_i$ and good random generator, such check never fails.
From a mathematical standpoint, $e$ can safely be chosen as $N$, in which case it depends on the $r_i$. That is the case in Christopher Cocks's 1973 cryptosystem, see here for bibliography.



In any case, $d$ must be much larger than $N^{0.292}$ in order to avoid an attack by Dan Boneh and Glenn Durfee, Cryptanalysis of RSA with Private Key $d$ Less than $N^{0.292}$, in proceedings of Eurocrypt 1999. A safer lower bound is $d&gt;\sqrt N$, or the aforementioned $d&gt;2^{\text{nlen}/2}$. That consideration is relevant at least when $d$ is chosen, as in in R.L.&nbsp;Rivest, A.&nbsp;Shamir, and L.&nbsp;Adleman's A Method for Obtaining Digital Signatures and Public-Key Cryptosystem (in CACM, 1978).



Maximum value

The upper bound for $d$ depends on context.


From a mathematical standpoint, there is no limit: any $d$ with $\lambda(N)$ dividing $e\,d-1$ is acceptable, where (for distinct $r_i$ ) $\lambda(N)$ is computed as the Least Common Multiple of the $(r_i-1)$. We can add any multiple of $\lambda(N)$ to any valid $d$, and obtain another valid $d$.
In a PKCS#1 context, we must additionally have $0&lt;d&lt;N$, which implies $d&lt;2^{\text{nlen}}$. That leaves at least two possible $d$, sometime more.
Some definitions of RSA state that $d=e^{-1}\bmod\varphi(N)$, where (for distinct $r_i$ ) $\varphi(N)=\prod(r_i-1)$, see Euler's totient. This implies $d&lt;\varphi(N)$, which implies $d&lt;N$ and $d&lt;2^{\text{nlen}}$. For usual RSA with two factors, that method of computing $d$ implies $d&lt;N-2\sqrt N$, thus the upper bound is slightly lower than $d&lt;N$ in PKCS#1.
In a FIPS&nbsp;186-4 context, it is required that $d=e^{-1}\bmod\lambda(n)$. That is the smallest positive $d$, and it is often markedly lower than with the previous method. We get $d&lt;\lambda(N)$, thus $d&lt;\varphi(N)/2$, thus $d&lt;2^{\text{nlen}-1}$, and for two factors $d&lt;N/2-\sqrt N$.