What is the minimum and maximum value of an RSA private exponent? Is it possible to calculate the minimum and maximum value of the private exponent for an RSA key, for example for a 1024 key size? In other words, what is the range of values in which the private exponent can occur?
In summary:


Modern practice is to fix a small public exponent $e$ such as $e=2^{(2^4)}+1=65537$, then choose a public modulus $N$ of $\text{nlen}$ bits (the key size) with large random prime factors compatible with $e$, then compute the RSA private exponent $d$ from that. With near certainty, that $d$ will be at least $\text{nlen}/2$-bit. That can be used as a minimum for other methods. For RSA1024, that's $d$ at least 512-bit.
If given a choice, compute $d=e^{-1}\bmod\lambda(N)$, and it's bit size will be strictly lower than the key size. For RSA1024, that's $d$ at most 1023-bit. See Carmichael function for the definition of $\lambda(N)$.
Otherwise, it is still recommendable to keep $d&lt;N$ for compatibility with common software. For RSA1024, that implies $d$ at most 1024-bit.


Note: by the mathematical definition, a positive integer $m$ is $b$-bit when $2^{b-1}\le m&lt;2^b$. Computer implementations often measure the size of integers differently: adding one for sign, or/and rounding up to the next multiple of some power of two, or/and adding more overhead for headers.

Caveat: RSA1024 might be vulnerable right now to well-funded and competent adversaries. For new applications, it has been deprecated for a decade at least, and RSA2048 is considered OK only till 2020 or 2030, depending on source (see the Keylength website).



Minimum value

Negative $d$ work, but at the price of an extra inversion modulo $N$ at each use, thus have little practical interest. We exclude negative $d$ in the following.

When $e$ is fixed or chosen then $d$ computed (as is modern practice), the lower bound for $d$ is commonly $d&gt;2^{\text{nlen}/2}$ (e.g. in FIPS&nbsp;186-4), or $d&gt;0$, or just unspecified. In fact, $d$ will typically be few (if any) bit(s) less than $\text{nlen}$, and $d&lt;2^{\text{nlen}-64}$ should seldom occur. $d&gt;2^{\text{nlen}/2}$ is met with overwhelming probability for any sound key generation procedure that computes $d$ without attempt to minimize it, or in other words where:


$d$ is computed from the public exponent $e$ and the prime factors of the public modulus $N$ (these factors are noted $p$ and $q$ is the common case of $N=p\,q$; or more generally $r_i$, with $N=\prod r_i$, and $p=r_1$, $q=r_2$ ).
and $e$ and the $r_i$ are chosen independently of each others, except for meeting the requirements: the $r_i$ are suitably large random primes, $\gcd((r_i-1),e)=1$ (implying $e$ odd), and $e\ge3$.
Exceptions to the above:


Sometime it is additionally checked that the $r_i$ are suitably different from each others. For safely large $r_i$ and good random generator, such check never fails.
From a mathematical standpoint, $e$ can safely be chosen as $N$, in which case it depends on the $r_i$. That is the case in Christopher Cocks's 1973 cryptosystem, see here for bibliography.



In any case, $d$ must be much larger than $N^{0.292}$ in order to avoid an attack by Dan Boneh and Glenn Durfee, Cryptanalysis of RSA with Private Key $d$ Less than $N^{0.292}$, in proceedings of Eurocrypt 1999. A safer lower bound is $d&gt;\sqrt N$, or the aforementioned $d&gt;2^{\text{nlen}/2}$. That consideration is relevant at least when $d$ is chosen, as in in R.L.&nbsp;Rivest, A.&nbsp;Shamir, and L.&nbsp;Adleman's A Method for Obtaining Digital Signatures and Public-Key Cryptosystem (in CACM, 1978).



Maximum value

The upper bound for $d$ depends on context.


From a mathematical standpoint, there is no limit: any $d$ with $\lambda(N)$ dividing $e\,d-1$ is acceptable, where (for distinct $r_i$ ) $\lambda(N)$ is computed as the Least Common Multiple of the $(r_i-1)$. We can add any multiple of $\lambda(N)$ to any valid $d$, and obtain another valid $d$.
In a PKCS#1 context, we must additionally have $0&lt;d&lt;N$, which implies $d&lt;2^{\text{nlen}}$. That leaves at least two possible $d$, sometime more.
Some definitions of RSA state that $d=e^{-1}\bmod\varphi(N)$, where (for distinct $r_i$ ) $\varphi(N)=\prod(r_i-1)$, see Euler's totient. This implies $d&lt;\varphi(N)$, which implies $d&lt;N$ and $d&lt;2^{\text{nlen}}$. For usual RSA with two factors, that method of computing $d$ implies $d&lt;N-2\sqrt N$, thus the upper bound is slightly lower than $d&lt;N$ in PKCS#1.
In a FIPS&nbsp;186-4 context, it is required that $d=e^{-1}\bmod\lambda(n)$. That is the smallest positive $d$, and it is often markedly lower than with the previous method. We get $d&lt;\lambda(N)$, thus $d&lt;\varphi(N)/2$, thus $d&lt;2^{\text{nlen}-1}$, and for two factors $d&lt;N/2-\sqrt N$.