Is there an upper bound to the private exponent in RSA? In the RSA algorithm, we choose $p$ and $q$ as prime numbers and we select a value $e$ which is coprime to $\varphi(pq)=(p-1)(q-1)$.

Then we calculate $d:=e^{-1}\bmod\varphi(pq)$.

My question is: What could be the maximum value of $d$? Is there an upper bound to it?
Mathematically speaking, there is no upper bound on the private exponent in RSA: assuming $d$ is a valid private exponent, then the valid exponents are the set of $d'=d+k\cdot\lambda(p\cdot q)$ with $k\in\mathbb Z$, where $\lambda(p\cdot q)=\operatorname{lcm}(p-1,q-1)$ since $p$ and $q$ are distinct primes; this set is unbounded.

If you compute $d$ as an integer with $d\equiv e^{-1}\pmod{\varphi(p\cdot q)}$, then by definition $d$ verifies $e\cdot d-1$ multiple of $\varphi(p\cdot q)$, and is unbounded. If you compute $d$ as the integer $d=e^{-1}\bmod\varphi(p\cdot q)$, by a common definition of that notation, $d$ is additionally non-negative and less than $\varphi(p\cdot q)$, which is then an upper bound.

In practice, available memory and time, existing software, or standards, limit the value of $d$. A most common standard, PKCS#1, requires $0&lt;d&lt;n$; the FIPS&nbsp;186-4 standard requires $2^{\lceil\log_2(N)\rceil/2}&lt;d&lt;\operatorname{lcm}(p-1,q-1)$; some implementations allow $0&lt;d&lt;256^{\lceil\log_{256}(p\cdot q)\rceil}$; $d\ge\varphi(p\cdot q)$ is unusual.