  Rabin encryption and a secure ownership transfer protocol based on the
difficulty of factorization of a public key use a small public exponent. Such
encryption requires random number padding. The Coppersmith's shortpad attack
works effectively on short padding, thereby allowing an adversary to extract
the secret message. However, the criteria for determining the appropriate
padding size remains unclear. In this paper, we derived the processing-time
formula for the shortpad attack and determined the optimal random-padding size
in order to achieve the desired security.
