4

If $m^{ed} \bmod n = m$ for message $m$, public key $e$ and private key $d$, then adding any integer multiple of $n$ to $m^{ed}$ still equals $m$ modulo $n$.

Supposing it exists, how do I find an equivalent key, d', such that $m^{ed'} = m^{ed} + kn$?

1 Answers1

7

The formula at the heart of RSA is:

$$x^{\lambda(n)} = 1 \pmod n$$

where $\lambda$ is the Carmichael function. In the case of two-prime RSA it's $\operatorname{lcm} (p - 1, q-1)$.

$$m^{k \cdot \lambda(n)+1} = m \pmod n$$

We choose $d$ such that $e\cdot d = 1 \pmod {\lambda(n)}$. If $\operatorname{GCD}(e,\lambda(n)) = 1$ then there is exactly one solution in the interval $0 \leq d < \lambda(n)$ but you can construct infinitely many solutions outside this interval by adding $k \cdot \lambda(n)$.


(There are some complications when $\operatorname{GCD}(x,n)\neq 1$, which I'll ignore, since it'll still work in that case)

CodesInChaos
  • 25,121
  • 2
  • 90
  • 129