2

From this discussion and this discussion I know that the RSA cryptosystem works like this:

$\bullet$ Let $N=pq$, where $p,q$ are primes, and

$\bullet$ choose $c$, an integer relatively prime to $(p-1)(q-1)$,

Then we can take $m$, the plaintext message, and decode it by computing $$a = m^c \pmod N.$$

To decode the message, we need $d = c^{-1} \pmod {\varphi (N)}$, i.e. $cd \equiv 1 \pmod {\varphi (N)}$, where $\varphi (N) = (p-1)(q-1)$.

My Question

Once we have $d$, then the claim is that $$ m \equiv (m^c)^d \pmod N.$$ Equivalently, since $cd \equiv 1 \pmod {\varphi (N)} \Leftrightarrow cd = 1 + k\varphi (N)$, $k \in \mathbb{Z}$, the claim is that $$ m \equiv m^{1 + k\varphi (N)} \pmod N.$$ Which means that $$m^{\varphi (N)} \equiv 1 \pmod N .$$

Now, I know that by Fermat's little theorem $$ m^{p-1} \equiv 1 \pmod p \quad \text{and} \quad m^{q-1} \equiv 1 \pmod q. $$

This implies that $$ m^{\varphi (N)} \equiv 1 \pmod p \quad \text{and} \quad m^{\varphi (N)} \equiv 1 \pmod q. $$

I don't see how to get from this that $$ m^{\varphi (N)} \equiv 1 \pmod N. $$ I know it follows from the Chinese Remainder Theorem, but I don't know how to use the theorem to get there since I think that the theorem only says that there is a solution and not what the solution is.

Peter_Pan
  • 1,938
  • 2
    $p$ and $q$ are distinct primes, so if both of them divide the difference $m^{\varphi(N)}-1$ then $N$ will divide that difference, and vice versa. –  Nov 08 '19 at 18:36
  • @StinkingBishop I see that if both $p$ and $q$ divide the difference, then $N$ will divide the difference. (which answers my question), but I don't understand the vice versa? If $N$ divides some nonero integer, than it follows that either $p$ or $q$ has to divide that integer. But why would it follow that both divide that integer? – Peter_Pan Nov 08 '19 at 18:42
  • 2
    Yes, some call this a proof by CRT, but it is a much simpler, specified version. You don't need the full force version. It's just what @StinkingBishop said above. – Randall Nov 08 '19 at 18:42
  • @Jess No, if $N$ divides an integer, then both $p$ and $q$ divide that integer by transitivity of "divides" relation (since both $p$ and $q$ already divide $N=pq$), –  Nov 08 '19 at 18:44
  • @StinkingBishop Oh, that's obvious. Thanks! – Peter_Pan Nov 08 '19 at 18:45

0 Answers0