different notations in RSA algorithm

76 Views Asked by At

I'm looking into the RSA-algorithm but in different textbooks i find that the method is a bit different.

They all start with two primes q and p and calculate N = pq. But after this i encountered three different approaches:

  • In the first one they calculate $\phi(N)=\operatorname{lcm}(p-1,q-1)$ (with lcm the least commen multiple). and from this they chose $e$ relative prime with $\phi(N)$ and calculate $d$ such that $ed \equiv 1 \mod \phi(N)$.

  • In the second one they calculate $\phi(N)=(p-1)(q-1)$ and do the same.

  • In the third one they calculate $\phi(N)=(p-1)(q-1)$, chose $e$ the same way but calculate $d$ such that $ed \equiv 1 \mod \frac{\phi(N)}{2}$.

What is the impact of these differences on the method (like the numbers $e$ and $d$)? Is one better than the other?

1

There are 1 best solutions below

1
On BEST ANSWER

The idea is, that $m^{ed}\equiv m\pmod p$ for a prime $p$ as long as $ed\equiv1\mod(p-1)$ and similarly for the prime $q$. And in case both are satisfied, the Chineese Remainders Theorem then makes sure that $$ m^{ed}\equiv m\mod{pq} $$ which is what we want.


So we just need to ensure that $$ \begin{align} ed&\equiv 1\mod(p-1)\\ ed&\equiv 1\mod(q-1) \end{align} $$ which can be done using any multiple $k\lambda$ of $\lambda=\operatorname{lcm}(p-1,q-1)$ and require that $$ ed\equiv 1\mod{k\lambda} $$ Note that both $(p-1)(q-1)$ and $\frac{(p-1)(q-1)}{2}$ are multiples of $\lambda$, but $\lambda$ is the least such multiple so in a sense the first version is optimal regarding size of the numbers involved.


Also note that $\phi(N)$ is the number of numbers relatively prime to $N=pq$ and this figure is $(p-1)(q-1)$ and should not be redefined to take on other values. I think you should save the notation $\phi(N)$ for this purpose.