Finding $m_1$ and $m_2$ (or $d_1$ and $d_2$ using RSA when $e_1$, $e_2$, $n_1$, $n_2$, $c_1$, $c_2$ are known, $e_1=e_2$ and $p_1=p_2$

24 Views Asked by At

I'm trying to obtain messages $M_1$ and $M_2$ using RSA under the following conditions:

  • There are two RSA asymmetric keys:

    • $p_1$ and $p_2$ are unknown, however we know that $p_1=p_2$
    • $q_1$ and $q_2$ are unknown and not equal: $q_1 \neq q_2$
    • $n_1$ and $n_2$ are known and not equal: $n_1 \neq n_2$
    • $e_1$ and $e_2$ are known and both are equal: $e_1 = e_2 = 65537$
  • There are two encrypted messages $C_1$ and $C_2$, both are known and $C_1 \neq C_2$.

    • Unencrypted messages $M_1$ and $M_2$ are unknown.

From RSA requirements we can infer that:

$$ e_1\equiv d_1\text{ mod } \phi(n_1) $$

$$ e_2 \equiv d_2\text{ mod } \phi(n_2) $$

As $e_1 = e_2$, those equations could be solved by the Chinese Remainder Theorem (CRT). However $\phi(n_1)$ and $\phi(n_2)$ are still unknown. I'd like to know if the constraint $p_1 = p_2$ allows to rewrite those equations in order to find a solution for $d_1$ and $d_2$