RSA cryptosystem relation between lambda and phi.

500 Views Asked by At

I'm currently studying cryptography and have the following question.

Suppose we have the following relation in an RSA system $ed\equiv1\pmod{\Phi(pq)}$ and $ek\equiv1\pmod{\lambda(pq)}$ Show that both $d$ and $k$ can be used to decrypt.

How can I show this? I know that $\lambda | \Phi$ and $d\equiv k\pmod\lambda$ but why does this help us decrypt using either $d$ or $k$.

2

There are 2 best solutions below

2
On

If any $k$ such that $ek\equiv1\pmod{\lambda(pq)}$ can be used, then any $d$ such that $ed\equiv 1\pmod{\varphi(pq)}$ can, because $\lambda(pq)\mid\varphi(pq)$ as you noted, and then $ed\equiv 1\pmod{\lambda(pq)}$.

To prove that $k$ can be used means to prove that $x^{ek}\equiv x\pmod{pq}$ for all $x$; in fact, more generally, for any squarefree $n$, and any $m>0$ such that $m\equiv 1\pmod{\lambda(n)}$, we have $x^m\equiv x\pmod{n}$ for all $x$ (indeed, $n$ is a product of distinct primes, and for any such prime $p$ we have $x^m\equiv x\pmod{p}$, because $\color{gray}{p-1={}}$$\lambda(p)\mid\lambda(n)$${}\mid(m-1)$ — so the claim follows by CRT).

0
On

If $k$ is such that $ek=1 \pmod{\lambda(n)}$ (for some number $k \in \{1,\dots,\lambda(n)-1\}$), then $k$ works as an inverse for encryption exponent $e$ in RSA, because we know that if $x$ is some "message", relatively prime to $n$, by definition of $\lambda$ (!) we know that $x^{\lambda(n)}=1 \pmod{n}$ and then writing $ek-1 = N\cdot\lambda(n)$ for some $N \in \mathbb{Z}$, we know that $$(x^e)^k = x^{ek} = x^{1+N\lambda(n)} = x^1 \cdot (x^{\lambda(n)})^N = x \pmod{n}$$

Now if $ed=1 \pmod{\phi(n)}$ for some $d \in \{1, \ldots, \phi(n)-1\}$ we know that $\phi(n) | (ed-1)$ and as $\lambda(n)|\phi(n)$, $\lambda(n)|(ed-1)$ as well, and so $d$ (or $d \pmod{\lambda}$ if $d > \lambda(n)$) will work by the above.

It's slightly more efficient to work modulo $\lambda(n)$ as it is smaller than $\phi(n)$ in the RSA situation (typically, the way the parameters are chosen, we have $\lambda(n)=\frac{\phi(n)}{2}$, as $\gcd(p-1,q-1)=2$ in a typical setup.) Most standards even proscribe working modulo $\lambda(n)$.