What is the smallest $n = pq$ for which the RSA encryption and decryption works?

1.5k Views Asked by At

The example at https://www.di-mgt.com.au/rsa_alg.html#simpleexample claims that the smallest value for the modulus $ n $ for which the RSA algorithm works is $ n = 11 \times 3 = 33 $.

But slide number 30 (page 30) of http://haifux.org/lectures/161/RSA-lecture.pdf claims that $ n = 5 \times 11 = 55 $ as the minimal example of RSA key.

I would like to know why $ n = 2 \times 5 = 10 $ is not the minimal example. For example,

\begin{align*} p &= 2 \\ q &= 5 \\ n = pq &= 10 \\ \phi(n) = (p - 1)(q - 1) &= 4 \\ e &= 3 \\ d &= 3 \\ \end{align*}

These numbers seem valid because $ e $ is coprime to $ \phi(n) $ and $ ed \equiv 1 \pmod{\phi(n)}$.

Both encryption and decryption seems to work fine with this. Let the message $ m = 8 $. Therefore the ciphertext is $ m^e \text{ mod } n = 2.$ The plaintext can be retrieved again as $ 2^d \text{ mod } n = 8.$

Why is $ n = 2 \times 5 = 10 $ not the smallest $ n $ for which the RSA encryption and decryption works fine?

1

There are 1 best solutions below

3
On

I've looked at the two papers. Clearly, strength is not the point, even $p,q$ of the order of about a hundred are open to attacks by hand/calculator.

Firstly $e\neq d$ is an absolute requirement for the definition of RSA since in practice $e$ is public and $d$ is private (needs to be kept secret) so both cannot be the same.

The other problem is that one chooses odd primes for RSA. The reason being if you choose $p=2,$ then your $\phi(n)=(p-1)(q-1)=q-1,$ directly reveals the value of $p$. The reason this is important is that the valid user in posession of the secret key $e,$ also knows $p$ and $q$ (it's been proved that knowing $(n,e)$ you can find $p,q$) and thus can break the system.

In fact the exponentiation for decryption $C^d$ are performed separately mod $p$ and $q$ by the legitimate user for efficiency, and then the Chinese Remainder Theorem is used to obtain $C^d$ modulo $n.$

What if we chose the smaller prime to be $p=3$? This presents a problem for the popular choice of exponent $e=3.$ By Fermat's little theorem, $$a^p\equiv a~(\textrm{mod}~p),$$ for all integers $a$ which means that the subgroup of multiplication modulo $p=3,$ is "inactive" in some sense in the exponentiation operation and then $q$ could be discovered by a cryptanalyst.

In summary, the smaller prime must be at least $p=5.$ Taking $p=5,$ the smallest $q$ would be 7, otherwise taking the integer square root of $n$ is equivalent to factorisation.

If $p=5,q=7$ then $\phi(n)=24,$ which violates the requirement $gcd(e,\phi(n))=1,$ for the exponent $e=5.$

So take $p=5,q=11$ to get $n=55,$ ruling out $n=33,$ as I explained above.