Sign up ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I wanted to know how I could manage to do what I'm going to tell you next, with the RSA encryption/decryption scheme.

So Alice and Bob each have a public key $(n, e)$ and a private key $(p, q, d)$; where $n = p\cdot q$; $p$ and $q$ are odd distinct primes; and $e\cdot d \equiv 1 \pmod{\varphi(n)}$ with $1 < d < \varphi(n)$.

Alice has a number $x$, she encrypts it with her $e_A$ and sends it to Bob; this way, Bob cannot tell which number it is. Then Bob encrypts it with his $e_B$ too and sends it back to Alice.

I want Alice to be able to decrypt the number from Bob; this way, Alice would obtain the number $x^{e_B} \bmod n_B$ and Bob could still decrypt it with his private key to find $x$ again.

So basically, I want to find a way to make the number comes back to Alice but I don't want her to be able to know which number it was first (and Bob could still decrypts it).

I hope I was clear enough and sorry for my bad English.

Thank you.

share|improve this question
Welcome to CSE! I've edited the question to use $\TeX$; have $p$ and $q$ odd distinct primes; and uses commutative encryption in title and tags, for that's the meat of the requirement. $\;$ Common wisdom is that RSA is unsuitable for commutative public-key encryption, but can be adapted for commutative encryption if $e_A$ and $e_B$ are secret, $n_A=n_B$, and some other tweaks. See this article on Mental Poker a.k.a. SRA (not a typo), and this attack. – fgrieu Jun 6 '14 at 12:12
Thank you for your answer ! – Desura Jun 6 '14 at 13:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.