# Tag Info

We don't say this can't happen, we just say it won't happen. The only value that will decrypt to $p_2$ under $(e_2,n_2)$ is $p_2^{d_2}$, which we can call $s_2$. So, your problem comes down to asking what is the probability that $s_1=s_2$? If we assume that they're random, and that the moduli are similar enough sizes that this is even a realistic ...