Return to Answer

No, it's not possible. If it was possible it would have a devastating impact on asymmetric cryptography in general.

Most asymmetric cryptosystems rely on mathematically problems that cannot be solved in polynomial time (such as integer factorization, or discrete logarithm).

Let's look at RSA: you choose your $K_{pub} = N_e$ and $k_{priv} = (d)$ with $e \in \{1,2,\dotsc , \Phi(n) - 1\}$ to fulfill the following equations:

$$\Phi(n) = (p - 1) \cdot (q - 1)$$ $$\operatorname{gcd}(e, \Phi(n)) = 1$$ $$d \cdot e \equiv 1 \bmod \Phi(n)$$

Every element in a group can have one inverse element at maximum, you can not find a $d'$ for which:

$$d' \cdot e \not\equiv 1 \bmod \Phi(n)$$

So instead of:

$$d_{k_{priv}}(y) = d_{k_{priv}}(e_{k_{pub}}(x)) = (x^e)^d \equiv x^{de} \equiv x \bmod n$$

you will compute:

$$d_{k'_{priv}}(y) = d_{k'_{priv}}(e_{k_{pub}(x)}) = (x^e)^{d'} = x^{d'e} \equiv m' \not\equiv m \bmod n$$

So you will be able to compute the decryption with a different $d'$, but your result $m'$ will have nothing in common with the original $m$.

No, it's not possible. If it was possible it would have a devastating impact on asymmetric cryptography in general.

Most asymmetric cryptosystems rely on mathematically problems that cannot be solved in polynomial time (such as integer factorization, or discrete logarithm).

Let's look at RSA: you choose your $K_{pub} = (n,e)$ and $k_{priv} = (d)$ with $e \in \{1,2,\dotsc , \Phi(n) - 1\}$ to fulfill the following equations:

$$\Phi(n) = (p - 1) \cdot (q - 1)$$ $$\operatorname{gcd}(e, \Phi(n)) = 1$$ $$d \cdot e \equiv 1 \bmod \Phi(n)$$

Every element in a group can have one inverse element at maximum, you can not find a $d'$ for which:

$$d' \cdot e \not\equiv 1 \bmod \Phi(n)$$

So instead of:

$$d_{k_{priv}}(y) = d_{k_{priv}}(e_{k_{pub}}(x)) = (x^e)^d \equiv x^{de} \equiv x \bmod n$$

you will compute:

$$d_{k'_{priv}}(y) = d_{k'_{priv}}(e_{k_{pub}(x)}) = (x^e)^{d'} = x^{d'e} \equiv m' \not\equiv m \bmod n$$

So you will be able to compute the decryption with a different $d'$, but your result $m'$ will have nothing in common with the original $m$.

No, it's not possible. If it was possible it would have a devastating impact on asymmetric cryptography in general.

Most asymmetric cryptosystems rely on mathematically problems that cannot be solved in polynomial time (such as integer factorization, or discrete logarithm).

Let's look at RSA: you choose your $K_{pub} = N_e$ and $k_{priv} = (d)$ with $e \in \{1,2,\dotsc , \Phi(n) - 1\}$ to fulfill the following equations:

$$\Phi(n) = (p - 1) \cdot (q - 1)$$ $$\operatorname{gcd}(e, \Phi(n)) = 1$$ $$d \cdot e\Phi \equiv 1 \bmod \Phi(n)$$

Every element in a group can have one inverse element at maximum, you can not find a $d'$ for which:

$$d' \cdot e \not\equiv 1 \bmod \Phi(n)$$

So instead of:

$$d_{k_{priv}}(y) = d_{k_{priv}}(e_{k_{pub}}(x)) = (x^e)^d \equiv x^{de} \equiv x \bmod n$$

you will compute:

$$d_{k'_{priv}}(y) = d_{k'_{priv}}(e_{k_{pub}(x)}) = (x^e)^{d'} = x^{d'e} \equiv m' \not\equiv m \bmod n$$

So you will be able to compute the decryption with a different $d'$, but your result $m'$ will have nothing in common with the original $m$.

No, it's not possible. If it was possible it would have a devastating impact on asymmetric cryptography in general.

Most asymmetric cryptosystems rely on mathematically problems that cannot be solved in polynomial time (such as integer factorization, or discrete logarithm).

Let's look at RSA: you choose your $K_{pub} = N_e$ and $k_{priv} = (d)$ with $e \in \{1,2,\dotsc , \Phi(n) - 1\}$ to fulfill the following equations:

$$\Phi(n) = (p - 1) \cdot (q - 1)$$ $$\operatorname{gcd}(e, \Phi(n)) = 1$$ $$d \cdot e \equiv 1 \bmod \Phi(n)$$

Every element in a group can have one inverse element at maximum, you can not find a $d'$ for which:

$$d' \cdot e \not\equiv 1 \bmod \Phi(n)$$

So instead of:

$$d_{k_{priv}}(y) = d_{k_{priv}}(e_{k_{pub}}(x)) = (x^e)^d \equiv x^{de} \equiv x \bmod n$$

you will compute:

$$d_{k'_{priv}}(y) = d_{k'_{priv}}(e_{k_{pub}(x)}) = (x^e)^{d'} = x^{d'e} \equiv m' \not\equiv m \bmod n$$

So you will be able to compute the decryption with a different $d'$, but your result $m'$ will have nothing in common with the original $m$.

No, it's not possible, moreover it would have a devastating impact on asymmetric cryptography in general.

Most asymmetric cryptosystems relies on mathematically problems, which can't be solved in polynomial time (such as integer factorization, or discrete logarithm).

Let's look at RSA: You choose your with to full fill the following equations:

Every element in a group can have one inverse element at maximum, you can not find a d' for which

So instead of

![formula][7]

you will compute

![formula][8]

So you will be able to compute the decryption with a different d', but your result m' will have nothing in common with the original m.

[7]: https://chart.googleapis.com/chart?cht=tx&chl=d_%7Bk_%7Bpriv%7D%7D(y)%3Dd_%7Bk_%7Bpriv%7D%7D(e_%7Bk_%7Bpub%7D%7D(x)))%3D(x%5Ee)%5Ed%20%5Cequiv%20x%5E%7Bde%7D%20%5Cequiv%20x%5C%3B%20mod%5C%3B%20n [8]: https://chart.googleapis.com/chart?cht=tx&chl=d_%7Bk'_%7Bpriv%7D%7D(y)%3Dd_%7Bk'_%7Bpriv%7D%7D(e_%7Bk_%7Bpub%7D%7D(x)))%3D(x%5Ee)%5Ed'%20%5Cequiv%20x%5E%7Bd'e%7D%20%5Cequiv%20m'%5C%3B%20%5Cnot%5Cequiv%20%5C%3Bm%5C%3B%20mod%5C%3B%20n

No, it's not possible. If it was possible it would have a devastating impact on asymmetric cryptography in general.

Most asymmetric cryptosystems rely on mathematically problems that cannot be solved in polynomial time (such as integer factorization, or discrete logarithm).

Let's look at RSA: you choose your $K_{pub} = N_e$ and $k_{priv} = (d)$ with $e \in \{1,2,\dotsc , \Phi(n) - 1\}$ to fulfill the following equations:

$$\Phi(n) = (p - 1) \cdot (q - 1)$$ $$\operatorname{gcd}(e, \Phi(n)) = 1$$ $$d \cdot e\Phi \equiv 1 \bmod \Phi(n)$$

Every element in a group can have one inverse element at maximum, you can not find a $d'$ for which:

$$d' \cdot e \not\equiv 1 \bmod \Phi(n)$$

So instead of:

$$d_{k_{priv}}(y) = d_{k_{priv}}(e_{k_{pub}}(x)) = (x^e)^d \equiv x^{de} \equiv x \bmod n$$

you will compute:

$$d_{k'_{priv}}(y) = d_{k'_{priv}}(e_{k_{pub}(x)}) = (x^e)^{d'} = x^{d'e} \equiv m' \not\equiv m \bmod n$$

So you will be able to compute the decryption with a different $d'$, but your result $m'$ will have nothing in common with the original $m$.