Timeline for Is it possible to decrypt a ciphertext with a different private key?

Current License: CC BY-SA 3.0

9 events

when toggle format	what		by	license	comment
Dec 25, 2016 at 19:25	comment	added	Jerre		Can you explain, why Euler's theorem also holds for $d \equiv e^{-1} \pmod{\lambda(n))}$, although the equation $d \equiv e^{-1} \pmod{\phi(n))}$ and therefore $x^{\phi(n)}\equiv 1 \pmod n$ is not full filled?
Dec 25, 2016 at 13:00	comment	added	Ilmari Karonen		The inverse $d \equiv e^{-1} \pmod{\lambda(n)}$ is indeed unique modulo $\lambda(n)$, but, as with any modular congruence class, it has multiple integer representatives of the form $d \pm k\lambda(n)$. In particular, if you calculate $d' \equiv e^{-1} \pmod{\phi(n))}$, you will usually find that $d' \ne d$ (and, since $\lambda(n)$ is not generally a divisor of $n$, also $d' \not\equiv d \pmod{n}$), but both still satisfy $x^{ed} \equiv x^{ed'} \equiv x \pmod n$.
Dec 25, 2016 at 11:30	comment	added	Jerre		You are right with your correction of $\phi(n)$ to $\lambda(n)$. Thanks for your addition. But since the private exponent $d$ has to be also computed $\bmod \lambda(n)$ there will still be none other $d' \not\equiv d \bmod n$, which is an inverse of the public exponent $e$, because inverse elements are unique in groups
Dec 24, 2016 at 16:02	comment	added	Ilmari Karonen		Actually, what you write above isn't quite correct, because the exponent of the RSA group is not $\phi(n) = (p-1)(q-1)$, but $\lambda(n) = \operatorname{lcm}(p-1, q-1)$, which is a proper divisor of $\phi(n)$. Thus, $d$ and $d'$ are equivalent RSA exponents if and only if $d \equiv d' \pmod{\lambda(n)}$.
Dec 24, 2016 at 15:28	history	edited	Jerre	CC BY-SA 3.0	added 2 characters in body
Dec 24, 2016 at 12:46	history	edited	Maarten Bodewes♦	CC BY-SA 3.0	deleted 4 characters in body
Dec 24, 2016 at 12:41	history	edited	Maarten Bodewes♦	CC BY-SA 3.0	formatting
Dec 24, 2016 at 10:01	review	First posts
Dec 24, 2016 at 10:40
Dec 24, 2016 at 9:54	history	answered	Jerre	CC BY-SA 3.0