# How multiplicative property of RSA can be exploited

It is known that RSA has the multiplicative property

$E(m_1) \cdot E(m_2) = E(m_1 \cdot m_2)$

because

$m_1^e \cdot m_2^e = (m_1 \cdot m_2)^e \pmod n$

But how can this property be used to break the RSA system?

What are the attacks that use this property?

• If you have the encryption of the plaintext numbers 2, 3 and 5 you could create every ciphertext which can be composed as product of this numbers, like 4, 8, 16, 32, ..., or 6, 9, 12, 15, 18, 24... If the prime factorization of a number only contains the number 2, 3 or 5 then you can create the ciphertext for that number. – Nova Apr 9 '15 at 16:40
• @Nova, but since the public key is public, what does this gain an attacker? – mikeazo Apr 9 '15 at 16:52
• you don't have in practice this attack since you hash the msg before you sign it or encrypt it – 111 Apr 9 '15 at 19:38
• @111: Just hashing the message using e.g. SHA-1 is not quite enough protection for signature; and you can't replace the message with its hash for encryption, for then it can not be efficiently deciphered. $\;$ It remains that indeed, RSA encryption and signature schemes used in practice do not externally have the multiplicative property. – fgrieu Apr 27 '15 at 4:22

1. If you're using RSA for public-key encryption, there's an adaptive chosen ciphertext attack. Suppose you want to decrypt $c$ and A is decrypting everything but $c$ for you. Now you can chose your $c_1=x^e*c$ with $x\in Z_n^*$. Now you you send $c_1$ to A, he decrypts this. Now you'll have $m_1=c_1^d=c^d*(x^e)^d=m*x$ $(mod$ $n)$, now you simply compute $m=m_1*x^{-1}$ $(mod$ $n)$ and decrypted an arbitrary ciphertext