# Is it possible to have E=D and Ke <> Kd?

Let us consider $E$ an encryption algorithm that encrypts a message $m$ into a ciphertext $c$ using a key $K_e$. i.e $c = E(K_e, m)$. Similarly, decryption is achieved by $m = D(K_d, c)$.

Is there any public key encryption scheme where the encryption process is the same as the decryption process (i.e. $E=D$ )?

• This can be achieved trivially by having encryption and decryption be the same algorithm, which ignores the first bit of the key. Then you can let the encryption and decryption keys differ in the first bit. – Chris Peikert Sep 5 '15 at 0:30
• Text book RSA fits the description: $E((N,x),t) = D((N,x),t) = t^x \bmod N$ – Henrick Hellström Sep 5 '15 at 2:21
• @HenrickHellström Why not post it as an answer? Please include the fact that textbook RSA is not secure though. Either we should answer "easy to answer" questions or we should should close them - with just comments this question is likely to remain open. – Maarten Bodewes Sep 5 '15 at 11:39
• You could construct an algorithm that fulfills the conditions from any symmetric or asymmetric encryption algorithm. Define $E'=D'$ as $E$ if MSB of key is 1 else $D$, with the MSB ignored for the actual algorithm. Then prepend 1 to the "encryption key" and 0 to the "decryption key". So I don't think this question is well defined. – otus Sep 5 '15 at 12:27