# What's the main difference between Pohlig-Hellman and RSA?

Both Pohlig-Hellman and RSA perform encryption and decryption by exponentiation modulo some integer ($p$ prime for PH, $n$ composite for RSA). They both use a key $e$ as the exponent to encrypt a message. They both use the inverse element of key $e$ to decrypt. In both, the encryption key $e$ can be a randomly chosen integer coprime with $p-1=\phi(p)$ (for PH) or $\phi(n)$ (for RSA).

So what's the main difference between Pohlig-Hellman and RSA?

Note: The question has been edited for accuracy and more standard notations.

The main difference is that Pohlig-Hellman is a symmetric cypher, while RSA is a public key system. This is because, with Pohlig-Hellman, anyone who knows the encryption key $e$ can compute the inverse operation (because the 'decryption' key $e^{-1} \bmod p-1$ is easy to compute), while the RSA, someone who knows the encryption key $e$ (but not the factorization of the RSA modulus) cannot compute the decryption operation.
• @markroxor: Pohlig-Hellman and RSA are more different than that; PH uses, one might say, q=1; and because computing $\phi N$ is easy, it is a symmetric system, based on the difficultly of discrete logs. In contrast, RSA is based on, well, the RSA problem, which assumes the difficulty of factoring (note: computing discrete logs in a composite modulus allows you to factor, hence we don't need to note the discrete log problem separately) Jul 28, 2022 at 12:01