The [proof as it stood at time of starting this answer][1] attempted to prove something that did not hold with the hypothesis that it then stated, which did not include $$\;p\ne q\;\text{ or }\;\gcd(m,pq)=1\;$$ This is required in RSA (illustration: try $p=q=5$, $e=3$, $m=10$; encryption followed by decryption yields $0$ rather than $10$ ). Now $p\ne q$ is made explicit, satisfying said requirement. But it is not apparent where this is used. Not coincidentally, the proof still has a serious gap at the point where $1^k$ appears, which implicitly uses that $m^{\phi(pq)}\equiv1\pmod{pq}$, because: - This proposition is wrong for some $m$, including $m=p$ . - [Fermat's little theorem][2] is invoked as a justification, but an hypothesis in FLT is that the modulus is prime, while $pq$ is not. - FLT makes no mention of $\phi$ . Useful facts: - If $p$ and $q$ are coprime, $pq$ divides $x$ if and only if both $p$ and $q$ divide $x$ . - If $p$ and $q$ are distinct primes, then $p$ and $q$ are coprime. - For $N>0$, the definition of $u=v\bmod N$ used in RSA encryption and decryption is that $u\equiv v\pmod N$ and $0\le u<N$ . - The definition of $u\equiv v\pmod N$ is that $N$ divide $u-v$ . ___ Independently: it is used, but not stated, that the definition of RSA considered uses $d$ such that $ed\equiv1\pmod{\phi(pq)}$ . Another popular definition uses $ed\equiv1\pmod{\lambda(pq)}$ , where $\lambda$ is the [Carmichael function][3]. That definition is used in PKCS#1 et FIPS 186-4. It is mathematically satisfying, for it is necessary and sufficient, when $ed\equiv1\pmod{\phi(pq)}$ is merely sufficient. Also, the proof would be clearer if it was restated a number of other things: - $p$ and $q$ are primes; - $N=pq$ ; - whatever hypothesis on $m$ (commonly, that is $0\le m<N$, with further restriction to $\gcd(m,N)=1$ if the condition $p\ne q$ is not used); - use of textbook RSA encryption $m\to c=m^e\bmod N$ ; - use of textbook RSA decryption $c\to m'=c^d\bmod N$ (with a distinct notation for the original message and deciphered messages); - what's to be demonstrated (this answer assumes that it is $m'=m$ for all $m$ satisfying the hypothesis made on $m$ ). Also: there's a missing bit of reasoning, going from $m'\equiv m\pmod N$ to $m'=m$ . Finally: textbook RSA is not a secure encryption algorithm (assume encryption of the name of someone in the public class roll, which will be interrogated tomorrow, and how one can easily determine if that's her/him). [1]: https://crypto.stackexchange.com/revisions/51284/4 [2]: http://mathworld.wolfram.com/FermatsLittleTheorem.html [3]: https://en.wikipedia.org/wiki/Carmichael_function