2

We have been shown that DE is congruent to 1 mod phi(n). How do we arrive to the real equation for figuring out d that is d = e^-1 mod phi(n). I want to know the entire process. I am just curious, spending the night studying the workings of the RSA.

Ali Gajani
  • 418
  • 2
  • 6
  • 12
  • it's because of definition of $\phi(n)$ in essence $x^{\phi(n)} = x \mod n \Rightarrow x^y=x^{y \mod \phi(n)} \mod n$. So you select an $e$ and $d$ such that $ed = 1 \mod \phi(n)$ – ratchet freak Dec 06 '13 at 09:56
  • Related: http://crypto.stackexchange.com/questions/5889/calculating-rsa-private-exponent-when-given-public-exponent-and-the-modulus-fact – Ilmari Karonen Dec 17 '15 at 20:12

1 Answers1

7

Are you asking "given $e$ and $\phi(n)$, how do we find $d$ such that $de \equiv 1 \bmod \phi(n)$"? (which can also be written as $d = e^{-1} \bmod \phi(n)$

The standard way of find such a value is the Extended Euclidean Method; this is a relatively efficient method that results in $d$ given $e$ and $\phi(n)$ as inputs (assuming, of course, that $e$ and $\phi(n)$ are relatively prime; if they aren't, $e$ won't work as a public exponent anyways).

Now,I do have one minor nit which doesn't have anything to do with your actual question: actually, if $d$ and $e$ are RSA private/public exponents, it's not always true that $de \equiv 1 \bmod \phi(n)$. Now, such a $d$ and $e$ that satisfies that condition will work as RSA private/public exponents (and hence if you are constructing an RSA private/public keypair, using $\phi(n)$ won't break anything).

However it turns out that the weaker condition $de \equiv 1 \bmod \lambda(n)$ where $\lambda(n) = lcm(p-1, q-1)$ turns out to be both necessary and sufficient. This does not affect your question (because you end up giving $e$ and $\lambda(n)$ to the Extended Euclidean Method). You did mention that you were studying RSA; you should be aware of that.

poncho
  • 147,019
  • 11
  • 229
  • 360