6

Say I want generate pair of public/private keys. First of all lets choose two prime numbers $q = 17, p = 11$. Now, lets choose public key $e=7$ and try to determine the matching private key $d$:
$$d\cdot e \mod (q-1)(p-1) = 1$$ $$d\cdot 7 \mod 16\cdot 10 = 1$$ $$7d \mod 160 = 1$$

So, there are many solutions for this equation, such $23$, $183$, $343$ and in general $d = 160k+23$ for every $k\in Z$.

But RSA should have single private key for public key, so why can I get many solutions/private keys? I tested them, and they can decrypt the encryption of the public key $e$.

I know that $q$ and $p$ should be destroyed and without them it is hard to calculate the private key. I just don't understand why there are many private keys for one public key...

nrofis
  • 163
  • 1
  • 4
  • 2
    The key is unique in $[0,80]$ ie in $[0,\lambda(n)]$ where $\lambda(\cdot)$ is the carmichael-function of the modulus. All of these keys are equivalent and given any of them you should be "easily" able to recover the others, this is a well-known fact. This implies that actually $103$ is a valid private key as well. – SEJPM Jul 03 '17 at 20:47
  • $d\cdot e \bmod (p-1)(q-1),=,1$ is a sufficient condition for $d$ being a valid private exponent; this allows several values of integer $d$. The condition $d\cdot e \bmod \operatorname{lcm}(p-1,q-1),=,1$ is a necessary and sufficient condition for $d$ being a valid private exponent, and allows even more values of integer $d$. – fgrieu Jul 04 '17 at 12:23
  • Anyone knowing any $e,d,N$ can calculate $p,q$ or $\lambda(N)$ in polynomial time. And then it's easy to calculate other representations. – tylo Apr 15 '18 at 10:49

1 Answers1

5

Well,

  1. You're working in the multiplicative group.

  2. There is a theorem (which is proven by group axioms), that the inverse element is unique ($d$ is inverse to $e$).

  3. When you say $d = 160 \cdot k + 23$ for every $k$ from $Z$, you actually should mean that in the context mod $160$ then your $d \cdot k$ for any $k$ is actually the same element.

I think the mindtrick here is that:

You claim: $d = 160 \cdot k + 23$ for every $k$ in Z; oh, there is a lot of such elements!
NO. You're in the multiplicative group. You can write this element different ways. But it is still the same element.

You do not work with "numbers". You work with an element of multiplicative group. Which can be represented many ways (see your claim about $k$). But it's the same element. In the context of 'multiplicative group mod $160$, elements $23$ and $183$ are the same elements.

You can easily prove that $23 \bmod 160 = 183 \bmod 160$. So $183$ equals $23$ in group mod $160$. That means you can write on sheet of paper $183$ or $23$ or whatever $160 \cdot k + 23$ you like, and you will be talking about the same element, which is unique.

The key is therefore also unique - your key is an element of a multiplicative group, which can be written in many ways ($160 \cdot k + 23$, where $k$ is in $Z$)

Maarten Bodewes
  • 92,551
  • 13
  • 161
  • 313
Valentyn Kuznietsov
  • 246
  • 1
  • 5
  • 1
    Please note that the OP got the order wrong, the multiplicative order is $\lambda(n)=\operatorname{lcm}(16,10)=80$ and not $160$ which means $23\equiv 103\equiv 183$ as exponents. – SEJPM Jul 03 '17 at 21:08
  • Thanks! I haven't noticed that - just blindly copied OP's numbers! – Valentyn Kuznietsov Jul 03 '17 at 21:09
  • @ValentynKuznietsov OK, I understand that i can write $d$ in different ways that are represent the same element in the multiplicative group. But the attacker that tries to brute-force the private key, can't just find one value that represents the same private key in the multiplicative group? – nrofis Jul 04 '17 at 19:04
  • It does not make his work any easier. Between 0 and 79 (for group mod 80) there is only one such element. Other 'representations' will be bigger than 80 - how that makes bruteforce easier? – Valentyn Kuznietsov Jul 05 '17 at 10:12
  • And maybe it was not exactly your question, I would also like to point out that this bruteforce is assumed to be hard. If he tries to brute d directly, he needs to solve Discrete Log Problem. If he tries to factorize your n to be able to calculate d by taking modular inverse of e, he needs to solve Factorization problem, which has equal difficulty as Discrete Log Problem. (assumed to be very hard) – Valentyn Kuznietsov Jul 05 '17 at 10:22