2

Consider the following scenario:

Suppose A and B have set up their RSA public keys, namely $(e_a, n)$ and $(e_b, n)$, where the n-value is the same. Also, it happens that the $\gcd (e_a, e_b) = 1$. Suppose C wants to send both A and B a message $M$ that is coprime with $n$. Thus, C encrypts $M$ using A and B's public keys, producing the cipher text, $C_a$ and $C_b$.

I was told by my instructor, that suppose if there is someone who obtains the values of both $C_a$ and $C_b$, that particular person can determine the message $M$ using the public keys of $A$ and $B$, without knowing their private keys. Why is it necessarily true? Any help would be highly appreciated!

Joshua
  • 123
  • 4

1 Answers1

3

This is called the common modulus attack.

Bezout's Identity says that there exists $x$ and $y$ such that $ax + by = gcd(a, b)$.

In our case we have $gcd(e_a,e_b) = 1$, so we can find $x$ and $y$ such that $e_{a}x + e_{b}y = 1$ (you can use the extended euclidean algorithm for this).

After solving for $x$ and $y$, you compute:

$C^xC^y\mod N$ to get $M$.

This works because $C^xC^y= M^{e_{a}x}M^{{e_b}y} = M^{e_{a}x + e_{b}y} = M$

user13741
  • 2,627
  • 11
  • 16