1

Starting with the same primes $p$ and $q$ to generate $n=pq$, will Carmichael's totient function and Euler's totient function give the same public key ($e,n$) and private key ($d,n$) in RSA encryption?

If not, are there specific types or range of primes $p$ and $q$ that result in the difference?

THANK YOU!

AleksanderCH
  • 6,435
  • 10
  • 29
  • 62
dkssud10
  • 125
  • 5
  • Hint: How is $\lambda(n)$ related to $\phi(n)$? Is it possible for $e$ and $d$ to satisfy $ed \equiv 1 \pmod{\phi(n)}$ but not $ed \equiv 1 \pmod{\lambda(n)}$, or vice versa? (Write out the congruences as equations about integers.) – Squeamish Ossifrage May 17 '19 at 02:05
  • Also consider looking at existing Qs like https://crypto.stackexchange.com/questions/68873/ https://crypto.stackexchange.com/questions/54280/ https://crypto.stackexchange.com/questions/33676/ https://crypto.stackexchange.com/questions/29591/ – dave_thompson_085 May 17 '19 at 03:21

1 Answers1

3

There is no standard definition of "same" when applied to cryptographic keys.

There is a precise definition of equivalent keys: keys which always yield the same effect when used for their designated usage, e.g. encryption, decryption, signature generation or verification. For example, in DES, low order bits of key bytes play no role, thus 0123456789ABCDEF (in hexadecimal) is a key equivalent to 0022446688AACCEE, if the later is considered valid. In TEA, 0123456789ABCDEF0123456789ABCDEF is equivalent to 8123456709ABCDEF8123456709ABCDEF.

In RSA, Carmichael's and Euler's totient functions generate equivalent keys, even though (in the variant of RSA where the private exponent $d$ is generated from the public exponent $e$) the resulting values of $d_\lambda=e^{-1}\bmod\lambda(n)$ and $d_\varphi=e^{-1}\bmod\varphi(n)$ often are not equal. Example:$$\begin{align} n&=5\times11=55\quad&e&=3\\ \lambda(n)&=\operatorname{lcm}(4,10)=20\quad&d_\lambda&=7\\ \varphi(n)&=4\times10=40\quad&d_\varphi&=27 \end{align}$$

In the (original) variant of RSA where the public exponent $e$ is generated from the private exponent $d$, we'd often have different $e_\lambda=d^{-1}\bmod\lambda(n)$ and $e_\varphi=d^{-1}\bmod\varphi(n)$.

Note: we do not even have a universally accepted definition of equal keys. Are two DES keys represented as 16 characters 0123456789ABCDEF and 0123456789abcdef equal? Does LF vs CR/LF matter in RSA keys as PEM files?

fgrieu
  • 140,762
  • 12
  • 307
  • 587