0

It is my understanding that the public key modulus $N$ for the RSA cryptosystem is presumed to be a semiprime. I have also read where it is not necessary that $N$ be a semiprime, but it could be some other type of composite number.

My question is: If one wants to decrypt a message knowing $N$ and one of its prime factors, can the message still be decrypted if $N$ is not a semiprime?

Bill Dubuque
  • 272,048
DDS
  • 3,199
  • 1
  • 8
  • 31
  • You need a complete factorization of $N$ to decrypt. But if you know one prime factor, you have a big head start on finding the complete factorization. – Gerry Myerson Oct 01 '20 at 03:26
  • @Gerry Myerson May I thus presume that if the two proper factors were treated as primes, ``decryption'' would take place but would result in garble? Or, would it never get to that point? Thanks. – DDS Oct 01 '20 at 03:46
  • Why don't you try decrypting a message with $N=15$, making believe that $15$ is a prime, and see what happens? – Gerry Myerson Oct 01 '20 at 03:47
  • 1
    If $n$ has more than two distinct factors in RSA then it is called multi-prime RSA where all primes are distinct. Let say it has $k$ primes then you still need to find $k-1$ primes to solve it. – kelalaka Oct 01 '20 at 22:00

1 Answers1

1

To decrypt the message $\,m^e\,$ we need to take its $\,e$'th root $\bmod N.\,$ As explained here this is easy if we know a "universal period" $\,k\,$ such that $\,a^k\equiv 1,\,$ for all $\,a\,$ coprime to $\,N.\,$ Then to compute the message $\,e\,$ we can simply raise $\,m^e$ to power $\,\frac{1}{\large e} \bmod k,\,$ i.e. informally, we can take an $e$'th root by raising to power $\,\frac{1}{\large e}\,$ as usual (follow the link for a rigorous statement).

RSA uses as universal period $\,k = \phi(N)=\,$ Euler totient (for $N$ semiprime) but we could also use any multiple of $\lambda(N)=$ Carmichael lambda function = (universal) group exponent of $\,\Bbb Z_N^{*}$.

Currently the the fastest way known to compute such a universal period $\,k\,$ requires completely prime factoring $N$ then using this to compute $\phi(N)$ or $\lambda (N)$. Since this is not practical for a large modulus $\,N,\,$ RSA powering encryption is a good one-way (trapdoor) function for cryptography.

So, to answer your question, given what is currently known, generally there is no fast way to decrypt (RSA) powered messages without a complete factorization of $N$.

Bill Dubuque
  • 272,048
  • Fist link is now fixed (was wrong before). – Bill Dubuque Oct 01 '20 at 03:47
  • Is there a real possibility that some of the public keys may contain more than two prime factors on purpose? – DDS Oct 01 '20 at 03:49
  • @J.Bogdan They choose two primes since that's all that is needed (and it yields quicker computations). It works fine with any number of primes (at least two distinct). – Bill Dubuque Oct 01 '20 at 03:50
  • @J.Bogdan If you choose more primes then they need to be large enough to be safe against known factorization algorithms (among other exploits), so the more you choose the larger their product $,N,$ becomes, which slows down the modular arithmetic in the algorithm. – Bill Dubuque Oct 01 '20 at 04:02
  • Thank you for both comments. – DDS Oct 01 '20 at 04:43