3

As you know, in RSA encryption, we calculate an n value by multiplying two long primes. Then we calculate Φ(n), which is equal to (p-1)(q-1). After that, we choose an encryption key which satisfies gcd(e,Φ(n))=1. I know that it is necessary to calculate decryption key, which is the modular inverse of e. My question is: Why do we use Φ(n) in determination of encryption and decryption key processes? How can one prove it is working for RSA encryption?

user13791
  • 647

3 Answers3

13

Short answer. We use $\Phi(n)$ because that is the order of the multiplicative group of units modulo $n=pq$.

Long answer. RSA works via modular exponentiation modulo $n$. The idea is to take a message that corresponds to a number $M$, "encrypt" it by raising it some power $e$ to obtain an encyphered text $M^e$; and then "decrypt" by raising it to an appropriate power $d$ to recover $M$. The reason this works is that the multiplicative group of units modulo $n$ is a finite group, and by Euler's Theorem we know that $M^{\Phi(n)} \equiv 1 \pmod{n}$ for all $M$ that is relatively prime to $n$.

That means that for every integer $k$ we have $$M^{\Phi(n)+k} = M^{\Phi(n)}M^k \equiv 1\cdot M^k =M^k\pmod{n}.$$

That is, raising a number that is realtively prime to $n$ to the $\Phi(n)$-th power will "kill it": make it congruent to $1$.

In order to be able to recover $M$ from $M^e$ by exponentiation, we need there to exist a $d$ such that $M\equiv (M^e)^d = M^{ed}\pmod{n}$. But for this to be possible, we want $ed \equiv 1 \pmod{\Phi(n)}$; because if $ed\equiv 1 \pmod{\Phi(n)}$, then we can write $ed = r\Phi(n) + 1$ for some $r$, and then $$M^{ed} = M^{r\Phi(n)+1} = (M^{\Phi(n)})^rM \equiv 1^r\cdot M = M \pmod{n},$$ and we have recovered $M$.

Arturo Magidin
  • 398,050
  • It is not working for some power $e$, it must be $gcd(e,\phi(n))=1$ otherwise the encryption will not be functional. And actually, the proper RSA use $\lambda(n)$ since it always produces smaller $d$s. – kelalaka Nov 22 '21 at 08:50
  • @kelalaka The final paragraph states already that we need $ed\equiv 1 \pmod{\Phi(n)}$, so I don't know why you believe this needs mentioning. Your second point is about implementation, not theory. – Arturo Magidin Nov 22 '21 at 14:22
  • I was aware of that part, too. Well, It may be your writing style that causes for me ( some power $e$, the possible $e$'s are well-defined at the end). The $\lambda$ on the other hand the part of the theory, not in the original RSA, but later defined and standardized. if the gcd is 1 then in RSA $d$ not only exists but also not unique. Since this was considered as a canonical question, I considered that this should be mentioned, that's it. – kelalaka Nov 22 '21 at 15:10
  • @kelalaka: If you believe it is so important, then don't hide it in the comments. Add your own answer instead of hiding it in the comments, and implying that something is missing when it patently is not. As for the Carmichael function, that is not trivial to calculate (it requires further factorizations). But in any case, this question isn't about how RSA is actually used, but about why $\Phi$ shows up in its definition. So introducing the Carmichael function would not actually address the question, but instead address something not being asked, hence irrelevant. – Arturo Magidin Nov 22 '21 at 15:21
1

The reason why you pick $e$ relative prime to $(p-1)(q-1)$ is because we know that all relative primes to $(p-1)(q-1)$ form a group with respect to multiplication, thus $e$ has a multiplicative inverse mod $(p-1)(q-1)$ (see group axioms). Let's call this number d.

Now to proof that the encryption/ decryption works, we have to show that $x^{ed} \equiv x \pmod{pq}$.

We do so as follows: remember that $ed \equiv 1 \pmod{(p-1)(q-1)}$. thus $ed = 1 + t(p-1)(q-1)$. for some $t \in \mathbb{Z}$.

Plugging this into $x^{ed}$ we get $x^{ed} \equiv x^{1+t \,(p-1)(q-1)} \equiv xx^{t\,(p-1)(q-1)}$

Now here you can apply Fermats little theorem when x is relative prime to p.

Thus we get $xx^{t(p-1)(q-1)} \equiv x(x^{(p-1)})^{t \,(q-1)} \equiv x1^{t \,(q-1)} \equiv x \pmod{p}$

and $xx^{t(p-1)(q-1)} \equiv x(x^{(q-1)})^{t \,(p-1)} \equiv x1^{t \,(p-1)} \equiv x \pmod{q}$.

Now because of the above and because $p$ and $q$ are relative prime, we know that $x^{ed} = x \pmod{pq}$.

When x and p or x and q are not relative prime, we cannot use Fermats little theorem. However, you should try deriving the correctness here yourself. If you can't work it out, give me a tell.

sxd
  • 3,504
  • 1
    @Dmitry: To get the (mod pq) property typeset and spaced, you should use the $\LaTeX$ command \pmod{pq}, which produces $\pmod{pq}$ with extra space before the opening parenthesis. – Arturo Magidin Jul 28 '11 at 18:35
  • Any idea how i can make the exponent of $x^{t(q-1)}$ less ugly, it looks glued to the parentheses. – sxd Jul 28 '11 at 18:40
  • @Dmitri: I'm not sure which one you mean... But I would change $(x^{(p-1)})^{(t(q-1))}$ in line 9 to simply $(x^{p-1})^{t(q-1)}$. – Arturo Magidin Jul 28 '11 at 18:49
  • @Arturo: I mean, the t is like glued to the parentheses. When I write a latex report, I do not have this problem. – sxd Jul 28 '11 at 18:57
  • @Dmitri: I don't see that problem in my display; it may simply be an artifact of your display. But one can always add a little space, e.g., )^{\,t} or )^{\;t} to get $)^{,t}$ or $)^{;t}$, respectively, vs. )^t which produces $)^t$. – Arturo Magidin Jul 28 '11 at 19:02
  • @Arturo: I actually meant that the t was leaning into the parenthesis to its right (this is an issue that I don't have in reports), thanks for your comment though, i didn't know that – sxd Jul 28 '11 at 19:32
  • @Dimitry: You can put in the thin space \, or medium space \; after the t to give it more space, or even add italic correction \/; I usually don't like the look of the latter, though. – Arturo Magidin Jul 28 '11 at 19:39
1

In RSA, $\rm\,\phi = \phi(pq)\,$ arises because it is the order of the group of the invertible integers $\!\!\rm\pmod{\!pq}$ The exponent $\rm\:e\:$ in the encryption map $\rm\:x\to x^e\:$ is chosen coprime to $\:\phi,\,$ i.e. $\rm\:(e,\:\phi) = 1,\:$ to ensure that the map $\rm\:x\to x^e\:$ is $1$ to $1$ so invertible, a necessary requirement for decryption to be unique. The proof is easy. If $\rm\:x^e \equiv y^e\:$ then $\rm\:z^e\equiv 1\:$ for $\rm\:z = x/y\:.\:$ By Euler $\rm\:z^\phi\equiv 1\:$ so by the Lemma below $\rm\:z^{(e,\:\phi)} \equiv 1\:.\:$ Thus if $\rm\:(e,\phi) = 1$ then $\rm\: z\equiv 1\:$ $\Rightarrow$ $\rm\ x\equiv y\ $ hence $\rm\:x\to x^e\:$ is $1$ to $1.$

Lemma $\rm\ (e,\phi) = \color{#c00}de+k\phi = 1, \ z^{e}\equiv z^{\phi}\equiv 1 \ \Rightarrow \ z^{(e,\,\phi)} =\ z^{\:d\,e+k\,\phi} = (z^e)^d (z^\phi)^k \equiv 1\cdot 1$

Remark $ $ More generally, this answer explains at length how we can take $\rm\,e\:\!$'th roots when $\,\rm e\,$ is coprime to the period (here $\phi)$ by simply raising to the power $\rm \,\frac{1}e\bmod \phi \ (\equiv\rm \color{#c00}d\,$ above).

Bill Dubuque
  • 272,048