Errata: 8 Oct 2002 - not "e and d are congruent mod phi(n)", but "ed is
congruent mod phi(n)".

Errata: 4 Oct 2002 - ed was incorrectly listed in one instance as congruent
to 1 mod n.  ed is congruent to 1 mod phi(n).


-------------------------------------
Lecture notes on RSA and the totient function
Jason Holt
3 October 2002
BYU Internet Security Research Lab
This document is in the public domain
-------------------------------------

RSA takes advantage of Euler's generalization of Fermat's Little
Theorem, namely:

 phi(n)
a       is congruent to 1 (mod n)

Euler's totient function, phi(n) is defined as follows, where p0..pk
are the prime factors of n:

            e0      e1          en
Given n = p0   *  p1   ... *  pn


                  e0-1            e1-1                en-1
phi(n) = (p0-1)*p0     * (p1-1)*p1     ... * (pn-1)*pn

For example:

         5    4
90720 = 2  * 3  * 5 * 7

                    4          3
phi(90720) = (2-1)*2  * (3-1)*3  * (5-1) * (7-1) = 20736

The totient function describes the number of values <n which are
relatively prime to n.  For the purposes of RSA, we're only concerned
with values of n which are the product of 2 primes, p and q, so phi(n)
is always just (p-1)*(q-1).

Encryption and decryption in RSA take advantage of the fact that for a
message m and exponents e and d:

   e*d
  m    = m (mod n)

This works because e and d are chosen such that for some (unimportant)
value k,

  e*d = k*phi(n) + 1.

(That is to say, ed is congruent to 1 mod phi(n).)  Since any

  k*phi(n)    phi(n)   phi(n)   phi(n)
 m         = m       *m       *m       *... =   1 (mod n),


  e*d      k*phi(n)+1       k*phi(n)
 m      = m           =  m*m         = 1*m (mod n)

Since ed is congruent to 1 mod phi(n), d happens to be the
multiplicative inverse of e (mod phi(n)) (and vice versa).  e is
chosen somewhat arbitrarily, usually as something inexpensive when
used as an exponent.  Nowadays, it's generally 65537.  e is known as
the public or encryption exponent, and d as the decryption or private
exponent.  To encrypt a message m to a ciphertext c, simply calculate 

      e
 c = m  mod n

Since only the recipient knows d, only he can recover the message:

            d
      d    e     e*d
 m = c  = m   = m    (mod n)

Why is RSA secure?  Well, because both discrete logarithms and
factoring are hard for large numbers.  Given 

  e
 m  (mod n)

it's hard to determine what either the base or exponent were (although
in the case of RSA, the public exponent is published).  And given the
public modulus n and public exponent e, it's hard to compute d because
you can't calculate phi(n) without knowing n's factors p and q.

Signing with RSA.
RSA can be used to produce digital signatures on the hash h of a
message m.  The signer raises h to his secret exponent d:

      d
 s = h   (mod n)

Only she knows how to do this because only she knows d.  Anyone else
can verify the signature by raising it to the public exponent:

            e
      e    d 
 h = s  = h   (mod n).