RSA Decryption Correctness
Statement
Let be a product of two distinct primes, and let and satisfy . Then for every message with , encrypting with and decrypting with recovers the original message: .
Why is it true?
This is the theorem that makes RSA actually usable: it guarantees that whatever the sender encrypts with the public exponent, the holder of the private exponent can always decrypt, for every possible message, not just most of them — the proof has to handle the edge case where a message accidentally shares a factor with the modulus.
Proof sketch
Since , by definition of modular congruence there is a non-negative integer with .
Case 1: . Euler's theorem gives , so raising both sides to the power and multiplying by gives .
Case 2: . Since , this means divides or divides (not both, since is smaller than ). Working modulo : if divides then both and are congruent to modulo ; otherwise and Fermat's little theorem gives , and since divides the same computation as Case 1 shows . The identical argument modulo shows .
By the Chinese Remainder Theorem, a congruence that holds modulo and modulo separately also holds modulo their product , so holds for every message , not just those coprime to .
Topics that use this theorem
Step-by-step proofs
No step-by-step proof yet for this theorem.
References
- Alfred J. Menezes, Paul C. van Oorschot, Scott A. Vanstone (1996). Handbook of Applied Cryptography
- Peter W. Shor (1994). Algorithms for Quantum Computation: Discrete Logarithms and Factoring · arXiv:quant-ph/9508027
- National Institute of Standards and Technology (2024). Module-Lattice-Based Key-Encapsulation Mechanism Standard (FIPS 203)