MathLabs
TheoremProved

RSA Decryption Correctness

Statement

Let n=pqn = pq be a product of two distinct primes, and let ee and dd satisfy ed≡1(modϕ(n))ed \equiv 1 \pmod{\phi(n)}. Then for every message mm with 0≤m<n0 \le m < n, encrypting with ee and decrypting with dd recovers the original message: (me)d≡m(modn)(m^e)^d \equiv m \pmod n.

Why is it true?

This is the theorem that makes RSA actually usable: it guarantees that whatever the sender encrypts with the public exponent, the holder of the private exponent can always decrypt, for every possible message, not just most of them — the proof has to handle the edge case where a message accidentally shares a factor with the modulus.

Proof sketch

Since ed≡1(modϕ(n))ed \equiv 1 \pmod{\phi(n)}, by definition of modular congruence there is a non-negative integer kk with ed=1+kϕ(n)ed = 1 + k\phi(n).

Case 1: gcd⁡(m,n)=1\gcd(m,n)=1. Euler's theorem gives mϕ(n)≡1(modn)m^{\phi(n)} \equiv 1 \pmod n, so raising both sides to the power kk and multiplying by mm gives med=m⋅(mϕ(n))k≡m⋅1k≡m(modn)m^{ed} = m \cdot (m^{\phi(n)})^{k} \equiv m \cdot 1^{k} \equiv m \pmod n.

Case 2: gcd⁡(m,n)≠1\gcd(m,n) \ne 1. Since n=pqn = pq, this means pp divides mm or qq divides mm (not both, since mm is smaller than nn). Working modulo pp: if pp divides mm then both mm and medm^{ed} are congruent to 00 modulo pp; otherwise gcd⁡(m,p)=1\gcd(m,p)=1 and Fermat's little theorem gives mp−1≡1(modp)m^{p-1} \equiv 1 \pmod p, and since (p−1)(p-1) divides ϕ(n)\phi(n) the same computation as Case 1 shows med≡m(modp)m^{ed} \equiv m \pmod p. The identical argument modulo qq shows med≡m(modq)m^{ed} \equiv m \pmod q.

By the Chinese Remainder Theorem, a congruence that holds modulo pp and modulo qq separately also holds modulo their product n=pqn=pq, so (me)d≡m(modn)(m^e)^d \equiv m \pmod n holds for every message mm, not just those coprime to nn.

Topics that use this theorem

Step-by-step proofs

No step-by-step proof yet for this theorem.

References

  1. Alfred J. Menezes, Paul C. van Oorschot, Scott A. Vanstone (1996). Handbook of Applied Cryptography
  2. Peter W. Shor (1994). Algorithms for Quantum Computation: Discrete Logarithms and Factoring · arXiv:quant-ph/9508027
  3. National Institute of Standards and Technology (2024). Module-Lattice-Based Key-Encapsulation Mechanism Standard (FIPS 203)