6

I think I roughly understand how the RSA algorithm works.

However, I don't understand why we need the $N$, which we use as a modulus, to be $pq$ for some large primes $p, q$.

I vaguely know it has something to do with factorization, but I am kind of lost. So, hypothetical questions.

  • What would happen if the $N$ was not $pq$, but just a big prime?
  • What if $N$ would be some random composite (that's easy to factor)?

The other parts of RSA would stay the same.

FLAK-ZOSO
  • 115
  • 6
Karel Bílek
  • 235
  • 3
  • 8

1 Answers1

10

RSA would still "work" with such $N$, but isn't secure for $N$ that are easily factored. If you know the factorization of $N$ (which is trivial for prime $N$s) you can calculate the private key from the public key. This totally breaks the desired security properties of RSA.

The essential equation for RSA is that $m^{\phi(N)+1}= m \mod N $ for all $m$. This works for all $N$, but only for some $N$ it's hard to calculate $\phi(N)$. When using RSA we require $\phi(N)$ being hard to calculate, since once you know $\phi(N)$ you can get $d$ from $e$ by solving $e \cdot d = 1 \mod \phi(N)$ using the extended Euclidean algorithm (just like what you do when legitimately creating the key-pair).

If $N$ has more than two factors, but at least two of those are large and hard to guess, it's still secure. But almost nobody uses this RSA variation.

CodesInChaos
  • 25,121
  • 2
  • 90
  • 129