4

Hi I know there have been other questions like this on here, namely here.

But of all the solutions I have seen of this problem, $e_1$ and $e_2$ are relatively prime, which is how we can get to the final equation $m \equiv c_1^{\,a} \cdot c_2^{\,b} \pmod n $, where $a$ and $b$ are from the equation $a\cdot e_1 + b\cdot e_2 =\gcd(e_1,e_2)$ from the extended euclidean algorithm.

However I'm wondering how to do it where $\gcd(e_1, e_2) >1$. I can get to a point where I have $m^{\gcd(e_1,e_2)} \equiv c_1^{\,a} \cdot c_2^{\,b}$ (as with the other solutions). But with $\gcd(e_1,e_2) \neq 1$, I am at square one with having $m$ under an exponent.

Is there another way to do this or a way to solve this problem?

fgrieu
  • 149,326
  • 13
  • 324
  • 622
amycandyit
  • 41
  • 1
  • 3

1 Answers1

9

Is there another way to do this or a way to solve this problem?

We hope not; otherwise, you can break RSA.

Suppose you did have a way that, given $m^{e_1} \bmod n$ and $m^{e_2} \bmod n$ (and $e_1$ and $e_2$), you could recover $m$ (even if $e_1, e_2$ were not relatively prime).

Then, given $m^e \bmod n$ and $e$ (which is standard RSA), here is what you can do: you can select random values $r_1, r_2$ and compute $e_1 = e \cdot r_1$ and $e_2 = e \cdot r_2$. Then, you compute $(m^e)^{r_1} = m^{e_1} \pmod{n}$ and $(m^e)^{r_2} = m^{e_2} \pmod {n}$. You can then give these values to the method, and since you have satisfied all the requirements, your method will give you $m$, and so solving the RSA problem.

Again, we certainly hope RSA can't be broken that easily...

poncho
  • 154,064
  • 12
  • 239
  • 382