CINXE.COM

<!DOCTYPE html> <html class="client-nojs vector-feature-language-in-header-enabled vector-feature-language-in-main-page-header-disabled vector-feature-sticky-header-disabled vector-feature-page-tools-pinned-disabled vector-feature-toc-pinned-clientpref-1 vector-feature-main-menu-pinned-disabled vector-feature-limited-width-clientpref-1 vector-feature-limited-width-content-enabled vector-feature-custom-font-size-clientpref-1 vector-feature-appearance-pinned-clientpref-1 vector-feature-night-mode-enabled skin-theme-clientpref-day vector-toc-available" lang="en" dir="ltr"> <head> <meta charset="UTF-8"> <title>RSA (cryptosystem) - Wikipedia</title> <script>(function(){var className="client-js vector-feature-language-in-header-enabled vector-feature-language-in-main-page-header-disabled vector-feature-sticky-header-disabled vector-feature-page-tools-pinned-disabled vector-feature-toc-pinned-clientpref-1 vector-feature-main-menu-pinned-disabled vector-feature-limited-width-clientpref-1 vector-feature-limited-width-content-enabled vector-feature-custom-font-size-clientpref-1 vector-feature-appearance-pinned-clientpref-1 vector-feature-night-mode-enabled skin-theme-clientpref-day vector-toc-available";var cookie=document.cookie.match(/(?:^|; )enwikimwclientpreferences=([^;]+)/);if(cookie){cookie[1].split('%2C').forEach(function(pref){className=className.replace(new RegExp('(^| )'+pref.replace(/-clientpref-\w+$|[^\w-]+/g,'')+'-clientpref-\\w+( |$)'),'$1'+pref+'$2');});}document.documentElement.className=className;}());RLCONF={"wgBreakFrames":false,"wgSeparatorTransformTable":["",""],"wgDigitTransformTable":["",""],"wgDefaultDateFormat":"dmy", "wgMonthNames":["","January","February","March","April","May","June","July","August","September","October","November","December"],"wgRequestId":"a11e5500-160e-43f7-8897-b396488e9342","wgCanonicalNamespace":"","wgCanonicalSpecialPageName":false,"wgNamespaceNumber":0,"wgPageName":"RSA_(cryptosystem)","wgTitle":"RSA (cryptosystem)","wgCurRevisionId":1258725874,"wgRevisionId":1258725874,"wgArticleId":25385,"wgIsArticle":true,"wgIsRedirect":false,"wgAction":"view","wgUserName":null,"wgUserGroups":["*"],"wgCategories":["Wikipedia articles needing clarification from June 2020","Articles with short description","Short description matches Wikidata","All articles with self-published sources","Articles with self-published sources from December 2023","All articles with failed verification","Articles with failed verification from April 2022","All articles with unsourced statements","Articles with unsourced statements from February 2015","All articles that may contain original research", "Articles that may contain original research from August 2019","Articles with unsourced statements from December 2023","Articles containing potentially dated statements from 2020","All articles containing potentially dated statements","Articles needing additional references from October 2017","All articles needing additional references","Public-key encryption schemes","Digital signature schemes"],"wgPageViewLanguage":"en","wgPageContentLanguage":"en","wgPageContentModel":"wikitext","wgRelevantPageName":"RSA_(cryptosystem)","wgRelevantArticleId":25385,"wgIsProbablyEditable":true,"wgRelevantPageIsProbablyEditable":true,"wgRestrictionEdit":[],"wgRestrictionMove":[],"wgRedirectedFrom":"RSA_(algorithm)","wgNoticeProject":"wikipedia","wgCiteReferencePreviewsActive":false,"wgFlaggedRevsParams":{"tags":{"status":{"levels":1}}},"wgMediaViewerOnClick":true,"wgMediaViewerEnabledByDefault":true,"wgPopupsFlags":0,"wgVisualEditor":{"pageLanguageCode":"en","pageLanguageDir":"ltr", "pageVariantFallbacks":"en"},"wgMFDisplayWikibaseDescriptions":{"search":true,"watchlist":true,"tagline":false,"nearby":true},"wgWMESchemaEditAttemptStepOversample":false,"wgWMEPageLength":60000,"wgInternalRedirectTargetUrl":"/wiki/RSA_(cryptosystem)","wgRelatedArticlesCompat":[],"wgEditSubmitButtonLabelPublish":true,"wgULSPosition":"interlanguage","wgULSisCompactLinksEnabled":false,"wgVector2022LanguageInHeader":true,"wgULSisLanguageSelectorEmpty":false,"wgWikibaseItemId":"Q181551","wgCheckUserClientHintsHeadersJsApi":["brands","architecture","bitness","fullVersionList","mobile","model","platform","platformVersion"],"GEHomepageSuggestedEditsEnableTopics":true,"wgGETopicsMatchModeEnabled":false,"wgGEStructuredTaskRejectionReasonTextInputEnabled":false,"wgGELevelingUpEnabledForUser":false};RLSTATE={"ext.globalCssJs.user.styles":"ready","site.styles":"ready","user.styles":"ready","ext.globalCssJs.user":"ready","user":"ready","user.options":"loading","ext.cite.styles":"ready", "ext.math.styles":"ready","skins.vector.search.codex.styles":"ready","skins.vector.styles":"ready","skins.vector.icons":"ready","jquery.makeCollapsible.styles":"ready","ext.wikimediamessages.styles":"ready","ext.visualEditor.desktopArticleTarget.noscript":"ready","ext.uls.interlanguage":"ready","wikibase.client.init":"ready","ext.wikimediaBadges":"ready"};RLPAGEMODULES=["mediawiki.action.view.redirect","ext.cite.ux-enhancements","mediawiki.page.media","site","mediawiki.page.ready","jquery.makeCollapsible","mediawiki.toc","skins.vector.js","ext.centralNotice.geoIP","ext.centralNotice.startUp","ext.gadget.ReferenceTooltips","ext.gadget.switcher","ext.urlShortener.toolbar","ext.centralauth.centralautologin","mmv.bootstrap","ext.popups","ext.visualEditor.desktopArticleTarget.init","ext.visualEditor.targetLoader","ext.echo.centralauth","ext.eventLogging","ext.wikimediaEvents","ext.navigationTiming","ext.uls.interface","ext.cx.eventlogging.campaigns","ext.cx.uls.quick.actions", "wikibase.client.vector-2022","ext.checkUser.clientHints","ext.quicksurveys.init","ext.growthExperiments.SuggestedEditSession","wikibase.sidebar.tracking"];</script> <script>(RLQ=window.RLQ||[]).push(function(){mw.loader.impl(function(){return["user.options@12s5i",function($,jQuery,require,module){mw.user.tokens.set({"patrolToken":"+\\","watchToken":"+\\","csrfToken":"+\\"}); }];});});</script> <link rel="stylesheet" href="/w/load.php?lang=en&modules=ext.cite.styles%7Cext.math.styles%7Cext.uls.interlanguage%7Cext.visualEditor.desktopArticleTarget.noscript%7Cext.wikimediaBadges%7Cext.wikimediamessages.styles%7Cjquery.makeCollapsible.styles%7Cskins.vector.icons%2Cstyles%7Cskins.vector.search.codex.styles%7Cwikibase.client.init&only=styles&skin=vector-2022"> <script async="" src="/w/load.php?lang=en&modules=startup&only=scripts&raw=1&skin=vector-2022"></script> <meta name="ResourceLoaderDynamicStyles" content=""> <link rel="stylesheet" href="/w/load.php?lang=en&modules=site.styles&only=styles&skin=vector-2022"> <meta name="generator" content="MediaWiki 1.44.0-wmf.5"> <meta name="referrer" content="origin"> <meta name="referrer" content="origin-when-cross-origin"> <meta name="robots" content="max-image-preview:standard"> <meta name="format-detection" content="telephone=no"> <meta name="viewport" content="width=1120"> <meta property="og:title" content="RSA (cryptosystem) - Wikipedia"> <meta property="og:type" content="website"> <link rel="preconnect" href="//upload.wikimedia.org"> <link rel="alternate" media="only screen and (max-width: 640px)" href="//en.m.wikipedia.org/wiki/RSA_(cryptosystem)"> <link rel="alternate" type="application/x-wiki" title="Edit this page" href="/w/index.php?title=RSA_(cryptosystem)&action=edit"> <link rel="apple-touch-icon" href="/static/apple-touch/wikipedia.png"> <link rel="icon" href="/static/favicon/wikipedia.ico"> <link rel="search" type="application/opensearchdescription+xml" href="/w/rest.php/v1/search" title="Wikipedia (en)"> <link rel="EditURI" type="application/rsd+xml" href="//en.wikipedia.org/w/api.php?action=rsd"> <link rel="canonical" href="https://en.wikipedia.org/wiki/RSA_(cryptosystem)"> <link rel="license" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en"> <link rel="alternate" type="application/atom+xml" title="Wikipedia Atom feed" href="/w/index.php?title=Special:RecentChanges&feed=atom"> <link rel="dns-prefetch" href="//meta.wikimedia.org" /> <link rel="dns-prefetch" href="//login.wikimedia.org"> </head> <body class="skin--responsive skin-vector skin-vector-search-vue mediawiki ltr sitedir-ltr mw-hide-empty-elt ns-0 ns-subject mw-editable page-RSA_cryptosystem rootpage-RSA_cryptosystem skin-vector-2022 action-view"><a class="mw-jump-link" href="#bodyContent">Jump to content</a> <div class="vector-header-container"> <header class="vector-header mw-header"> <div class="vector-header-start"> <nav class="vector-main-menu-landmark" aria-label="Site"> <div id="vector-main-menu-dropdown" class="vector-dropdown vector-main-menu-dropdown vector-button-flush-left vector-button-flush-right" > <input type="checkbox" id="vector-main-menu-dropdown-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-vector-main-menu-dropdown" class="vector-dropdown-checkbox " aria-label="Main menu" > <label id="vector-main-menu-dropdown-label" for="vector-main-menu-dropdown-checkbox" class="vector-dropdown-label cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet cdx-button--icon-only " aria-hidden="true" > Main menu </label> <div class="vector-dropdown-content"> <div id="vector-main-menu-unpinned-container" class="vector-unpinned-container"> <div id="vector-main-menu" class="vector-main-menu vector-pinnable-element"> <div class="vector-pinnable-header vector-main-menu-pinnable-header vector-pinnable-header-unpinned" data-feature-name="main-menu-pinned" data-pinnable-element-id="vector-main-menu" data-pinned-container-id="vector-main-menu-pinned-container" data-unpinned-container-id="vector-main-menu-unpinned-container" > <div class="vector-pinnable-header-label">Main menu</div> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-pin-button" data-event-name="pinnable-header.vector-main-menu.pin">move to sidebar</button> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-unpin-button" data-event-name="pinnable-header.vector-main-menu.unpin">hide</button> </div> <div id="p-navigation" class="vector-menu mw-portlet mw-portlet-navigation" > <div class="vector-menu-heading"> Navigation </div> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="n-mainpage-description" class="mw-list-item"><a href="/wiki/Main_Page" title="Visit the main page [z]" accesskey="z">Main page</a></li><li id="n-contents" class="mw-list-item"><a href="/wiki/Wikipedia:Contents" title="Guides to browsing Wikipedia">Contents</a></li><li id="n-currentevents" class="mw-list-item"><a href="/wiki/Portal:Current_events" title="Articles related to current events">Current events</a></li><li id="n-randompage" class="mw-list-item"><a href="/wiki/Special:Random" title="Visit a randomly selected article [x]" accesskey="x">Random article</a></li><li id="n-aboutsite" class="mw-list-item"><a href="/wiki/Wikipedia:About" title="Learn about Wikipedia and how it works">About Wikipedia</a></li><li id="n-contactpage" class="mw-list-item"><a href="//en.wikipedia.org/wiki/Wikipedia:Contact_us" title="How to contact Wikipedia">Contact us</a></li> </ul> </div> </div> <div id="p-interaction" class="vector-menu mw-portlet mw-portlet-interaction" > <div class="vector-menu-heading"> Contribute </div> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="n-help" class="mw-list-item"><a href="/wiki/Help:Contents" title="Guidance on how to use and edit Wikipedia">Help</a></li><li id="n-introduction" class="mw-list-item"><a href="/wiki/Help:Introduction" title="Learn how to edit Wikipedia">Learn to edit</a></li><li id="n-portal" class="mw-list-item"><a href="/wiki/Wikipedia:Community_portal" title="The hub for editors">Community portal</a></li><li id="n-recentchanges" class="mw-list-item"><a href="/wiki/Special:RecentChanges" title="A list of recent changes to Wikipedia [r]" accesskey="r">Recent changes</a></li><li id="n-upload" class="mw-list-item"><a href="/wiki/Wikipedia:File_upload_wizard" title="Add images or other media for use on Wikipedia">Upload file</a></li> </ul> </div> </div> </div> </div> </div> </div> </nav> <a href="/wiki/Main_Page" class="mw-logo"> <img class="mw-logo-icon" src="/static/images/icons/wikipedia.png" alt="" aria-hidden="true" height="50" width="50"> <img class="mw-logo-wordmark" alt="Wikipedia" src="/static/images/mobile/copyright/wikipedia-wordmark-en.svg" style="width: 7.5em; height: 1.125em;"> <img class="mw-logo-tagline" alt="The Free Encyclopedia" src="/static/images/mobile/copyright/wikipedia-tagline-en.svg" width="117" height="13" style="width: 7.3125em; height: 0.8125em;"> </a> </div> <div class="vector-header-end"> <div id="p-search" role="search" class="vector-search-box-vue vector-search-box-collapses vector-search-box-show-thumbnail vector-search-box-auto-expand-width vector-search-box"> <a href="/wiki/Special:Search" class="cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet cdx-button--icon-only search-toggle" title="Search Wikipedia [f]" accesskey="f"> Search </a> <div class="vector-typeahead-search-container"> <div class="cdx-typeahead-search cdx-typeahead-search--show-thumbnail cdx-typeahead-search--auto-expand-width"> <form action="/w/index.php" id="searchform" class="cdx-search-input cdx-search-input--has-end-button"> <div id="simpleSearch" class="cdx-search-input__input-wrapper" data-search-loc="header-moved"> <div class="cdx-text-input cdx-text-input--has-start-icon"> <input class="cdx-text-input__input" type="search" name="search" placeholder="Search Wikipedia" aria-label="Search Wikipedia" autocapitalize="sentences" title="Search Wikipedia [f]" accesskey="f" id="searchInput" > </div> <input type="hidden" name="title" value="Special:Search"> </div> <button class="cdx-button cdx-search-input__end-button">Search</button> </form> </div> </div> </div> <nav class="vector-user-links vector-user-links-wide" aria-label="Personal tools"> <div class="vector-user-links-main"> <div id="p-vector-user-menu-preferences" class="vector-menu mw-portlet emptyPortlet" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> </ul> </div> </div> <div id="p-vector-user-menu-userpage" class="vector-menu mw-portlet emptyPortlet" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> </ul> </div> </div> <nav class="vector-appearance-landmark" aria-label="Appearance"> <div id="vector-appearance-dropdown" class="vector-dropdown " title="Change the appearance of the page's font size, width, and color" > <input type="checkbox" id="vector-appearance-dropdown-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-vector-appearance-dropdown" class="vector-dropdown-checkbox " aria-label="Appearance" > <label id="vector-appearance-dropdown-label" for="vector-appearance-dropdown-checkbox" class="vector-dropdown-label cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet cdx-button--icon-only " aria-hidden="true" > Appearance </label> <div class="vector-dropdown-content"> <div id="vector-appearance-unpinned-container" class="vector-unpinned-container"> </div> </div> </div> </nav> <div id="p-vector-user-menu-notifications" class="vector-menu mw-portlet emptyPortlet" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> </ul> </div> </div> <div id="p-vector-user-menu-overflow" class="vector-menu mw-portlet" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="pt-sitesupport-2" class="user-links-collapsible-item mw-list-item user-links-collapsible-item"><a data-mw="interface" href="https://donate.wikimedia.org/wiki/Special:FundraiserRedirector?utm_source=donate&utm_medium=sidebar&utm_campaign=C13_en.wikipedia.org&uselang=en" class="">Donate</a> </li> <li id="pt-createaccount-2" class="user-links-collapsible-item mw-list-item user-links-collapsible-item"><a data-mw="interface" href="/w/index.php?title=Special:CreateAccount&returnto=RSA+%28cryptosystem%29" title="You are encouraged to create an account and log in; however, it is not mandatory" class="">Create account</a> </li> <li id="pt-login-2" class="user-links-collapsible-item mw-list-item user-links-collapsible-item"><a data-mw="interface" href="/w/index.php?title=Special:UserLogin&returnto=RSA+%28cryptosystem%29" title="You're encouraged to log in; however, it's not mandatory. [o]" accesskey="o" class="">Log in</a> </li> </ul> </div> </div> </div> <div id="vector-user-links-dropdown" class="vector-dropdown vector-user-menu vector-button-flush-right vector-user-menu-logged-out" title="Log in and more options" > <input type="checkbox" id="vector-user-links-dropdown-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-vector-user-links-dropdown" class="vector-dropdown-checkbox " aria-label="Personal tools" > <label id="vector-user-links-dropdown-label" for="vector-user-links-dropdown-checkbox" class="vector-dropdown-label cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet cdx-button--icon-only " aria-hidden="true" > Personal tools </label> <div class="vector-dropdown-content"> <div id="p-personal" class="vector-menu mw-portlet mw-portlet-personal user-links-collapsible-item" title="User menu" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="pt-sitesupport" class="user-links-collapsible-item mw-list-item"><a href="https://donate.wikimedia.org/wiki/Special:FundraiserRedirector?utm_source=donate&utm_medium=sidebar&utm_campaign=C13_en.wikipedia.org&uselang=en">Donate</a></li><li id="pt-createaccount" class="user-links-collapsible-item mw-list-item"><a href="/w/index.php?title=Special:CreateAccount&returnto=RSA+%28cryptosystem%29" title="You are encouraged to create an account and log in; however, it is not mandatory"> Create account</a></li><li id="pt-login" class="user-links-collapsible-item mw-list-item"><a href="/w/index.php?title=Special:UserLogin&returnto=RSA+%28cryptosystem%29" title="You're encouraged to log in; however, it's not mandatory. [o]" accesskey="o"> Log in</a></li> </ul> </div> </div> <div id="p-user-menu-anon-editor" class="vector-menu mw-portlet mw-portlet-user-menu-anon-editor" > <div class="vector-menu-heading"> Pages for logged out editors <a href="/wiki/Help:Introduction" aria-label="Learn more about editing">learn more</a> </div> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="pt-anoncontribs" class="mw-list-item"><a href="/wiki/Special:MyContributions" title="A list of edits made from this IP address [y]" accesskey="y">Contributions</a></li><li id="pt-anontalk" class="mw-list-item"><a href="/wiki/Special:MyTalk" title="Discussion about edits from this IP address [n]" accesskey="n">Talk</a></li> </ul> </div> </div> </div> </div> </nav> </div> </header> </div> <div class="mw-page-container"> <div class="mw-page-container-inner"> <div class="vector-sitenotice-container"> <div id="siteNotice"></div> </div> <div class="vector-column-start"> <div class="vector-main-menu-container"> <div id="mw-navigation"> <nav id="mw-panel" class="vector-main-menu-landmark" aria-label="Site"> <div id="vector-main-menu-pinned-container" class="vector-pinned-container"> </div> </nav> </div> </div> <div class="vector-sticky-pinned-container"> <nav id="mw-panel-toc" aria-label="Contents" data-event-name="ui.sidebar-toc" class="mw-table-of-contents-container vector-toc-landmark"> <div id="vector-toc-pinned-container" class="vector-pinned-container"> <div id="vector-toc" class="vector-toc vector-pinnable-element"> <div class="vector-pinnable-header vector-toc-pinnable-header vector-pinnable-header-pinned" data-feature-name="toc-pinned" data-pinnable-element-id="vector-toc" > <h2 class="vector-pinnable-header-label">Contents</h2> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-pin-button" data-event-name="pinnable-header.vector-toc.pin">move to sidebar</button> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-unpin-button" data-event-name="pinnable-header.vector-toc.unpin">hide</button> </div> <ul class="vector-toc-contents" id="mw-panel-toc-list"> <li id="toc-mw-content-text" class="vector-toc-list-item vector-toc-level-1"> <a href="#" class="vector-toc-link"> <div class="vector-toc-text">(Top)</div> </a> </li> <li id="toc-History" class="vector-toc-list-item vector-toc-level-1"> <a class="vector-toc-link" href="#History"> <div class="vector-toc-text"> 1 History </div> </a> <ul id="toc-History-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Patent" class="vector-toc-list-item vector-toc-level-1"> <a class="vector-toc-link" href="#Patent"> <div class="vector-toc-text"> 2 Patent </div> </a> <ul id="toc-Patent-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Operation" class="vector-toc-list-item vector-toc-level-1"> <a class="vector-toc-link" href="#Operation"> <div class="vector-toc-text"> 3 Operation </div> </a> <button aria-controls="toc-Operation-sublist" class="cdx-button cdx-button--weight-quiet cdx-button--icon-only vector-toc-toggle"> Toggle Operation subsection </button> <ul id="toc-Operation-sublist" class="vector-toc-list"> <li id="toc-Key_generation" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Key_generation"> <div class="vector-toc-text"> 3.1 Key generation </div> </a> <ul id="toc-Key_generation-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Key_distribution" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Key_distribution"> <div class="vector-toc-text"> 3.2 Key distribution </div> </a> <ul id="toc-Key_distribution-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Encryption" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Encryption"> <div class="vector-toc-text"> 3.3 Encryption </div> </a> <ul id="toc-Encryption-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Decryption" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Decryption"> <div class="vector-toc-text"> 3.4 Decryption </div> </a> <ul id="toc-Decryption-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Example" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Example"> <div class="vector-toc-text"> 3.5 Example </div> </a> <ul id="toc-Example-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Signing_messages" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Signing_messages"> <div class="vector-toc-text"> 3.6 Signing messages </div> </a> <ul id="toc-Signing_messages-sublist" class="vector-toc-list"> </ul> </li> </ul> </li> <li id="toc-Proofs_of_correctness" class="vector-toc-list-item vector-toc-level-1"> <a class="vector-toc-link" href="#Proofs_of_correctness"> <div class="vector-toc-text"> 4 Proofs of correctness </div> </a> <button aria-controls="toc-Proofs_of_correctness-sublist" class="cdx-button cdx-button--weight-quiet cdx-button--icon-only vector-toc-toggle"> Toggle Proofs of correctness subsection </button> <ul id="toc-Proofs_of_correctness-sublist" class="vector-toc-list"> <li id="toc-Proof_using_Fermat's_little_theorem" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Proof_using_Fermat's_little_theorem"> <div class="vector-toc-text"> 4.1 Proof using Fermat's little theorem </div> </a> <ul id="toc-Proof_using_Fermat's_little_theorem-sublist" class="vector-toc-list"> <li id="toc-Notes" class="vector-toc-list-item vector-toc-level-3"> <a class="vector-toc-link" href="#Notes"> <div class="vector-toc-text"> 4.1.1 Notes </div> </a> <ul id="toc-Notes-sublist" class="vector-toc-list"> </ul> </li> </ul> </li> <li id="toc-Proof_using_Euler's_theorem" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Proof_using_Euler's_theorem"> <div class="vector-toc-text"> 4.2 Proof using Euler's theorem </div> </a> <ul id="toc-Proof_using_Euler's_theorem-sublist" class="vector-toc-list"> </ul> </li> </ul> </li> <li id="toc-Padding" class="vector-toc-list-item vector-toc-level-1"> <a class="vector-toc-link" href="#Padding"> <div class="vector-toc-text"> 5 Padding </div> </a> <button aria-controls="toc-Padding-sublist" class="cdx-button cdx-button--weight-quiet cdx-button--icon-only vector-toc-toggle"> Toggle Padding subsection </button> <ul id="toc-Padding-sublist" class="vector-toc-list"> <li id="toc-Attacks_against_plain_RSA" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Attacks_against_plain_RSA"> <div class="vector-toc-text"> 5.1 Attacks against plain RSA </div> </a> <ul id="toc-Attacks_against_plain_RSA-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Padding_schemes" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Padding_schemes"> <div class="vector-toc-text"> 5.2 Padding schemes </div> </a> <ul id="toc-Padding_schemes-sublist" class="vector-toc-list"> </ul> </li> </ul> </li> <li id="toc-Security_and_practical_considerations" class="vector-toc-list-item vector-toc-level-1"> <a class="vector-toc-link" href="#Security_and_practical_considerations"> <div class="vector-toc-text"> 6 Security and practical considerations </div> </a> <button aria-controls="toc-Security_and_practical_considerations-sublist" class="cdx-button cdx-button--weight-quiet cdx-button--icon-only vector-toc-toggle"> Toggle Security and practical considerations subsection </button> <ul id="toc-Security_and_practical_considerations-sublist" class="vector-toc-list"> <li id="toc-Using_the_Chinese_remainder_algorithm" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Using_the_Chinese_remainder_algorithm"> <div class="vector-toc-text"> 6.1 Using the Chinese remainder algorithm </div> </a> <ul id="toc-Using_the_Chinese_remainder_algorithm-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Integer_factorization_and_the_RSA_problem" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Integer_factorization_and_the_RSA_problem"> <div class="vector-toc-text"> 6.2 Integer factorization and the RSA problem </div> </a> <ul id="toc-Integer_factorization_and_the_RSA_problem-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Faulty_key_generation" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Faulty_key_generation"> <div class="vector-toc-text"> 6.3 Faulty key generation </div> </a> <ul id="toc-Faulty_key_generation-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Importance_of_strong_random_number_generation" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Importance_of_strong_random_number_generation"> <div class="vector-toc-text"> 6.4 Importance of strong random number generation </div> </a> <ul id="toc-Importance_of_strong_random_number_generation-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Timing_attacks" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Timing_attacks"> <div class="vector-toc-text"> 6.5 Timing attacks </div> </a> <ul id="toc-Timing_attacks-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Adaptive_chosen-ciphertext_attacks" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Adaptive_chosen-ciphertext_attacks"> <div class="vector-toc-text"> 6.6 Adaptive chosen-ciphertext attacks </div> </a> <ul id="toc-Adaptive_chosen-ciphertext_attacks-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Side-channel_analysis_attacks" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Side-channel_analysis_attacks"> <div class="vector-toc-text"> 6.7 Side-channel analysis attacks </div> </a> <ul id="toc-Side-channel_analysis_attacks-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Tricky_implementation" class="vector-toc-list-item vector-toc-level-2"> <a class="vector-toc-link" href="#Tricky_implementation"> <div class="vector-toc-text"> 6.8 Tricky implementation </div> </a> <ul id="toc-Tricky_implementation-sublist" class="vector-toc-list"> </ul> </li> </ul> </li> <li id="toc-Implementations" class="vector-toc-list-item vector-toc-level-1"> <a class="vector-toc-link" href="#Implementations"> <div class="vector-toc-text"> 7 Implementations </div> </a> <ul id="toc-Implementations-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-See_also" class="vector-toc-list-item vector-toc-level-1"> <a class="vector-toc-link" href="#See_also"> <div class="vector-toc-text"> 8 See also </div> </a> <ul id="toc-See_also-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Notes_2" class="vector-toc-list-item vector-toc-level-1"> <a class="vector-toc-link" href="#Notes_2"> <div class="vector-toc-text"> 9 Notes </div> </a> <ul id="toc-Notes_2-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-References" class="vector-toc-list-item vector-toc-level-1"> <a class="vector-toc-link" href="#References"> <div class="vector-toc-text"> 10 References </div> </a> <ul id="toc-References-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-Further_reading" class="vector-toc-list-item vector-toc-level-1"> <a class="vector-toc-link" href="#Further_reading"> <div class="vector-toc-text"> 11 Further reading </div> </a> <ul id="toc-Further_reading-sublist" class="vector-toc-list"> </ul> </li> <li id="toc-External_links" class="vector-toc-list-item vector-toc-level-1"> <a class="vector-toc-link" href="#External_links"> <div class="vector-toc-text"> 12 External links </div> </a> <ul id="toc-External_links-sublist" class="vector-toc-list"> </ul> </li> </ul> </div> </div> </nav> </div> </div> <div class="mw-content-container"> <main id="content" class="mw-body"> <header class="mw-body-header vector-page-titlebar"> <nav aria-label="Contents" class="vector-toc-landmark"> <div id="vector-page-titlebar-toc" class="vector-dropdown vector-page-titlebar-toc vector-button-flush-left" > <input type="checkbox" id="vector-page-titlebar-toc-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-vector-page-titlebar-toc" class="vector-dropdown-checkbox " aria-label="Toggle the table of contents" > <label id="vector-page-titlebar-toc-label" for="vector-page-titlebar-toc-checkbox" class="vector-dropdown-label cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet cdx-button--icon-only " aria-hidden="true" > Toggle the table of contents </label> <div class="vector-dropdown-content"> <div id="vector-page-titlebar-toc-unpinned-container" class="vector-unpinned-container"> </div> </div> </div> </nav> <h1 id="firstHeading" class="firstHeading mw-first-heading">RSA (cryptosystem)</h1> <div id="p-lang-btn" class="vector-dropdown mw-portlet mw-portlet-lang" > <input type="checkbox" id="p-lang-btn-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-p-lang-btn" class="vector-dropdown-checkbox mw-interlanguage-selector" aria-label="Go to an article in another language. Available in 51 languages" > <label id="p-lang-btn-label" for="p-lang-btn-checkbox" class="vector-dropdown-label cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet cdx-button--action-progressive mw-portlet-lang-heading-51" aria-hidden="true" > 51 languages </label> <div class="vector-dropdown-content"> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li class="interlanguage-link interwiki-ar mw-list-item"><a href="https://ar.wikipedia.org/wiki/%D8%AE%D9%88%D8%A7%D8%B1%D8%B2%D9%85%D9%8A%D8%A9_%D8%A2%D8%B1_%D8%A5%D8%B3_%D8%A5%D9%8A%D9%87" title="خوارزمية آر إس إيه – Arabic" lang="ar" hreflang="ar" data-title="خوارزمية آر إس إيه" data-language-autonym="العربية" data-language-local-name="Arabic" class="interlanguage-link-target">العربية</a></li><li class="interlanguage-link interwiki-bn mw-list-item"><a href="https://bn.wikipedia.org/wiki/%E0%A6%86%E0%A6%B0%E0%A6%8F%E0%A6%B8%E0%A6%8F_%E0%A6%97%E0%A7%81%E0%A6%AA%E0%A7%8D%E0%A6%A4%E0%A6%AC%E0%A6%BF%E0%A6%A6%E0%A7%8D%E0%A6%AF%E0%A6%BE" title="আরএসএ গুপ্তবিদ্যা – Bangla" lang="bn" hreflang="bn" data-title="আরএসএ গুপ্তবিদ্যা" data-language-autonym="বাংলা" data-language-local-name="Bangla" class="interlanguage-link-target">বাংলা</a></li><li class="interlanguage-link interwiki-be-x-old mw-list-item"><a href="https://be-tarask.wikipedia.org/wiki/RSA" title="RSA – Belarusian (Taraškievica orthography)" lang="be-tarask" hreflang="be-tarask" data-title="RSA" data-language-autonym="Беларуская (тарашкевіца)" data-language-local-name="Belarusian (Taraškievica orthography)" class="interlanguage-link-target">Беларуская (тарашкевіца)</a></li><li class="interlanguage-link interwiki-bg mw-list-item"><a href="https://bg.wikipedia.org/wiki/RSA" title="RSA – Bulgarian" lang="bg" hreflang="bg" data-title="RSA" data-language-autonym="Български" data-language-local-name="Bulgarian" class="interlanguage-link-target">Български</a></li><li class="interlanguage-link interwiki-bs mw-list-item"><a href="https://bs.wikipedia.org/wiki/RSA" title="RSA – Bosnian" lang="bs" hreflang="bs" data-title="RSA" data-language-autonym="Bosanski" data-language-local-name="Bosnian" class="interlanguage-link-target">Bosanski</a></li><li class="interlanguage-link interwiki-ca mw-list-item"><a href="https://ca.wikipedia.org/wiki/RSA" title="RSA – Catalan" lang="ca" hreflang="ca" data-title="RSA" data-language-autonym="Català" data-language-local-name="Catalan" class="interlanguage-link-target">Català</a></li><li class="interlanguage-link interwiki-cs mw-list-item"><a href="https://cs.wikipedia.org/wiki/RSA" title="RSA – Czech" lang="cs" hreflang="cs" data-title="RSA" data-language-autonym="Čeština" data-language-local-name="Czech" class="interlanguage-link-target">Čeština</a></li><li class="interlanguage-link interwiki-da mw-list-item"><a href="https://da.wikipedia.org/wiki/RSA" title="RSA – Danish" lang="da" hreflang="da" data-title="RSA" data-language-autonym="Dansk" data-language-local-name="Danish" class="interlanguage-link-target">Dansk</a></li><li class="interlanguage-link interwiki-de mw-list-item"><a href="https://de.wikipedia.org/wiki/RSA-Kryptosystem" title="RSA-Kryptosystem – German" lang="de" hreflang="de" data-title="RSA-Kryptosystem" data-language-autonym="Deutsch" data-language-local-name="German" class="interlanguage-link-target">Deutsch</a></li><li class="interlanguage-link interwiki-et mw-list-item"><a href="https://et.wikipedia.org/wiki/RSA_(algoritm)" title="RSA (algoritm) – Estonian" lang="et" hreflang="et" data-title="RSA (algoritm)" data-language-autonym="Eesti" data-language-local-name="Estonian" class="interlanguage-link-target">Eesti</a></li><li class="interlanguage-link interwiki-el mw-list-item"><a href="https://el.wikipedia.org/wiki/RSA" title="RSA – Greek" lang="el" hreflang="el" data-title="RSA" data-language-autonym="Ελληνικά" data-language-local-name="Greek" class="interlanguage-link-target">Ελληνικά</a></li><li class="interlanguage-link interwiki-es mw-list-item"><a href="https://es.wikipedia.org/wiki/RSA" title="RSA – Spanish" lang="es" hreflang="es" data-title="RSA" data-language-autonym="Español" data-language-local-name="Spanish" class="interlanguage-link-target">Español</a></li><li class="interlanguage-link interwiki-eo mw-list-item"><a href="https://eo.wikipedia.org/wiki/RSA_(kriptado)" title="RSA (kriptado) – Esperanto" lang="eo" hreflang="eo" data-title="RSA (kriptado)" data-language-autonym="Esperanto" data-language-local-name="Esperanto" class="interlanguage-link-target">Esperanto</a></li><li class="interlanguage-link interwiki-eu mw-list-item"><a href="https://eu.wikipedia.org/wiki/RSA" title="RSA – Basque" lang="eu" hreflang="eu" data-title="RSA" data-language-autonym="Euskara" data-language-local-name="Basque" class="interlanguage-link-target">Euskara</a></li><li class="interlanguage-link interwiki-fa mw-list-item"><a href="https://fa.wikipedia.org/wiki/%D8%A2%D8%B1%D8%A7%D8%B3%E2%80%8C%D8%A7%DB%8C" title="آراس‌ای – Persian" lang="fa" hreflang="fa" data-title="آراس‌ای" data-language-autonym="فارسی" data-language-local-name="Persian" class="interlanguage-link-target">فارسی</a></li><li class="interlanguage-link interwiki-fr mw-list-item"><a href="https://fr.wikipedia.org/wiki/Chiffrement_RSA" title="Chiffrement RSA – French" lang="fr" hreflang="fr" data-title="Chiffrement RSA" data-language-autonym="Français" data-language-local-name="French" class="interlanguage-link-target">Français</a></li><li class="interlanguage-link interwiki-gl mw-list-item"><a href="https://gl.wikipedia.org/wiki/RSA" title="RSA – Galician" lang="gl" hreflang="gl" data-title="RSA" data-language-autonym="Galego" data-language-local-name="Galician" class="interlanguage-link-target">Galego</a></li><li class="interlanguage-link interwiki-ko mw-list-item"><a href="https://ko.wikipedia.org/wiki/RSA_%EC%95%94%ED%98%B8" title="RSA 암호 – Korean" lang="ko" hreflang="ko" data-title="RSA 암호" data-language-autonym="한국어" data-language-local-name="Korean" class="interlanguage-link-target">한국어</a></li><li class="interlanguage-link interwiki-hy mw-list-item"><a href="https://hy.wikipedia.org/wiki/RSA" title="RSA – Armenian" lang="hy" hreflang="hy" data-title="RSA" data-language-autonym="Հայերեն" data-language-local-name="Armenian" class="interlanguage-link-target">Հայերեն</a></li><li class="interlanguage-link interwiki-hr mw-list-item"><a href="https://hr.wikipedia.org/wiki/RSA" title="RSA – Croatian" lang="hr" hreflang="hr" data-title="RSA" data-language-autonym="Hrvatski" data-language-local-name="Croatian" class="interlanguage-link-target">Hrvatski</a></li><li class="interlanguage-link interwiki-id mw-list-item"><a href="https://id.wikipedia.org/wiki/RSA" title="RSA – Indonesian" lang="id" hreflang="id" data-title="RSA" data-language-autonym="Bahasa Indonesia" data-language-local-name="Indonesian" class="interlanguage-link-target">Bahasa Indonesia</a></li><li class="interlanguage-link interwiki-is mw-list-item"><a href="https://is.wikipedia.org/wiki/RSA" title="RSA – Icelandic" lang="is" hreflang="is" data-title="RSA" data-language-autonym="Íslenska" data-language-local-name="Icelandic" class="interlanguage-link-target">Íslenska</a></li><li class="interlanguage-link interwiki-it mw-list-item"><a href="https://it.wikipedia.org/wiki/RSA_(crittografia)" title="RSA (crittografia) – Italian" lang="it" hreflang="it" data-title="RSA (crittografia)" data-language-autonym="Italiano" data-language-local-name="Italian" class="interlanguage-link-target">Italiano</a></li><li class="interlanguage-link interwiki-he mw-list-item"><a href="https://he.wikipedia.org/wiki/RSA" title="RSA – Hebrew" lang="he" hreflang="he" data-title="RSA" data-language-autonym="עברית" data-language-local-name="Hebrew" class="interlanguage-link-target">עברית</a></li><li class="interlanguage-link interwiki-ka mw-list-item"><a href="https://ka.wikipedia.org/wiki/RSA_%E1%83%90%E1%83%9A%E1%83%92%E1%83%9D%E1%83%A0%E1%83%98%E1%83%97%E1%83%9B%E1%83%98" title="RSA ალგორითმი – Georgian" lang="ka" hreflang="ka" data-title="RSA ალგორითმი" data-language-autonym="ქართული" data-language-local-name="Georgian" class="interlanguage-link-target">ქართული</a></li><li class="interlanguage-link interwiki-lv mw-list-item"><a href="https://lv.wikipedia.org/wiki/RSA_%C5%A1ifr%C4%93%C5%A1anas_algoritms" title="RSA šifrēšanas algoritms – Latvian" lang="lv" hreflang="lv" data-title="RSA šifrēšanas algoritms" data-language-autonym="Latviešu" data-language-local-name="Latvian" class="interlanguage-link-target">Latviešu</a></li><li class="interlanguage-link interwiki-lt mw-list-item"><a href="https://lt.wikipedia.org/wiki/RSA" title="RSA – Lithuanian" lang="lt" hreflang="lt" data-title="RSA" data-language-autonym="Lietuvių" data-language-local-name="Lithuanian" class="interlanguage-link-target">Lietuvių</a></li><li class="interlanguage-link interwiki-lmo mw-list-item"><a href="https://lmo.wikipedia.org/wiki/RSA" title="RSA – Lombard" lang="lmo" hreflang="lmo" data-title="RSA" data-language-autonym="Lombard" data-language-local-name="Lombard" class="interlanguage-link-target">Lombard</a></li><li class="interlanguage-link interwiki-hu mw-list-item"><a href="https://hu.wikipedia.org/wiki/RSA-elj%C3%A1r%C3%A1s" title="RSA-eljárás – Hungarian" lang="hu" hreflang="hu" data-title="RSA-eljárás" data-language-autonym="Magyar" data-language-local-name="Hungarian" class="interlanguage-link-target">Magyar</a></li><li class="interlanguage-link interwiki-ml mw-list-item"><a href="https://ml.wikipedia.org/wiki/%E0%B4%86%E0%B5%BC.%E0%B4%8E%E0%B4%B8%E0%B5%8D.%E0%B4%8E._%E0%B4%85%E0%B5%BD%E0%B4%97%E0%B5%8A%E0%B4%B0%E0%B4%BF%E0%B4%A4%E0%B4%82" title="ആർ.എസ്.എ. അൽഗൊരിതം – Malayalam" lang="ml" hreflang="ml" data-title="ആർ.എസ്.എ. അൽഗൊരിതം" data-language-autonym="മലയാളം" data-language-local-name="Malayalam" class="interlanguage-link-target">മലയാളം</a></li><li class="interlanguage-link interwiki-ms mw-list-item"><a href="https://ms.wikipedia.org/wiki/RSA" title="RSA – Malay" lang="ms" hreflang="ms" data-title="RSA" data-language-autonym="Bahasa Melayu" data-language-local-name="Malay" class="interlanguage-link-target">Bahasa Melayu</a></li><li class="interlanguage-link interwiki-mn mw-list-item"><a href="https://mn.wikipedia.org/wiki/RSA_(%D0%B0%D0%BB%D0%B3%D0%BE%D1%80%D0%B8%D1%82%D0%BC)" title="RSA (алгоритм) – Mongolian" lang="mn" hreflang="mn" data-title="RSA (алгоритм)" data-language-autonym="Монгол" data-language-local-name="Mongolian" class="interlanguage-link-target">Монгол</a></li><li class="interlanguage-link interwiki-nl mw-list-item"><a href="https://nl.wikipedia.org/wiki/RSA_(cryptografie)" title="RSA (cryptografie) – Dutch" lang="nl" hreflang="nl" data-title="RSA (cryptografie)" data-language-autonym="Nederlands" data-language-local-name="Dutch" class="interlanguage-link-target">Nederlands</a></li><li class="interlanguage-link interwiki-ja mw-list-item"><a href="https://ja.wikipedia.org/wiki/RSA%E6%9A%97%E5%8F%B7" title="RSA暗号 – Japanese" lang="ja" hreflang="ja" data-title="RSA暗号" data-language-autonym="日本語" data-language-local-name="Japanese" class="interlanguage-link-target">日本語</a></li><li class="interlanguage-link interwiki-no mw-list-item"><a href="https://no.wikipedia.org/wiki/RSA" title="RSA – Norwegian Bokmål" lang="nb" hreflang="nb" data-title="RSA" data-language-autonym="Norsk bokmål" data-language-local-name="Norwegian Bokmål" class="interlanguage-link-target">Norsk bokmål</a></li><li class="interlanguage-link interwiki-pl mw-list-item"><a href="https://pl.wikipedia.org/wiki/RSA_(kryptografia)" title="RSA (kryptografia) – Polish" lang="pl" hreflang="pl" data-title="RSA (kryptografia)" data-language-autonym="Polski" data-language-local-name="Polish" class="interlanguage-link-target">Polski</a></li><li class="interlanguage-link interwiki-pt mw-list-item"><a href="https://pt.wikipedia.org/wiki/RSA_(sistema_criptogr%C3%A1fico)" title="RSA (sistema criptográfico) – Portuguese" lang="pt" hreflang="pt" data-title="RSA (sistema criptográfico)" data-language-autonym="Português" data-language-local-name="Portuguese" class="interlanguage-link-target">Português</a></li><li class="interlanguage-link interwiki-ro mw-list-item"><a href="https://ro.wikipedia.org/wiki/RSA" title="RSA – Romanian" lang="ro" hreflang="ro" data-title="RSA" data-language-autonym="Română" data-language-local-name="Romanian" class="interlanguage-link-target">Română</a></li><li class="interlanguage-link interwiki-qu mw-list-item"><a href="https://qu.wikipedia.org/wiki/RSA_(ukhulli_qillqay)" title="RSA (ukhulli qillqay) – Quechua" lang="qu" hreflang="qu" data-title="RSA (ukhulli qillqay)" data-language-autonym="Runa Simi" data-language-local-name="Quechua" class="interlanguage-link-target">Runa Simi</a></li><li class="interlanguage-link interwiki-ru mw-list-item"><a href="https://ru.wikipedia.org/wiki/RSA" title="RSA – Russian" lang="ru" hreflang="ru" data-title="RSA" data-language-autonym="Русский" data-language-local-name="Russian" class="interlanguage-link-target">Русский</a></li><li class="interlanguage-link interwiki-simple mw-list-item"><a href="https://simple.wikipedia.org/wiki/RSA_algorithm" title="RSA algorithm – Simple English" lang="en-simple" hreflang="en-simple" data-title="RSA algorithm" data-language-autonym="Simple English" data-language-local-name="Simple English" class="interlanguage-link-target">Simple English</a></li><li class="interlanguage-link interwiki-sl mw-list-item"><a href="https://sl.wikipedia.org/wiki/RSA" title="RSA – Slovenian" lang="sl" hreflang="sl" data-title="RSA" data-language-autonym="Slovenščina" data-language-local-name="Slovenian" class="interlanguage-link-target">Slovenščina</a></li><li class="interlanguage-link interwiki-sr mw-list-item"><a href="https://sr.wikipedia.org/wiki/RSA_(%D0%B0%D0%BB%D0%B3%D0%BE%D1%80%D0%B8%D1%82%D0%B0%D0%BC)" title="RSA (алгоритам) – Serbian" lang="sr" hreflang="sr" data-title="RSA (алгоритам)" data-language-autonym="Српски / srpski" data-language-local-name="Serbian" class="interlanguage-link-target">Српски / srpski</a></li><li class="interlanguage-link interwiki-fi mw-list-item"><a href="https://fi.wikipedia.org/wiki/RSA" title="RSA – Finnish" lang="fi" hreflang="fi" data-title="RSA" data-language-autonym="Suomi" data-language-local-name="Finnish" class="interlanguage-link-target">Suomi</a></li><li class="interlanguage-link interwiki-sv mw-list-item"><a href="https://sv.wikipedia.org/wiki/RSA" title="RSA – Swedish" lang="sv" hreflang="sv" data-title="RSA" data-language-autonym="Svenska" data-language-local-name="Swedish" class="interlanguage-link-target">Svenska</a></li><li class="interlanguage-link interwiki-th mw-list-item"><a href="https://th.wikipedia.org/wiki/%E0%B8%AD%E0%B8%B2%E0%B8%A3%E0%B9%8C%E0%B9%80%E0%B8%AD%E0%B8%AA%E0%B9%80%E0%B8%AD" title="อาร์เอสเอ – Thai" lang="th" hreflang="th" data-title="อาร์เอสเอ" data-language-autonym="ไทย" data-language-local-name="Thai" class="interlanguage-link-target">ไทย</a></li><li class="interlanguage-link interwiki-tr mw-list-item"><a href="https://tr.wikipedia.org/wiki/RSA_(%C5%9Fifreleme_y%C3%B6netimi)" title="RSA (şifreleme yönetimi) – Turkish" lang="tr" hreflang="tr" data-title="RSA (şifreleme yönetimi)" data-language-autonym="Türkçe" data-language-local-name="Turkish" class="interlanguage-link-target">Türkçe</a></li><li class="interlanguage-link interwiki-uk mw-list-item"><a href="https://uk.wikipedia.org/wiki/RSA" title="RSA – Ukrainian" lang="uk" hreflang="uk" data-title="RSA" data-language-autonym="Українська" data-language-local-name="Ukrainian" class="interlanguage-link-target">Українська</a></li><li class="interlanguage-link interwiki-vi mw-list-item"><a href="https://vi.wikipedia.org/wiki/RSA_(m%C3%A3_h%C3%B3a)" title="RSA (mã hóa) – Vietnamese" lang="vi" hreflang="vi" data-title="RSA (mã hóa)" data-language-autonym="Tiếng Việt" data-language-local-name="Vietnamese" class="interlanguage-link-target">Tiếng Việt</a></li><li class="interlanguage-link interwiki-zh-yue mw-list-item"><a href="https://zh-yue.wikipedia.org/wiki/RSA_%E5%AF%86%E7%A2%BC%E7%B3%BB%E7%B5%B1" title="RSA 密碼系統 – Cantonese" lang="yue" hreflang="yue" data-title="RSA 密碼系統" data-language-autonym="粵語" data-language-local-name="Cantonese" class="interlanguage-link-target">粵語</a></li><li class="interlanguage-link interwiki-zh mw-list-item"><a href="https://zh.wikipedia.org/wiki/RSA%E5%8A%A0%E5%AF%86%E6%BC%94%E7%AE%97%E6%B3%95" title="RSA加密演算法 – Chinese" lang="zh" hreflang="zh" data-title="RSA加密演算法" data-language-autonym="中文" data-language-local-name="Chinese" class="interlanguage-link-target">中文</a></li> </ul> <div class="after-portlet after-portlet-lang"><a href="https://www.wikidata.org/wiki/Special:EntityPage/Q181551#sitelinks-wikipedia" title="Edit interlanguage links" class="wbc-editpage">Edit links</a></div> </div> </div> </div> </header> <div class="vector-page-toolbar"> <div class="vector-page-toolbar-container"> <div id="left-navigation"> <nav aria-label="Namespaces"> <div id="p-associated-pages" class="vector-menu vector-menu-tabs mw-portlet mw-portlet-associated-pages" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="ca-nstab-main" class="selected vector-tab-noicon mw-list-item"><a href="/wiki/RSA_(cryptosystem)" title="View the content page [c]" accesskey="c">Article</a></li><li id="ca-talk" class="vector-tab-noicon mw-list-item"><a href="/wiki/Talk:RSA_(cryptosystem)" rel="discussion" title="Discuss improvements to the content page [t]" accesskey="t">Talk</a></li> </ul> </div> </div> <div id="vector-variants-dropdown" class="vector-dropdown emptyPortlet" > <input type="checkbox" id="vector-variants-dropdown-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-vector-variants-dropdown" class="vector-dropdown-checkbox " aria-label="Change language variant" > <label id="vector-variants-dropdown-label" for="vector-variants-dropdown-checkbox" class="vector-dropdown-label cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet" aria-hidden="true" >English </label> <div class="vector-dropdown-content"> <div id="p-variants" class="vector-menu mw-portlet mw-portlet-variants emptyPortlet" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> </ul> </div> </div> </div> </div> </nav> </div> <div id="right-navigation" class="vector-collapsible"> <nav aria-label="Views"> <div id="p-views" class="vector-menu vector-menu-tabs mw-portlet mw-portlet-views" > <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="ca-view" class="selected vector-tab-noicon mw-list-item"><a href="/wiki/RSA_(cryptosystem)">Read</a></li><li id="ca-edit" class="vector-tab-noicon mw-list-item"><a href="/w/index.php?title=RSA_(cryptosystem)&action=edit" title="Edit this page [e]" accesskey="e">Edit</a></li><li id="ca-history" class="vector-tab-noicon mw-list-item"><a href="/w/index.php?title=RSA_(cryptosystem)&action=history" title="Past revisions of this page [h]" accesskey="h">View history</a></li> </ul> </div> </div> </nav> <nav class="vector-page-tools-landmark" aria-label="Page tools"> <div id="vector-page-tools-dropdown" class="vector-dropdown vector-page-tools-dropdown" > <input type="checkbox" id="vector-page-tools-dropdown-checkbox" role="button" aria-haspopup="true" data-event-name="ui.dropdown-vector-page-tools-dropdown" class="vector-dropdown-checkbox " aria-label="Tools" > <label id="vector-page-tools-dropdown-label" for="vector-page-tools-dropdown-checkbox" class="vector-dropdown-label cdx-button cdx-button--fake-button cdx-button--fake-button--enabled cdx-button--weight-quiet" aria-hidden="true" >Tools </label> <div class="vector-dropdown-content"> <div id="vector-page-tools-unpinned-container" class="vector-unpinned-container"> <div id="vector-page-tools" class="vector-page-tools vector-pinnable-element"> <div class="vector-pinnable-header vector-page-tools-pinnable-header vector-pinnable-header-unpinned" data-feature-name="page-tools-pinned" data-pinnable-element-id="vector-page-tools" data-pinned-container-id="vector-page-tools-pinned-container" data-unpinned-container-id="vector-page-tools-unpinned-container" > <div class="vector-pinnable-header-label">Tools</div> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-pin-button" data-event-name="pinnable-header.vector-page-tools.pin">move to sidebar</button> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-unpin-button" data-event-name="pinnable-header.vector-page-tools.unpin">hide</button> </div> <div id="p-cactions" class="vector-menu mw-portlet mw-portlet-cactions emptyPortlet vector-has-collapsible-items" title="More options" > <div class="vector-menu-heading"> Actions </div> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="ca-more-view" class="selected vector-more-collapsible-item mw-list-item"><a href="/wiki/RSA_(cryptosystem)">Read</a></li><li id="ca-more-edit" class="vector-more-collapsible-item mw-list-item"><a href="/w/index.php?title=RSA_(cryptosystem)&action=edit" title="Edit this page [e]" accesskey="e">Edit</a></li><li id="ca-more-history" class="vector-more-collapsible-item mw-list-item"><a href="/w/index.php?title=RSA_(cryptosystem)&action=history">View history</a></li> </ul> </div> </div> <div id="p-tb" class="vector-menu mw-portlet mw-portlet-tb" > <div class="vector-menu-heading"> General </div> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="t-whatlinkshere" class="mw-list-item"><a href="/wiki/Special:WhatLinksHere/RSA_(cryptosystem)" title="List of all English Wikipedia pages containing links to this page [j]" accesskey="j">What links here</a></li><li id="t-recentchangeslinked" class="mw-list-item"><a href="/wiki/Special:RecentChangesLinked/RSA_(cryptosystem)" rel="nofollow" title="Recent changes in pages linked from this page [k]" accesskey="k">Related changes</a></li><li id="t-upload" class="mw-list-item"><a href="/wiki/Wikipedia:File_Upload_Wizard" title="Upload files [u]" accesskey="u">Upload file</a></li><li id="t-specialpages" class="mw-list-item"><a href="/wiki/Special:SpecialPages" title="A list of all special pages [q]" accesskey="q">Special pages</a></li><li id="t-permalink" class="mw-list-item"><a href="/w/index.php?title=RSA_(cryptosystem)&oldid=1258725874" title="Permanent link to this revision of this page">Permanent link</a></li><li id="t-info" class="mw-list-item"><a href="/w/index.php?title=RSA_(cryptosystem)&action=info" title="More information about this page">Page information</a></li><li id="t-cite" class="mw-list-item"><a href="/w/index.php?title=Special:CiteThisPage&page=RSA_%28cryptosystem%29&id=1258725874&wpFormIdentifier=titleform" title="Information on how to cite this page">Cite this page</a></li><li id="t-urlshortener" class="mw-list-item"><a href="/w/index.php?title=Special:UrlShortener&url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FRSA_%28cryptosystem%29">Get shortened URL</a></li><li id="t-urlshortener-qrcode" class="mw-list-item"><a href="/w/index.php?title=Special:QrCode&url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FRSA_%28cryptosystem%29">Download QR code</a></li> </ul> </div> </div> <div id="p-coll-print_export" class="vector-menu mw-portlet mw-portlet-coll-print_export" > <div class="vector-menu-heading"> Print/export </div> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="coll-download-as-rl" class="mw-list-item"><a href="/w/index.php?title=Special:DownloadAsPdf&page=RSA_%28cryptosystem%29&action=show-download-screen" title="Download this page as a PDF file">Download as PDF</a></li><li id="t-print" class="mw-list-item"><a href="/w/index.php?title=RSA_(cryptosystem)&printable=yes" title="Printable version of this page [p]" accesskey="p">Printable version</a></li> </ul> </div> </div> <div id="p-wikibase-otherprojects" class="vector-menu mw-portlet mw-portlet-wikibase-otherprojects" > <div class="vector-menu-heading"> In other projects </div> <div class="vector-menu-content"> <ul class="vector-menu-content-list"> <li id="t-wikibase" class="wb-otherproject-link wb-otherproject-wikibase-dataitem mw-list-item"><a href="https://www.wikidata.org/wiki/Special:EntityPage/Q181551" title="Structured data on this page hosted by Wikidata [g]" accesskey="g">Wikidata item</a></li> </ul> </div> </div> </div> </div> </div> </div> </nav> </div> </div> </div> <div class="vector-column-end"> <div class="vector-sticky-pinned-container"> <nav class="vector-page-tools-landmark" aria-label="Page tools"> <div id="vector-page-tools-pinned-container" class="vector-pinned-container"> </div> </nav> <nav class="vector-appearance-landmark" aria-label="Appearance"> <div id="vector-appearance-pinned-container" class="vector-pinned-container"> <div id="vector-appearance" class="vector-appearance vector-pinnable-element"> <div class="vector-pinnable-header vector-appearance-pinnable-header vector-pinnable-header-pinned" data-feature-name="appearance-pinned" data-pinnable-element-id="vector-appearance" data-pinned-container-id="vector-appearance-pinned-container" data-unpinned-container-id="vector-appearance-unpinned-container" > <div class="vector-pinnable-header-label">Appearance</div> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-pin-button" data-event-name="pinnable-header.vector-appearance.pin">move to sidebar</button> <button class="vector-pinnable-header-toggle-button vector-pinnable-header-unpin-button" data-event-name="pinnable-header.vector-appearance.unpin">hide</button> </div> </div> </div> </nav> </div> </div> <div id="bodyContent" class="vector-body" aria-labelledby="firstHeading" data-mw-ve-target-container> <div class="vector-body-before-content"> <div class="mw-indicators"> </div> <div id="siteSub" class="noprint">From Wikipedia, the free encyclopedia</div> </div> <div id="contentSub"><div id="mw-content-subtitle">(Redirected from <a href="/w/index.php?title=RSA_(algorithm)&redirect=no" class="mw-redirect" title="RSA (algorithm)">RSA (algorithm)</a>)</div></div> <div id="mw-content-text" class="mw-body-content"><div class="mw-content-ltr mw-parser-output" lang="en" dir="ltr"><div class="shortdescription nomobile noexcerpt noprint searchaux" style="display:none">Algorithm for public-key cryptography</div> <style data-mw-deduplicate="TemplateStyles:r1236090951">.mw-parser-output .hatnote{font-style:italic}.mw-parser-output div.hatnote{padding-left:1.6em;margin-bottom:0.5em}.mw-parser-output .hatnote i{font-style:normal}.mw-parser-output .hatnote+link+.hatnote{margin-top:-0.5em}@media print{body.ns-0 .mw-parser-output .hatnote{display:none!important}}</style><div role="note" class="hatnote navigation-not-searchable">This article is about a cryptosystem. For the company, see <a href="/wiki/RSA_Security" title="RSA Security">RSA Security</a>.</div> <style data-mw-deduplicate="TemplateStyles:r1257001546">.mw-parser-output .infobox-subbox{padding:0;border:none;margin:-3px;width:auto;min-width:100%;font-size:100%;clear:none;float:none;background-color:transparent}.mw-parser-output .infobox-3cols-child{margin:auto}.mw-parser-output .infobox .navbar{font-size:100%}@media screen{html.skin-theme-clientpref-night .mw-parser-output .infobox-full-data:not(.notheme)>div:not(.notheme)[style]{background:#1f1f23!important;color:#f8f9fa}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .infobox-full-data:not(.notheme) div:not(.notheme){background:#1f1f23!important;color:#f8f9fa}}@media(min-width:640px){body.skin--responsive .mw-parser-output .infobox-table{display:table!important}body.skin--responsive .mw-parser-output .infobox-table>caption{display:table-caption!important}body.skin--responsive .mw-parser-output .infobox-table>tbody{display:table-row-group}body.skin--responsive .mw-parser-output .infobox-table tr{display:table-row!important}body.skin--responsive .mw-parser-output .infobox-table th,body.skin--responsive .mw-parser-output .infobox-table td{padding-left:inherit;padding-right:inherit}}</style><table class="infobox"><caption class="infobox-title">RSA</caption><tbody><tr><th colspan="2" class="infobox-header">General</th></tr><tr><th scope="row" class="infobox-label">Designers</th><td class="infobox-data"><a href="/wiki/Ron_Rivest" title="Ron Rivest">Ron Rivest</a>,<a href="#cite_note-rsa-1">[1]</a> <a href="/wiki/Adi_Shamir" title="Adi Shamir">Adi Shamir</a>, and <a href="/wiki/Leonard_Adleman" title="Leonard Adleman">Leonard Adleman</a></td></tr><tr><th scope="row" class="infobox-label">First published</th><td class="infobox-data">1977</td></tr><tr><th scope="row" class="infobox-label">Certification</th><td class="infobox-data"><a href="/wiki/PKCS1" class="mw-redirect" title="PKCS1">PKCS#1</a>, <a href="/w/index.php?title=ANSI_X9.31&action=edit&redlink=1" class="new" title="ANSI X9.31 (page does not exist)">ANSI X9.31</a></td></tr><tr><th colspan="2" class="infobox-header">Cipher detail</th></tr><tr><th scope="row" class="infobox-label"><a href="/wiki/Key_size" title="Key size">Key sizes</a></th><td class="infobox-data">variable but 2,048 to 4,096 bit typically</td></tr><tr><th scope="row" class="infobox-label"><a href="/wiki/Round_(cryptography)" title="Round (cryptography)">Rounds</a></th><td class="infobox-data">1</td></tr><tr><th colspan="2" class="infobox-header">Best public <a href="/wiki/Cryptanalysis" title="Cryptanalysis">cryptanalysis</a></th></tr><tr><td colspan="2" class="infobox-below" style="line-height: 1.25em; text-align: left"><a href="/wiki/General_number_field_sieve" title="General number field sieve">General number field sieve</a> for classical computers; <a href="/wiki/Shor%27s_algorithm" title="Shor's algorithm">Shor's algorithm</a> for quantum computers. An <a href="/wiki/RSA-250" class="mw-redirect" title="RSA-250">829-bit key</a> has been broken.</td></tr></tbody></table> RSA (Rivest–Shamir–Adleman) is a <a href="/wiki/Public-key_cryptography" title="Public-key cryptography">public-key cryptosystem</a>, one of the oldest widely used for secure data transmission. The <a href="/wiki/Initialism" class="mw-redirect" title="Initialism">initialism</a> "RSA" comes from the surnames of <a href="/wiki/Ron_Rivest" title="Ron Rivest">Ron Rivest</a>, <a href="/wiki/Adi_Shamir" title="Adi Shamir">Adi Shamir</a> and <a href="/wiki/Leonard_Adleman" title="Leonard Adleman">Leonard Adleman</a>, who publicly described the algorithm in 1977. An equivalent system was developed secretly in 1973 at <a href="/wiki/Government_Communications_Headquarters" class="mw-redirect" title="Government Communications Headquarters">Government Communications Headquarters</a> (GCHQ), the British <a href="/wiki/Signals_intelligence" title="Signals intelligence">signals intelligence</a> agency, by the English mathematician <a href="/wiki/Clifford_Cocks" title="Clifford Cocks">Clifford Cocks</a>. That system was <a href="/wiki/Classified_information" title="Classified information">declassified</a> in 1997.<a href="#cite_note-2">[2]</a> In a public-key <a href="/wiki/Cryptosystem" title="Cryptosystem">cryptosystem</a>, the <a href="/wiki/Encryption_key" class="mw-redirect" title="Encryption key">encryption key</a> is public and distinct from the <a href="/wiki/Decryption_key" class="mw-redirect" title="Decryption key">decryption key</a>, which is kept secret (private). An RSA user creates and publishes a public key based on two large <a href="/wiki/Prime_number" title="Prime number">prime numbers</a>, along with an auxiliary value. The prime numbers are kept secret. Messages can be encrypted by anyone, via the public key, but can only be decrypted by someone who knows the private key.<a href="#cite_note-rsa-1">[1]</a> The security of RSA relies on the practical difficulty of <a href="/wiki/Factorization" title="Factorization">factoring</a> the product of two large <a href="/wiki/Prime_number" title="Prime number">prime numbers</a>, the "<a href="/wiki/Factoring_problem" class="mw-redirect" title="Factoring problem">factoring problem</a>". Breaking RSA encryption is known as the <a href="/wiki/RSA_problem" title="RSA problem">RSA problem</a>. Whether it is as difficult as the factoring problem is an open question.<a href="#cite_note-3">[3]</a> There are no published methods to defeat the system if a large enough key is used. RSA is a relatively slow algorithm. Because of this, it is not commonly used to directly encrypt user data. More often, RSA is used to transmit shared keys for <a href="/wiki/Symmetric-key_algorithm" title="Symmetric-key algorithm">symmetric-key</a> cryptography, which are then used for bulk encryption–decryption. <meta property="mw:PageProp/toc" /> <div class="mw-heading mw-heading2"><h2 id="History">History</h2>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=1" title="Edit section: History">edit</a>]</div> <figure class="mw-default-size" typeof="mw:File/Thumb"><a href="/wiki/File:Adi_Shamir_2009_crop.jpg" class="mw-file-description"><img src="//upload.wikimedia.org/wikipedia/commons/thumb/0/06/Adi_Shamir_2009_crop.jpg/150px-Adi_Shamir_2009_crop.jpg" decoding="async" width="150" height="220" class="mw-file-element" srcset="//upload.wikimedia.org/wikipedia/commons/thumb/0/06/Adi_Shamir_2009_crop.jpg/225px-Adi_Shamir_2009_crop.jpg 1.5x, //upload.wikimedia.org/wikipedia/commons/thumb/0/06/Adi_Shamir_2009_crop.jpg/300px-Adi_Shamir_2009_crop.jpg 2x" data-file-width="600" data-file-height="879" /></a><figcaption><a href="/wiki/Adi_Shamir" title="Adi Shamir">Adi Shamir</a>, co-inventor of RSA (the others are <a href="/wiki/Ron_Rivest" title="Ron Rivest">Ron Rivest</a> and <a href="/wiki/Leonard_Adleman" title="Leonard Adleman">Leonard Adleman</a>)</figcaption></figure> The idea of an asymmetric public-private key cryptosystem is attributed to <a href="/wiki/Whitfield_Diffie" title="Whitfield Diffie">Whitfield Diffie</a> and <a href="/wiki/Martin_Hellman" title="Martin Hellman">Martin Hellman</a>, who published this concept in 1976. They also introduced digital signatures and attempted to apply number theory. Their formulation used a shared-secret-key created from exponentiation of some number, modulo a prime number. However, they left open the problem of realizing a one-way function, possibly because the difficulty of factoring was not well-studied at the time.<a href="#cite_note-4">[4]</a> Moreover, like <a href="/wiki/Diffie%E2%80%93Hellman_key_exchange" title="Diffie–Hellman key exchange">Diffie-Hellman</a>, RSA is based on <a href="/wiki/Modular_exponentiation" title="Modular exponentiation">modular exponentiation</a>. <a href="/wiki/Ron_Rivest" title="Ron Rivest">Ron Rivest</a>, <a href="/wiki/Adi_Shamir" title="Adi Shamir">Adi Shamir</a>, and <a href="/wiki/Leonard_Adleman" title="Leonard Adleman">Leonard Adleman</a> at the <a href="/wiki/Massachusetts_Institute_of_Technology" title="Massachusetts Institute of Technology">Massachusetts Institute of Technology</a> made several attempts over the course of a year to create a function that was hard to invert. Rivest and Shamir, as computer scientists, proposed many potential functions, while Adleman, as a mathematician, was responsible for finding their weaknesses. They tried many approaches, including "<a href="/wiki/Knapsack_problem" title="Knapsack problem">knapsack</a>-based" and "permutation polynomials". For a time, they thought what they wanted to achieve was impossible due to contradictory requirements.<a href="#cite_note-5">[5]</a> In April 1977, they spent <a href="/wiki/Passover" title="Passover">Passover</a> at the house of a student and drank a good deal of wine before returning to their homes at around midnight.<a href="#cite_note-6">[6]</a> Rivest, unable to sleep, lay on the couch with a math textbook and started thinking about their one-way function. He spent the rest of the night formalizing his idea, and he had much of the paper ready by daybreak. The algorithm is now known as RSA – the initials of their surnames in same order as their paper.<a href="#cite_note-SIAM-7">[7]</a> <a href="/wiki/Clifford_Cocks" title="Clifford Cocks">Clifford Cocks</a>, an English <a href="/wiki/Mathematician" title="Mathematician">mathematician</a> working for the <a href="/wiki/United_Kingdom" title="United Kingdom">British</a> intelligence agency <a href="/wiki/Government_Communications_Headquarters" class="mw-redirect" title="Government Communications Headquarters">Government Communications Headquarters</a> (GCHQ), described a similar system in an internal document in 1973.<a href="#cite_note-8">[8]</a> However, given the relatively expensive computers needed to implement it at the time, it was considered to be mostly a curiosity and, as far as is publicly known, was never deployed. His ideas and concepts, were not revealed until 1997 due to its top-secret classification. Kid-RSA (KRSA) is a simplified, insecure public-key cipher published in 1997, designed for educational purposes. Some people feel that learning Kid-RSA gives insight into RSA and other public-key ciphers, analogous to <a href="/wiki/Data_Encryption_Standard#Simplified_DES" title="Data Encryption Standard">simplified DES</a>.<a href="#cite_note-9">[9]</a><a href="#cite_note-10">[10]</a><a href="#cite_note-11">[11]</a><a href="#cite_note-12">[12]</a><a href="#cite_note-13">[13]</a> <div class="mw-heading mw-heading2"><h2 id="Patent">Patent</h2>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=2" title="Edit section: Patent">edit</a>]</div> A <a href="/wiki/Patent" title="Patent">patent</a> describing the RSA algorithm was granted to <a href="/wiki/Massachusetts_Institute_of_Technology" title="Massachusetts Institute of Technology">MIT</a> on 20 September 1983: <a rel="nofollow" class="external text" href="https://patents.google.com/patent/US4405829">U.S. patent 4,405,829</a> "Cryptographic communications system and method". From <a href="/wiki/Derwent_World_Patent_Index" class="mw-redirect" title="Derwent World Patent Index">DWPI</a>'s abstract of the patent: <style data-mw-deduplicate="TemplateStyles:r1244412712">.mw-parser-output .templatequote{overflow:hidden;margin:1em 0;padding:0 32px}.mw-parser-output .templatequotecite{line-height:1.5em;text-align:left;margin-top:0}@media(min-width:500px){.mw-parser-output .templatequotecite{padding-left:1.6em}}</style><blockquote class="templatequote">The system includes a communications channel coupled to at least one terminal having an encoding device and to at least one terminal having a decoding device. A message-to-be-transferred is enciphered to ciphertext at the encoding terminal by encoding the message as a number M in a predetermined set. That number is then raised to a first predetermined power (associated with the intended receiver) and finally computed. The remainder or residue, C, is... computed when the exponentiated number is divided by the product of two predetermined prime numbers (associated with the intended receiver).</blockquote> A detailed description of the algorithm was published in August 1977, in <a href="/wiki/Scientific_American" title="Scientific American">Scientific American</a>'s <a href="/wiki/List_of_Martin_Gardner_Mathematical_Games_columns" title="List of Martin Gardner Mathematical Games columns">Mathematical Games</a> column.<a href="#cite_note-SIAM-7">[7]</a> This preceded the patent's filing date of December 1977. Consequently, the patent had no legal standing outside the <a href="/wiki/United_States" title="United States">United States</a>. Had Cocks' work been publicly known, a patent in the United States would not have been legal either. When the patent was issued, <a href="/wiki/Term_of_patent" title="Term of patent">terms of patent</a> were 17 years. The patent was about to expire on 21 September 2000, but <a href="/wiki/RSA_Security" title="RSA Security">RSA Security</a> released the algorithm to the public domain on 6 September 2000.<a href="#cite_note-14">[14]</a> <div class="mw-heading mw-heading2"><h2 id="Operation">Operation</h2>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=3" title="Edit section: Operation">edit</a>]</div> The RSA algorithm involves four steps: <a href="/wiki/Key_(cryptography)" title="Key (cryptography)">key</a> generation, key distribution, encryption, and decryption. A basic principle behind RSA is the observation that it is practical to find three very large positive integers e, d, and n, such that for all integers m (0 ≤ m < n), both <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle (m^{e})^{d}}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mo stretchy="false">(</mo> <msup> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>e</mi> </mrow> </msup> <msup> <mo stretchy="false">)</mo> <mrow class="MJX-TeXAtom-ORD"> <mi>d</mi> </mrow> </msup> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle (m^{e})^{d}}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/9a4201c042422d87e9b3579de21a7d2af510b9d6" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:5.94ex; height:3.176ex;" alt="{\displaystyle (m^{e})^{d}}"> and <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mi>m</mi> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle m}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/0a07d98bb302f3856cbabc47b2b9016692e3f7bc" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:2.04ex; height:1.676ex;" alt="{\displaystyle m}"> have the same <a href="/wiki/Euclidean_division" title="Euclidean division">remainder</a> when divided by <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle n}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mi>n</mi> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle n}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/a601995d55609f2d9f5e233e36fbe9ea26011b3b" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.395ex; height:1.676ex;" alt="{\displaystyle n}"> (they are <a href="/wiki/Modular_arithmetic#Congruence" title="Modular arithmetic">congruent modulo</a> <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle n}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mi>n</mi> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle n}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/a601995d55609f2d9f5e233e36fbe9ea26011b3b" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.395ex; height:1.676ex;" alt="{\displaystyle n}">):<math display="block" xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle (m^{e})^{d}\equiv m{\pmod {n}}.}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mo stretchy="false">(</mo> <msup> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>e</mi> </mrow> </msup> <msup> <mo stretchy="false">)</mo> <mrow class="MJX-TeXAtom-ORD"> <mi>d</mi> </mrow> </msup> <mo>≡</mo> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mspace width="1em" /> <mo stretchy="false">(</mo> <mi>mod</mi> <mspace width="0.333em" /> <mi>n</mi> <mo stretchy="false">)</mo> </mrow> <mo>.</mo> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle (m^{e})^{d}\equiv m{\pmod {n}}.}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/cb1853db67abf7c8fc10c22532edad0299531b89" class="mwe-math-fallback-image-display mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:22.805ex; height:3.176ex;" alt="{\displaystyle (m^{e})^{d}\equiv m{\pmod {n}}.}">However, when given only e and n, it is extremely difficult to find d. The integers n and e comprise the public key, d represents the private key, and m represents the message. The <a href="/wiki/Modular_exponentiation" title="Modular exponentiation">modular exponentiation</a> to e and d corresponds to encryption and decryption, respectively. In addition, because the two exponents <a href="/wiki/Exponentiation#Identities_and_properties" title="Exponentiation">can be swapped</a>, the private and public key can also be swapped, allowing for message <a href="/wiki/Digital_signature" title="Digital signature">signing and verification</a> using the same algorithm. <div class="mw-heading mw-heading3"><h3 id="Key_generation">Key generation</h3>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=4" title="Edit section: Key generation">edit</a>]</div> The keys for the RSA algorithm are generated in the following way: <ol><li>Choose two large <a href="/wiki/Prime_number" title="Prime number">prime numbers</a> p and q. <ul><li>To make factoring harder, p and q should be chosen at random, be both large and have a large difference.<a href="#cite_note-rsa-1">[1]</a> For choosing them the standard method is to choose random integers and use a <a href="/wiki/Primality_test" title="Primality test">primality test</a> until two primes are found.</li> <li>p and q are kept secret.</li></ul></li> <li>Compute n = pq. <ul><li>n is used as the <a href="/wiki/Modular_arithmetic" title="Modular arithmetic">modulus</a> for both the public and private keys. Its length, usually expressed in bits, is the <a href="/wiki/Key_length" class="mw-redirect" title="Key length">key length</a>.</li> <li>n is released as part of the public key.</li></ul></li> <li>Compute λ(n), where λ is <a href="/wiki/Carmichael%27s_totient_function" class="mw-redirect" title="Carmichael's totient function">Carmichael's totient function</a>. Since n = pq, λ(n) = <a href="/wiki/Least_common_multiple" title="Least common multiple">lcm</a>(λ(p), λ(q)), and since p and q are prime, λ(p) = <a href="/wiki/Euler_totient_function" class="mw-redirect" title="Euler totient function">φ</a>(p) = p − 1, and likewise λ(q) = q − 1. Hence λ(n) = lcm(p − 1, q − 1). <ul><li>The lcm may be calculated through the <a href="/wiki/Euclidean_algorithm" title="Euclidean algorithm">Euclidean algorithm</a>, since lcm(a, b) = <style data-mw-deduplicate="TemplateStyles:r1214402035">.mw-parser-output .sfrac{white-space:nowrap}.mw-parser-output .sfrac.tion,.mw-parser-output .sfrac .tion{display:inline-block;vertical-align:-0.5em;font-size:85%;text-align:center}.mw-parser-output .sfrac .num{display:block;line-height:1em;margin:0.0em 0.1em;border-bottom:1px solid}.mw-parser-output .sfrac .den{display:block;line-height:1em;margin:0.1em 0.1em}.mw-parser-output .sr-only{border:0;clip:rect(0,0,0,0);clip-path:polygon(0px 0px,0px 0px,0px 0px);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px}</style>⁠|ab|/gcd(a, b)⁠.</li> <li>λ(n) is kept secret.</li></ul></li> <li>Choose an integer e such that 1 < e < λ(n) and <a href="/wiki/Greatest_common_divisor" title="Greatest common divisor">gcd</a>(e, λ(n)) = 1; that is, e and λ(n) are <a href="/wiki/Coprime" class="mw-redirect" title="Coprime">coprime</a>. <ul><li>e having a short <a href="/wiki/Bit-length" title="Bit-length">bit-length</a> and small <a href="/wiki/Hamming_weight" title="Hamming weight">Hamming weight</a> results in more efficient encryption – the most commonly chosen value for e is 216 + 1 = 65537. The smallest (and fastest) possible value for e is 3, but such a small value for e has been shown to be less secure in some settings.<a href="#cite_note-Boneh99-15">[15]</a></li> <li>e is released as part of the public key.</li></ul></li> <li>Determine d as d ≡ e−1 (mod λ(n)); that is, d is the <a href="/wiki/Modular_multiplicative_inverse" title="Modular multiplicative inverse">modular multiplicative inverse</a> of e modulo λ(n). <ul><li>This means: solve for d the equation de ≡ 1 (mod λ(n)); d can be computed efficiently by using the <a href="/wiki/Extended_Euclidean_algorithm" title="Extended Euclidean algorithm">extended Euclidean algorithm</a>, since, thanks to e and λ(n) being coprime, said equation is a form of <a href="/wiki/B%C3%A9zout%27s_identity" title="Bézout's identity">Bézout's identity</a>, where d is one of the coefficients.</li> <li>d is kept secret as the private key exponent.</li></ul></li></ol> The public key consists of the modulus n and the public (or encryption) exponent e. The private key consists of the private (or decryption) exponent d, which must be kept secret. p, q, and λ(n) must also be kept secret because they can be used to calculate d. In fact, they can all be discarded after d has been computed.<a href="#cite_note-16">[16]</a> In the original RSA paper,<a href="#cite_note-rsa-1">[1]</a> the <a href="/wiki/Euler_totient_function" class="mw-redirect" title="Euler totient function">Euler totient function</a> φ(n) = (p − 1)(q − 1) is used instead of λ(n) for calculating the private exponent d. Since φ(n) is always divisible by λ(n), the algorithm works as well. The possibility of using <a href="/wiki/Euler_totient_function" class="mw-redirect" title="Euler totient function">Euler totient function</a> results also from <a href="/wiki/Lagrange%27s_theorem_(group_theory)" title="Lagrange's theorem (group theory)">Lagrange's theorem</a> applied to the <a href="/wiki/Multiplicative_group_of_integers_modulo_n" title="Multiplicative group of integers modulo n">multiplicative group of integers modulo pq</a>. Thus any d satisfying d⋅e ≡ 1 (mod φ(n)) also satisfies d⋅e ≡ 1 (mod λ(n)). However, computing d modulo φ(n) will sometimes yield a result that is larger than necessary (i.e. d > λ(n)). Most of the implementations of RSA will accept exponents generated using either method (if they use the private exponent d at all, rather than using the optimized decryption method <a href="#Using_the_Chinese_remainder_algorithm">based on the Chinese remainder theorem</a> described below), but some standards such as <a rel="nofollow" class="external text" href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf#page=63">FIPS 186-4</a> (Section B.3.1) may require that d < λ(n). Any "oversized" private exponents not meeting this criterion may always be reduced modulo λ(n) to obtain a smaller equivalent exponent. Since any common factors of (p − 1) and (q − 1) are present in the factorisation of n − 1 = pq − 1 = (p − 1)(q − 1) + (p − 1) + (q − 1),<a href="#cite_note-17">[17]</a>[<a href="/wiki/Wikipedia:Verifiability#Self-published_sources" title="Wikipedia:Verifiability">self-published source?</a>] it is recommended that (p − 1) and (q − 1) have only very small common factors, if any, besides the necessary 2.<a href="#cite_note-rsa-1">[1]</a><a href="#cite_note-18">[18]</a><a href="#cite_note-19">[19]</a>[<a href="/wiki/Wikipedia:Verifiability" title="Wikipedia:Verifiability">failed verification</a>]<a href="#cite_note-20">[20]</a>[<a href="/wiki/Wikipedia:Verifiability" title="Wikipedia:Verifiability">failed verification</a>] Note: The authors of the original RSA paper carry out the key generation by choosing d and then computing e as the <a href="/wiki/Modular_multiplicative_inverse" title="Modular multiplicative inverse">modular multiplicative inverse</a> of d modulo φ(n), whereas most current implementations of RSA, such as those following <a href="/wiki/PKCS1" class="mw-redirect" title="PKCS1">PKCS#1</a>, do the reverse (choose e and compute d). Since the chosen key can be small, whereas the computed key normally is not, the RSA paper's algorithm optimizes decryption compared to encryption, while the modern algorithm optimizes encryption instead.<a href="#cite_note-rsa-1">[1]</a><a href="#cite_note-21">[21]</a> <div class="mw-heading mw-heading3"><h3 id="Key_distribution">Key distribution</h3>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=5" title="Edit section: Key distribution">edit</a>]</div> Suppose that <a href="/wiki/Alice_and_Bob" title="Alice and Bob">Bob</a> wants to send information to <a href="/wiki/Alice_and_Bob" title="Alice and Bob">Alice</a>. If they decide to use RSA, Bob must know Alice's public key to encrypt the message, and Alice must use her private key to decrypt the message. To enable Bob to send his encrypted messages, Alice transmits her public key (n, e) to Bob via a reliable, but not necessarily secret, route. Alice's private key (d) is never distributed. <div class="mw-heading mw-heading3"><h3 id="Encryption">Encryption</h3>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=6" title="Edit section: Encryption">edit</a>]</div> After Bob obtains Alice's public key, he can send a message M to Alice. To do it, he first turns M (strictly speaking, the un-padded plaintext) into an integer m (strictly speaking, the <a href="/wiki/Padding_(cryptography)" title="Padding (cryptography)">padded</a> plaintext), such that 0 ≤ m < n by using an agreed-upon reversible protocol known as a <a href="#Padding_schemes">padding scheme</a>. He then computes the ciphertext c, using Alice's public key e, corresponding to <math display="block" xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c\equiv m^{e}{\pmod {n}}.}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mi>c</mi> <mo>≡</mo> <msup> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>e</mi> </mrow> </msup> <mrow class="MJX-TeXAtom-ORD"> <mspace width="1em" /> <mo stretchy="false">(</mo> <mi>mod</mi> <mspace width="0.333em" /> <mi>n</mi> <mo stretchy="false">)</mo> </mrow> <mo>.</mo> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle c\equiv m^{e}{\pmod {n}}.}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/2e52f73642221fad08a441c70d514ae06600cc4b" class="mwe-math-fallback-image-display mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:18.87ex; height:2.843ex;" alt="{\displaystyle c\equiv m^{e}{\pmod {n}}.}"> This can be done reasonably quickly, even for very large numbers, using <a href="/wiki/Modular_exponentiation" title="Modular exponentiation">modular exponentiation</a>. Bob then transmits c to Alice. Note that at least nine values of m will yield a ciphertext c equal to m,<a href="#cite_note-22">[a]</a> but this is very unlikely to occur in practice. <div class="mw-heading mw-heading3"><h3 id="Decryption">Decryption</h3>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=7" title="Edit section: Decryption">edit</a>]</div> Alice can recover m from c by using her private key exponent d by computing <math display="block" xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c^{d}\equiv (m^{e})^{d}\equiv m{\pmod {n}}.}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <msup> <mi>c</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>d</mi> </mrow> </msup> <mo>≡</mo> <mo stretchy="false">(</mo> <msup> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>e</mi> </mrow> </msup> <msup> <mo stretchy="false">)</mo> <mrow class="MJX-TeXAtom-ORD"> <mi>d</mi> </mrow> </msup> <mo>≡</mo> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mspace width="1em" /> <mo stretchy="false">(</mo> <mi>mod</mi> <mspace width="0.333em" /> <mi>n</mi> <mo stretchy="false">)</mo> </mrow> <mo>.</mo> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle c^{d}\equiv (m^{e})^{d}\equiv m{\pmod {n}}.}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/111a80bbccad42f94fe247a2b3cc68664e682744" class="mwe-math-fallback-image-display mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:28.002ex; height:3.176ex;" alt="{\displaystyle c^{d}\equiv (m^{e})^{d}\equiv m{\pmod {n}}.}"> Given m, she can recover the original message M by reversing the padding scheme. <div class="mw-heading mw-heading3"><h3 id="Example">Example</h3>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=8" title="Edit section: Example">edit</a>]</div> Here is an example of RSA encryption and decryption:<a href="#cite_note-23">[b]</a> <ol><li>Choose two distinct prime numbers, such as <dl><dd><math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle p=61}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mi>p</mi> <mo>=</mo> <mn>61</mn> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle p=61}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/2c7bf03bd6e938ab64329d0cfb7e582c20a794c0" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; margin-left: -0.089ex; width:6.682ex; height:2.509ex;" alt="{\displaystyle p=61}"> and <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle q=53}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mi>q</mi> <mo>=</mo> <mn>53</mn> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle q=53}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/b1bb88c50850de7071e1a7886ccbf56c4f52dd8d" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:6.493ex; height:2.509ex;" alt="{\displaystyle q=53}">.</dd></dl></li> <li>Compute n = pq giving <dl><dd><math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle n=61\times 53=3233.}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mi>n</mi> <mo>=</mo> <mn>61</mn> <mo>×</mo> <mn>53</mn> <mo>=</mo> <mn>3233.</mn> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle n=61\times 53=3233.}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/25d457c8ce36115cfcd9b778e451d3f3662fdf63" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:20.379ex; height:2.176ex;" alt="{\displaystyle n=61\times 53=3233.}"></dd></dl></li> <li>Compute the <a href="/wiki/Carmichael%27s_totient_function" class="mw-redirect" title="Carmichael's totient function">Carmichael's totient function</a> of the product as λ(n) = <a href="/wiki/Least_common_multiple" title="Least common multiple">lcm</a>(p − 1, q − 1) giving <dl><dd><math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle \lambda (3233)=\operatorname {lcm} (60,52)=780.}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mi>λ</mi> <mo stretchy="false">(</mo> <mn>3233</mn> <mo stretchy="false">)</mo> <mo>=</mo> <mi>lcm</mi> <mo>⁡</mo> <mo stretchy="false">(</mo> <mn>60</mn> <mo>,</mo> <mn>52</mn> <mo stretchy="false">)</mo> <mo>=</mo> <mn>780.</mn> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle \lambda (3233)=\operatorname {lcm} (60,52)=780.}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/acf1438506d041789a7d83d6f4a7afd0a8e97812" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:29.254ex; height:2.843ex;" alt="{\displaystyle \lambda (3233)=\operatorname {lcm} (60,52)=780.}"></dd></dl></li> <li>Choose any number 2 < e < 780 that is <a href="/wiki/Coprime" class="mw-redirect" title="Coprime">coprime</a> to 780. Choosing a prime number for e leaves us only to check that e is not a divisor of 780. <dl><dd>Let <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle e=17}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mi>e</mi> <mo>=</mo> <mn>17</mn> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle e=17}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/bfad0ed4be7b64d02099052d9cf960467c48a3de" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:6.507ex; height:2.176ex;" alt="{\displaystyle e=17}">.</dd></dl></li> <li>Compute d, the <a href="/wiki/Modular_multiplicative_inverse" title="Modular multiplicative inverse">modular multiplicative inverse</a> of e (mod λ(n)), yielding <math display="block" xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle d=413,}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mi>d</mi> <mo>=</mo> <mn>413</mn> <mo>,</mo> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle d=413,}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/dbafcd92df4ebdcaa6f17b0f7e9360dc0fd2b0f0" class="mwe-math-fallback-image-display mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:8.449ex; height:2.509ex;" alt="{\displaystyle d=413,}"> as <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle 1=(17\times 413){\bmod {7}}80.}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mn>1</mn> <mo>=</mo> <mo stretchy="false">(</mo> <mn>17</mn> <mo>×</mo> <mn>413</mn> <mo stretchy="false">)</mo> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mn>7</mn> </mrow> </mrow> <mn>80.</mn> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle 1=(17\times 413){\bmod {7}}80.}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/5595e465b8652f4ef3bd2e9c8fe847ab6405ab24" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:24.538ex; height:2.843ex;" alt="{\displaystyle 1=(17\times 413){\bmod {7}}80.}"></li></ol> The public key is (n = 3233, e = 17). For a padded <a href="/wiki/Plaintext" title="Plaintext">plaintext</a> message m, the encryption function is <math display="block" xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\begin{aligned}c(m)&=m^{e}{\bmod {n}}\\&=m^{17}{\bmod {3}}233.\end{aligned}}}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mrow class="MJX-TeXAtom-ORD"> <mtable columnalign="right left right left right left right left right left right left" rowspacing="3pt" columnspacing="0em 2em 0em 2em 0em 2em 0em 2em 0em 2em 0em" displaystyle="true"> <mtr> <mtd> <mi>c</mi> <mo stretchy="false">(</mo> <mi>m</mi> <mo stretchy="false">)</mo> </mtd> <mtd> <mi></mi> <mo>=</mo> <msup> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>e</mi> </mrow> </msup> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mi>n</mi> </mrow> </mrow> </mtd> </mtr> <mtr> <mtd /> <mtd> <mi></mi> <mo>=</mo> <msup> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mn>17</mn> </mrow> </msup> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mn>3</mn> </mrow> </mrow> <mn>233.</mn> </mtd> </mtr> </mtable> </mrow> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle {\begin{aligned}c(m)&=m^{e}{\bmod {n}}\\&=m^{17}{\bmod {3}}233.\end{aligned}}}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/dfd9b4fd297c6390a98a33771b34451e1a8abe1a" class="mwe-math-fallback-image-display mw-invert skin-invert" aria-hidden="true" style="vertical-align: -2.505ex; width:23.601ex; height:6.176ex;" alt="{\displaystyle {\begin{aligned}c(m)&=m^{e}{\bmod {n}}\\&=m^{17}{\bmod {3}}233.\end{aligned}}}"> The private key is (n = 3233, d = 413). For an encrypted <a href="/wiki/Ciphertext" title="Ciphertext">ciphertext</a> c, the decryption function is <math display="block" xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\begin{aligned}m(c)&=c^{d}{\bmod {n}}\\&=c^{413}{\bmod {3}}233.\end{aligned}}}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mrow class="MJX-TeXAtom-ORD"> <mtable columnalign="right left right left right left right left right left right left" rowspacing="3pt" columnspacing="0em 2em 0em 2em 0em 2em 0em 2em 0em 2em 0em" displaystyle="true"> <mtr> <mtd> <mi>m</mi> <mo stretchy="false">(</mo> <mi>c</mi> <mo stretchy="false">)</mo> </mtd> <mtd> <mi></mi> <mo>=</mo> <msup> <mi>c</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>d</mi> </mrow> </msup> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mi>n</mi> </mrow> </mrow> </mtd> </mtr> <mtr> <mtd /> <mtd> <mi></mi> <mo>=</mo> <msup> <mi>c</mi> <mrow class="MJX-TeXAtom-ORD"> <mn>413</mn> </mrow> </msup> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mn>3</mn> </mrow> </mrow> <mn>233.</mn> </mtd> </mtr> </mtable> </mrow> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle {\begin{aligned}m(c)&=c^{d}{\bmod {n}}\\&=c^{413}{\bmod {3}}233.\end{aligned}}}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/b6b3a4dab28b7c8d4c0ab2ae6ac7ffcf05deef4f" class="mwe-math-fallback-image-display mw-invert skin-invert" aria-hidden="true" style="vertical-align: -2.671ex; width:23.389ex; height:6.509ex;" alt="{\displaystyle {\begin{aligned}m(c)&=c^{d}{\bmod {n}}\\&=c^{413}{\bmod {3}}233.\end{aligned}}}"> For instance, in order to encrypt m = 65, one calculates <math display="block" xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c=65^{17}{\bmod {3}}233=2790.}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mi>c</mi> <mo>=</mo> <msup> <mn>65</mn> <mrow class="MJX-TeXAtom-ORD"> <mn>17</mn> </mrow> </msup> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mn>3</mn> </mrow> </mrow> <mn>233</mn> <mo>=</mo> <mn>2790.</mn> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle c=65^{17}{\bmod {3}}233=2790.}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/f4939f5d787225ac4e9cc7c64e4e267edf1cfb0b" class="mwe-math-fallback-image-display mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:27.033ex; height:2.676ex;" alt="{\displaystyle c=65^{17}{\bmod {3}}233=2790.}"> To decrypt c = 2790, one calculates <math display="block" xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m=2790^{413}{\bmod {3}}233=65.}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mi>m</mi> <mo>=</mo> <msup> <mn>2790</mn> <mrow class="MJX-TeXAtom-ORD"> <mn>413</mn> </mrow> </msup> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mn>3</mn> </mrow> </mrow> <mn>233</mn> <mo>=</mo> <mn>65.</mn> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle m=2790^{413}{\bmod {3}}233=65.}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/5d53757754102b99479568e625ad8ffa93f6696b" class="mwe-math-fallback-image-display mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:28.888ex; height:2.676ex;" alt="{\displaystyle m=2790^{413}{\bmod {3}}233=65.}"> Both of these calculations can be computed efficiently using the <a href="/wiki/Square-and-multiply_algorithm" class="mw-redirect" title="Square-and-multiply algorithm">square-and-multiply algorithm</a> for <a href="/wiki/Modular_exponentiation" title="Modular exponentiation">modular exponentiation</a>. In real-life situations the primes selected would be much larger; in our example it would be trivial to factor n = 3233 (obtained from the freely available public key) back to the primes p and q. e, also from the public key, is then inverted to get d, thus acquiring the private key. Practical implementations use the <a href="/wiki/Chinese_remainder_theorem" title="Chinese remainder theorem">Chinese remainder theorem</a> to speed up the calculation using modulus of factors (mod pq using mod p and mod q). The values dp, dq and qinv, which are part of the private key are computed as follows: <math display="block" xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\begin{aligned}d_{p}&=d{\bmod {(}}p-1)=413{\bmod {(}}61-1)=53,\\d_{q}&=d{\bmod {(}}q-1)=413{\bmod {(}}53-1)=49,\\q_{\text{inv}}&=q^{-1}{\bmod {p}}=53^{-1}{\bmod {6}}1=38\\&\Rightarrow (q_{\text{inv}}\times q){\bmod {p}}=38\times 53{\bmod {6}}1=1.\end{aligned}}}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mrow class="MJX-TeXAtom-ORD"> <mtable columnalign="right left right left right left right left right left right left" rowspacing="3pt" columnspacing="0em 2em 0em 2em 0em 2em 0em 2em 0em 2em 0em" displaystyle="true"> <mtr> <mtd> <msub> <mi>d</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>p</mi> </mrow> </msub> </mtd> <mtd> <mi></mi> <mo>=</mo> <mi>d</mi> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mo stretchy="false">(</mo> </mrow> </mrow> <mi>p</mi> <mo>−</mo> <mn>1</mn> <mo stretchy="false">)</mo> <mo>=</mo> <mn>413</mn> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mo stretchy="false">(</mo> </mrow> </mrow> <mn>61</mn> <mo>−</mo> <mn>1</mn> <mo stretchy="false">)</mo> <mo>=</mo> <mn>53</mn> <mo>,</mo> </mtd> </mtr> <mtr> <mtd> <msub> <mi>d</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>q</mi> </mrow> </msub> </mtd> <mtd> <mi></mi> <mo>=</mo> <mi>d</mi> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mo stretchy="false">(</mo> </mrow> </mrow> <mi>q</mi> <mo>−</mo> <mn>1</mn> <mo stretchy="false">)</mo> <mo>=</mo> <mn>413</mn> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mo stretchy="false">(</mo> </mrow> </mrow> <mn>53</mn> <mo>−</mo> <mn>1</mn> <mo stretchy="false">)</mo> <mo>=</mo> <mn>49</mn> <mo>,</mo> </mtd> </mtr> <mtr> <mtd> <msub> <mi>q</mi> <mrow class="MJX-TeXAtom-ORD"> <mtext>inv</mtext> </mrow> </msub> </mtd> <mtd> <mi></mi> <mo>=</mo> <msup> <mi>q</mi> <mrow class="MJX-TeXAtom-ORD"> <mo>−</mo> <mn>1</mn> </mrow> </msup> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mi>p</mi> </mrow> </mrow> <mo>=</mo> <msup> <mn>53</mn> <mrow class="MJX-TeXAtom-ORD"> <mo>−</mo> <mn>1</mn> </mrow> </msup> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mn>6</mn> </mrow> </mrow> <mn>1</mn> <mo>=</mo> <mn>38</mn> </mtd> </mtr> <mtr> <mtd /> <mtd> <mi></mi> <mo stretchy="false">⇒</mo> <mo stretchy="false">(</mo> <msub> <mi>q</mi> <mrow class="MJX-TeXAtom-ORD"> <mtext>inv</mtext> </mrow> </msub> <mo>×</mo> <mi>q</mi> <mo stretchy="false">)</mo> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mi>p</mi> </mrow> </mrow> <mo>=</mo> <mn>38</mn> <mo>×</mo> <mn>53</mn> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mn>6</mn> </mrow> </mrow> <mn>1</mn> <mo>=</mo> <mn>1.</mn> </mtd> </mtr> </mtable> </mrow> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle {\begin{aligned}d_{p}&=d{\bmod {(}}p-1)=413{\bmod {(}}61-1)=53,\\d_{q}&=d{\bmod {(}}q-1)=413{\bmod {(}}53-1)=49,\\q_{\text{inv}}&=q^{-1}{\bmod {p}}=53^{-1}{\bmod {6}}1=38\\&\Rightarrow (q_{\text{inv}}\times q){\bmod {p}}=38\times 53{\bmod {6}}1=1.\end{aligned}}}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/fb3ebbdfc9300ce963acb3db88e199642632a6a4" class="mwe-math-fallback-image-display mw-invert skin-invert" aria-hidden="true" style="vertical-align: -5.671ex; width:47.711ex; height:12.509ex;" alt="{\displaystyle {\begin{aligned}d_{p}&=d{\bmod {(}}p-1)=413{\bmod {(}}61-1)=53,\\d_{q}&=d{\bmod {(}}q-1)=413{\bmod {(}}53-1)=49,\\q_{\text{inv}}&=q^{-1}{\bmod {p}}=53^{-1}{\bmod {6}}1=38\\&\Rightarrow (q_{\text{inv}}\times q){\bmod {p}}=38\times 53{\bmod {6}}1=1.\end{aligned}}}"> Here is how dp, dq and qinv are used for efficient decryption (encryption is efficient by choice of a suitable d and e pair): <math display="block" xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\begin{aligned}m_{1}&=c^{d_{p}}{\bmod {p}}=2790^{53}{\bmod {6}}1=4,\\m_{2}&=c^{d_{q}}{\bmod {q}}=2790^{49}{\bmod {5}}3=12,\\h&=(q_{\text{inv}}\times (m_{1}-m_{2})){\bmod {p}}=(38\times -8){\bmod {6}}1=1,\\m&=m_{2}+h\times q=12+1\times 53=65.\end{aligned}}}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mrow class="MJX-TeXAtom-ORD"> <mtable columnalign="right left right left right left right left right left right left" rowspacing="3pt" columnspacing="0em 2em 0em 2em 0em 2em 0em 2em 0em 2em 0em" displaystyle="true"> <mtr> <mtd> <msub> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mn>1</mn> </mrow> </msub> </mtd> <mtd> <mi></mi> <mo>=</mo> <msup> <mi>c</mi> <mrow class="MJX-TeXAtom-ORD"> <msub> <mi>d</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>p</mi> </mrow> </msub> </mrow> </msup> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mi>p</mi> </mrow> </mrow> <mo>=</mo> <msup> <mn>2790</mn> <mrow class="MJX-TeXAtom-ORD"> <mn>53</mn> </mrow> </msup> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mn>6</mn> </mrow> </mrow> <mn>1</mn> <mo>=</mo> <mn>4</mn> <mo>,</mo> </mtd> </mtr> <mtr> <mtd> <msub> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mn>2</mn> </mrow> </msub> </mtd> <mtd> <mi></mi> <mo>=</mo> <msup> <mi>c</mi> <mrow class="MJX-TeXAtom-ORD"> <msub> <mi>d</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>q</mi> </mrow> </msub> </mrow> </msup> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mi>q</mi> </mrow> </mrow> <mo>=</mo> <msup> <mn>2790</mn> <mrow class="MJX-TeXAtom-ORD"> <mn>49</mn> </mrow> </msup> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mn>5</mn> </mrow> </mrow> <mn>3</mn> <mo>=</mo> <mn>12</mn> <mo>,</mo> </mtd> </mtr> <mtr> <mtd> <mi>h</mi> </mtd> <mtd> <mi></mi> <mo>=</mo> <mo stretchy="false">(</mo> <msub> <mi>q</mi> <mrow class="MJX-TeXAtom-ORD"> <mtext>inv</mtext> </mrow> </msub> <mo>×</mo> <mo stretchy="false">(</mo> <msub> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mn>1</mn> </mrow> </msub> <mo>−</mo> <msub> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mn>2</mn> </mrow> </msub> <mo stretchy="false">)</mo> <mo stretchy="false">)</mo> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mi>p</mi> </mrow> </mrow> <mo>=</mo> <mo stretchy="false">(</mo> <mn>38</mn> <mo>×</mo> <mo>−</mo> <mn>8</mn> <mo stretchy="false">)</mo> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mn>6</mn> </mrow> </mrow> <mn>1</mn> <mo>=</mo> <mn>1</mn> <mo>,</mo> </mtd> </mtr> <mtr> <mtd> <mi>m</mi> </mtd> <mtd> <mi></mi> <mo>=</mo> <msub> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mn>2</mn> </mrow> </msub> <mo>+</mo> <mi>h</mi> <mo>×</mo> <mi>q</mi> <mo>=</mo> <mn>12</mn> <mo>+</mo> <mn>1</mn> <mo>×</mo> <mn>53</mn> <mo>=</mo> <mn>65.</mn> </mtd> </mtr> </mtable> </mrow> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle {\begin{aligned}m_{1}&=c^{d_{p}}{\bmod {p}}=2790^{53}{\bmod {6}}1=4,\\m_{2}&=c^{d_{q}}{\bmod {q}}=2790^{49}{\bmod {5}}3=12,\\h&=(q_{\text{inv}}\times (m_{1}-m_{2})){\bmod {p}}=(38\times -8){\bmod {6}}1=1,\\m&=m_{2}+h\times q=12+1\times 53=65.\end{aligned}}}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/42d70002386d5452408e46c43e8238c406457d77" class="mwe-math-fallback-image-display mw-invert skin-invert" aria-hidden="true" style="vertical-align: -5.671ex; width:58.75ex; height:12.509ex;" alt="{\displaystyle {\begin{aligned}m_{1}&=c^{d_{p}}{\bmod {p}}=2790^{53}{\bmod {6}}1=4,\\m_{2}&=c^{d_{q}}{\bmod {q}}=2790^{49}{\bmod {5}}3=12,\\h&=(q_{\text{inv}}\times (m_{1}-m_{2})){\bmod {p}}=(38\times -8){\bmod {6}}1=1,\\m&=m_{2}+h\times q=12+1\times 53=65.\end{aligned}}}"> <div class="mw-heading mw-heading3"><h3 id="Signing_messages">Signing messages</h3>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=9" title="Edit section: Signing messages">edit</a>]</div> Suppose <a href="/wiki/Alice_and_Bob" title="Alice and Bob">Alice</a> uses <a href="/wiki/Alice_and_Bob" title="Alice and Bob">Bob</a>'s public key to send him an encrypted message. In the message, she can claim to be Alice, but Bob has no way of verifying that the message was from Alice, since anyone can use Bob's public key to send him encrypted messages. In order to verify the origin of a message, RSA can also be used to <a href="/wiki/Digital_signature" title="Digital signature">sign</a> a message. Suppose Alice wishes to send a signed message to Bob. She can use her own private key to do so. She produces a <a href="/wiki/Cryptographic_hash_function" title="Cryptographic hash function">hash value</a> of the message, raises it to the power of d (modulo n) (as she does when decrypting a message), and attaches it as a "signature" to the message. When Bob receives the signed message, he uses the same hash algorithm in conjunction with Alice's public key. He raises the signature to the power of e (modulo n) (as he does when encrypting a message), and compares the resulting hash value with the message's hash value. If the two agree, he knows that the author of the message was in possession of Alice's private key and that the message has not been tampered with since being sent. This works because of <a href="/wiki/Exponentiation" title="Exponentiation">exponentiation</a> rules: <math display="block" xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle h=\operatorname {hash} (m),}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mi>h</mi> <mo>=</mo> <mi>hash</mi> <mo>⁡</mo> <mo stretchy="false">(</mo> <mi>m</mi> <mo stretchy="false">)</mo> <mo>,</mo> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle h=\operatorname {hash} (m),}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/f7e5107188c07145061d5492fb92f9a75eabc693" class="mwe-math-fallback-image-display mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:13.598ex; height:2.843ex;" alt="{\displaystyle h=\operatorname {hash} (m),}"> <math display="block" xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle (h^{e})^{d}=h^{ed}=h^{de}=(h^{d})^{e}\equiv h{\pmod {n}}.}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mo stretchy="false">(</mo> <msup> <mi>h</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>e</mi> </mrow> </msup> <msup> <mo stretchy="false">)</mo> <mrow class="MJX-TeXAtom-ORD"> <mi>d</mi> </mrow> </msup> <mo>=</mo> <msup> <mi>h</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>e</mi> <mi>d</mi> </mrow> </msup> <mo>=</mo> <msup> <mi>h</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>d</mi> <mi>e</mi> </mrow> </msup> <mo>=</mo> <mo stretchy="false">(</mo> <msup> <mi>h</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>d</mi> </mrow> </msup> <msup> <mo stretchy="false">)</mo> <mrow class="MJX-TeXAtom-ORD"> <mi>e</mi> </mrow> </msup> <mo>≡</mo> <mi>h</mi> <mrow class="MJX-TeXAtom-ORD"> <mspace width="1em" /> <mo stretchy="false">(</mo> <mi>mod</mi> <mspace width="0.333em" /> <mi>n</mi> <mo stretchy="false">)</mo> </mrow> <mo>.</mo> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle (h^{e})^{d}=h^{ed}=h^{de}=(h^{d})^{e}\equiv h{\pmod {n}}.}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/4b4d480196d3152d504617fdf7b1ddfc7f715e4d" class="mwe-math-fallback-image-display mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:42.33ex; height:3.176ex;" alt="{\displaystyle (h^{e})^{d}=h^{ed}=h^{de}=(h^{d})^{e}\equiv h{\pmod {n}}.}"> Thus the keys may be swapped without loss of generality, that is, a private key of a key pair may be used either to: <ol><li>Decrypt a message only intended for the recipient, which may be encrypted by anyone having the public key (asymmetric encrypted transport).</li> <li>Encrypt a message which may be decrypted by anyone, but which can only be encrypted by one person; this provides a digital signature.</li></ol> <div class="mw-heading mw-heading2"><h2 id="Proofs_of_correctness">Proofs of correctness</h2>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=10" title="Edit section: Proofs of correctness">edit</a>]</div> <div class="mw-heading mw-heading3"><h3 id="Proof_using_Fermat's_little_theorem">Proof using Fermat's little theorem</h3>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=11" title="Edit section: Proof using Fermat's little theorem">edit</a>]</div> The proof of the correctness of RSA is based on <a href="/wiki/Fermat%27s_little_theorem" title="Fermat's little theorem">Fermat's little theorem</a>, stating that ap − 1 ≡ 1 (mod p) for any integer a and prime p, not dividing a.<a href="#cite_note-24">[note 1]</a> We want to show that <math display="block" xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle (m^{e})^{d}\equiv m{\pmod {pq}}}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mo stretchy="false">(</mo> <msup> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>e</mi> </mrow> </msup> <msup> <mo stretchy="false">)</mo> <mrow class="MJX-TeXAtom-ORD"> <mi>d</mi> </mrow> </msup> <mo>≡</mo> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mspace width="1em" /> <mo stretchy="false">(</mo> <mi>mod</mi> <mspace width="0.333em" /> <mi>p</mi> <mi>q</mi> <mo stretchy="false">)</mo> </mrow> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle (m^{e})^{d}\equiv m{\pmod {pq}}}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/5ebb2828955ddd2510a60c32ea2ec12203752025" class="mwe-math-fallback-image-display mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:23.002ex; height:3.176ex;" alt="{\displaystyle (m^{e})^{d}\equiv m{\pmod {pq}}}"> for every integer m when p and q are distinct prime numbers and e and d are positive integers satisfying ed ≡ 1 (mod λ(pq)). Since λ(pq) = <a href="/wiki/Least_common_multiple" title="Least common multiple">lcm</a>(p − 1, q − 1) is, by construction, divisible by both p − 1 and q − 1, we can write <math display="block" xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle ed-1=h(p-1)=k(q-1)}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mi>e</mi> <mi>d</mi> <mo>−</mo> <mn>1</mn> <mo>=</mo> <mi>h</mi> <mo stretchy="false">(</mo> <mi>p</mi> <mo>−</mo> <mn>1</mn> <mo stretchy="false">)</mo> <mo>=</mo> <mi>k</mi> <mo stretchy="false">(</mo> <mi>q</mi> <mo>−</mo> <mn>1</mn> <mo stretchy="false">)</mo> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle ed-1=h(p-1)=k(q-1)}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/56b4523b835b014483cf8e7e383aeae762c4ae12" class="mwe-math-fallback-image-display mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:28.913ex; height:2.843ex;" alt="{\displaystyle ed-1=h(p-1)=k(q-1)}"> for some nonnegative integers h and k.<a href="#cite_note-25">[note 2]</a> To check whether two numbers, such as med and m, are congruent mod pq, it suffices (and in fact is equivalent) to check that they are congruent mod p and mod q separately.<a href="#cite_note-26">[note 3]</a> To show med ≡ m (mod p), we consider two cases: <ol><li>If m ≡ 0 (mod p), m is a multiple of p. Thus med is a multiple of p. So med ≡ 0 ≡ m (mod p).</li> <li>If m <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle \not \equiv }"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mo>≢</mo> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle \not \equiv }</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/7d130bfc3eff6deb5c732a636f866cd9e373c197" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:1.809ex; height:2.676ex;" alt="{\displaystyle \not \equiv }"> 0 (mod p), <dl><dd><math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m^{ed}=m^{ed-1}m=m^{h(p-1)}m=(m^{p-1})^{h}m\equiv 1^{h}m\equiv m{\pmod {p}},}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <msup> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>e</mi> <mi>d</mi> </mrow> </msup> <mo>=</mo> <msup> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>e</mi> <mi>d</mi> <mo>−</mo> <mn>1</mn> </mrow> </msup> <mi>m</mi> <mo>=</mo> <msup> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>h</mi> <mo stretchy="false">(</mo> <mi>p</mi> <mo>−</mo> <mn>1</mn> <mo stretchy="false">)</mo> </mrow> </msup> <mi>m</mi> <mo>=</mo> <mo stretchy="false">(</mo> <msup> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>p</mi> <mo>−</mo> <mn>1</mn> </mrow> </msup> <msup> <mo stretchy="false">)</mo> <mrow class="MJX-TeXAtom-ORD"> <mi>h</mi> </mrow> </msup> <mi>m</mi> <mo>≡</mo> <msup> <mn>1</mn> <mrow class="MJX-TeXAtom-ORD"> <mi>h</mi> </mrow> </msup> <mi>m</mi> <mo>≡</mo> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mspace width="1em" /> <mo stretchy="false">(</mo> <mi>mod</mi> <mspace width="0.333em" /> <mi>p</mi> <mo stretchy="false">)</mo> </mrow> <mo>,</mo> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle m^{ed}=m^{ed-1}m=m^{h(p-1)}m=(m^{p-1})^{h}m\equiv 1^{h}m\equiv m{\pmod {p}},}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/d3910372951b43f96d684625b2180bb7b35a586e" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:65.048ex; height:3.343ex;" alt="{\displaystyle m^{ed}=m^{ed-1}m=m^{h(p-1)}m=(m^{p-1})^{h}m\equiv 1^{h}m\equiv m{\pmod {p}},}"></dd> <dd>where we used <a href="/wiki/Fermat%27s_little_theorem" title="Fermat's little theorem">Fermat's little theorem</a> to replace mp−1 mod p with 1.</dd></dl></li></ol> The verification that med ≡ m (mod q) proceeds in a completely analogous way: <ol><li>If m ≡ 0 (mod q), med is a multiple of q. So med ≡ 0 ≡ m (mod q).</li> <li>If m <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle \not \equiv }"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mo>≢</mo> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle \not \equiv }</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/7d130bfc3eff6deb5c732a636f866cd9e373c197" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:1.809ex; height:2.676ex;" alt="{\displaystyle \not \equiv }"> 0 (mod q), <dl><dd><math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m^{ed}=m^{ed-1}m=m^{k(q-1)}m=(m^{q-1})^{k}m\equiv 1^{k}m\equiv m{\pmod {q}}.}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <msup> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>e</mi> <mi>d</mi> </mrow> </msup> <mo>=</mo> <msup> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>e</mi> <mi>d</mi> <mo>−</mo> <mn>1</mn> </mrow> </msup> <mi>m</mi> <mo>=</mo> <msup> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>k</mi> <mo stretchy="false">(</mo> <mi>q</mi> <mo>−</mo> <mn>1</mn> <mo stretchy="false">)</mo> </mrow> </msup> <mi>m</mi> <mo>=</mo> <mo stretchy="false">(</mo> <msup> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>q</mi> <mo>−</mo> <mn>1</mn> </mrow> </msup> <msup> <mo stretchy="false">)</mo> <mrow class="MJX-TeXAtom-ORD"> <mi>k</mi> </mrow> </msup> <mi>m</mi> <mo>≡</mo> <msup> <mn>1</mn> <mrow class="MJX-TeXAtom-ORD"> <mi>k</mi> </mrow> </msup> <mi>m</mi> <mo>≡</mo> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mspace width="1em" /> <mo stretchy="false">(</mo> <mi>mod</mi> <mspace width="0.333em" /> <mi>q</mi> <mo stretchy="false">)</mo> </mrow> <mo>.</mo> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle m^{ed}=m^{ed-1}m=m^{k(q-1)}m=(m^{q-1})^{k}m\equiv 1^{k}m\equiv m{\pmod {q}}.}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/7a95337338557a3c99b74236a109fc76c0a14a94" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:64.536ex; height:3.343ex;" alt="{\displaystyle m^{ed}=m^{ed-1}m=m^{k(q-1)}m=(m^{q-1})^{k}m\equiv 1^{k}m\equiv m{\pmod {q}}.}"></dd></dl></li></ol> This completes the proof that, for any integer m, and integers e, d such that ed ≡ 1 (mod λ(pq)), <math display="block" xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle (m^{e})^{d}\equiv m{\pmod {pq}}.}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mo stretchy="false">(</mo> <msup> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>e</mi> </mrow> </msup> <msup> <mo stretchy="false">)</mo> <mrow class="MJX-TeXAtom-ORD"> <mi>d</mi> </mrow> </msup> <mo>≡</mo> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mspace width="1em" /> <mo stretchy="false">(</mo> <mi>mod</mi> <mspace width="0.333em" /> <mi>p</mi> <mi>q</mi> <mo stretchy="false">)</mo> </mrow> <mo>.</mo> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle (m^{e})^{d}\equiv m{\pmod {pq}}.}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/88178479fd469aba57ad446cf4df716cb26da7d2" class="mwe-math-fallback-image-display mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:23.649ex; height:3.176ex;" alt="{\displaystyle (m^{e})^{d}\equiv m{\pmod {pq}}.}"> <div class="mw-heading mw-heading4"><h4 id="Notes">Notes</h4>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=12" title="Edit section: Notes">edit</a>]</div> <style data-mw-deduplicate="TemplateStyles:r1239543626">.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}</style><div class="reflist"> <div class="mw-references-wrap"><ol class="references"> <li id="cite_note-24"><a href="#cite_ref-24">^</a> We cannot trivially break RSA by applying the theorem (mod pq) because pq is not prime. </li> <li id="cite_note-25"><a href="#cite_ref-25">^</a> In particular, the statement above holds for any e and d that satisfy ed ≡ 1 (mod (p − 1)(q − 1)), since (p − 1)(q − 1) is divisible by λ(pq), and thus trivially also by p − 1 and q − 1. However, in modern implementations of RSA, it is common to use a reduced private exponent d that only satisfies the weaker, but sufficient condition ed ≡ 1 (mod λ(pq)). </li> <li id="cite_note-26"><a href="#cite_ref-26">^</a> This is part of the <a href="/wiki/Chinese_remainder_theorem" title="Chinese remainder theorem">Chinese remainder theorem</a>, although it is not the significant part of that theorem. </li> </ol></div></div> <div class="mw-heading mw-heading3"><h3 id="Proof_using_Euler's_theorem">Proof using Euler's theorem</h3>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=13" title="Edit section: Proof using Euler's theorem">edit</a>]</div> Although the original paper of Rivest, Shamir, and Adleman used Fermat's little theorem to explain why RSA works, it is common to find proofs that rely instead on <a href="/wiki/Euler%27s_theorem" title="Euler's theorem">Euler's theorem</a>. We want to show that med ≡ m (mod n), where n = pq is a product of two different prime numbers, and e and d are positive integers satisfying ed ≡ 1 (mod φ(n)). Since e and d are positive, we can write ed = 1 + hφ(n) for some non-negative integer h. Assuming that m is relatively prime to n, we have <math display="block" xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m^{ed}=m^{1+h\varphi (n)}=m(m^{\varphi (n)})^{h}\equiv m(1)^{h}\equiv m{\pmod {n}},}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <msup> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>e</mi> <mi>d</mi> </mrow> </msup> <mo>=</mo> <msup> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mn>1</mn> <mo>+</mo> <mi>h</mi> <mi>φ</mi> <mo stretchy="false">(</mo> <mi>n</mi> <mo stretchy="false">)</mo> </mrow> </msup> <mo>=</mo> <mi>m</mi> <mo stretchy="false">(</mo> <msup> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>φ</mi> <mo stretchy="false">(</mo> <mi>n</mi> <mo stretchy="false">)</mo> </mrow> </msup> <msup> <mo stretchy="false">)</mo> <mrow class="MJX-TeXAtom-ORD"> <mi>h</mi> </mrow> </msup> <mo>≡</mo> <mi>m</mi> <mo stretchy="false">(</mo> <mn>1</mn> <msup> <mo stretchy="false">)</mo> <mrow class="MJX-TeXAtom-ORD"> <mi>h</mi> </mrow> </msup> <mo>≡</mo> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mspace width="1em" /> <mo stretchy="false">(</mo> <mi>mod</mi> <mspace width="0.333em" /> <mi>n</mi> <mo stretchy="false">)</mo> </mrow> <mo>,</mo> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle m^{ed}=m^{1+h\varphi (n)}=m(m^{\varphi (n)})^{h}\equiv m(1)^{h}\equiv m{\pmod {n}},}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/b1d66fbfbbdea9bb287238fa364c3445201b511f" class="mwe-math-fallback-image-display mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:55.552ex; height:3.343ex;" alt="{\displaystyle m^{ed}=m^{1+h\varphi (n)}=m(m^{\varphi (n)})^{h}\equiv m(1)^{h}\equiv m{\pmod {n}},}"> where the second-last congruence follows from <a href="/wiki/Euler%27s_theorem" title="Euler's theorem">Euler's theorem</a>. More generally, for any e and d satisfying ed ≡ 1 (mod λ(n)), the same conclusion follows from <a href="/wiki/Carmichael_function#Carmichael's_theorem" title="Carmichael function">Carmichael's generalization of Euler's theorem</a>, which states that mλ(n) ≡ 1 (mod n) for all m relatively prime to n. When m is not relatively prime to n, the argument just given is invalid. This is highly improbable (only a proportion of 1/p + 1/q − 1/(pq) numbers have this property), but even in this case, the desired congruence is still true. Either m ≡ 0 (mod p) or m ≡ 0 (mod q), and these cases can be treated using the previous proof. <div class="mw-heading mw-heading2"><h2 id="Padding">Padding</h2>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=14" title="Edit section: Padding">edit</a>]</div> <div class="mw-heading mw-heading3"><h3 id="Attacks_against_plain_RSA">Attacks against plain RSA</h3>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=15" title="Edit section: Attacks against plain RSA">edit</a>]</div> There are a number of attacks against plain RSA as described below. <ul><li>When encrypting with low encryption exponents (e.g., e = 3) and small values of the m (i.e., m < n1/e), the result of me is strictly less than the modulus n. In this case, ciphertexts can be decrypted easily by taking the eth root of the ciphertext over the integers.</li> <li>If the same clear-text message is sent to e or more recipients in an encrypted way, and the receivers share the same exponent e, but different p, q, and therefore n, then it is easy to decrypt the original clear-text message via the <a href="/wiki/Chinese_remainder_theorem" title="Chinese remainder theorem">Chinese remainder theorem</a>. <a href="/wiki/Johan_H%C3%A5stad" title="Johan Håstad">Johan Håstad</a> noticed that this attack is possible even if the clear texts are not equal, but the attacker knows a linear relation between them.<a href="#cite_note-27">[22]</a> This attack was later improved by <a href="/wiki/Don_Coppersmith" title="Don Coppersmith">Don Coppersmith</a> (see <a href="/wiki/Coppersmith%27s_attack" title="Coppersmith's attack">Coppersmith's attack</a>).<a href="#cite_note-28">[23]</a></li> <li>Because RSA encryption is a <a href="/wiki/Deterministic_algorithm" title="Deterministic algorithm">deterministic encryption algorithm</a> (i.e., has no random component) an attacker can successfully launch a <a href="/wiki/Chosen_plaintext_attack" class="mw-redirect" title="Chosen plaintext attack">chosen plaintext attack</a> against the cryptosystem, by encrypting likely plaintexts under the public key and test whether they are equal to the ciphertext. A cryptosystem is called <a href="/wiki/Semantically_secure" class="mw-redirect" title="Semantically secure">semantically secure</a> if an attacker cannot distinguish two encryptions from each other, even if the attacker knows (or has chosen) the corresponding plaintexts. RSA without padding is not semantically secure.<a href="#cite_note-29">[24]</a></li> <li>RSA has the property that the product of two ciphertexts is equal to the encryption of the product of the respective plaintexts. That is, m1em2e ≡ (m1m2)e (mod n). Because of this multiplicative property, a <a href="/wiki/Chosen-ciphertext_attack" title="Chosen-ciphertext attack">chosen-ciphertext attack</a> is possible. E.g., an attacker who wants to know the decryption of a ciphertext c ≡ me (mod n) may ask the holder of the private key d to decrypt an unsuspicious-looking ciphertext c′ ≡ cre (mod n) for some value r chosen by the attacker. Because of the multiplicative property, c' is the encryption of mr (mod n). Hence, if the attacker is successful with the attack, they will learn mr (mod n), from which they can derive the message m by multiplying mr with the modular inverse of r modulo n.[<a href="/wiki/Wikipedia:Citation_needed" title="Wikipedia:Citation needed">citation needed</a>]</li> <li>Given the private exponent d, one can efficiently factor the modulus n = pq. And given factorization of the modulus n = pq, one can obtain any private key (d', n) generated against a public key (e', n).<a href="#cite_note-Boneh99-15">[15]</a></li></ul> <div class="mw-heading mw-heading3"><h3 id="Padding_schemes">Padding schemes</h3>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=16" title="Edit section: Padding schemes">edit</a>]</div> To avoid these problems, practical RSA implementations typically embed some form of structured, randomized <a href="/wiki/Padding_(cryptography)" title="Padding (cryptography)">padding</a> into the value m before encrypting it. This padding ensures that m does not fall into the range of insecure plaintexts, and that a given message, once padded, will encrypt to one of a large number of different possible ciphertexts. Standards such as <a href="/wiki/PKCS1" class="mw-redirect" title="PKCS1">PKCS#1</a> have been carefully designed to securely pad messages prior to RSA encryption. Because these schemes pad the plaintext m with some number of additional bits, the size of the un-padded message M must be somewhat smaller. RSA padding schemes must be carefully designed so as to prevent sophisticated attacks that may be facilitated by a predictable message structure. Early versions of the PKCS#1 standard (up to version 1.5) used a construction that appears to make RSA semantically secure. However, at <a href="/wiki/International_Cryptology_Conference" class="mw-redirect" title="International Cryptology Conference">Crypto</a> 1998, Bleichenbacher showed that this version is vulnerable to a practical <a href="/wiki/Adaptive_chosen-ciphertext_attack" title="Adaptive chosen-ciphertext attack">adaptive chosen-ciphertext attack</a>. Furthermore, at <a href="/wiki/Eurocrypt" class="mw-redirect" title="Eurocrypt">Eurocrypt</a> 2000, Coron et al.<a href="#cite_note-30">[25]</a> showed that for some types of messages, this padding does not provide a high enough level of security. Later versions of the standard include <a href="/wiki/Optimal_Asymmetric_Encryption_Padding" class="mw-redirect" title="Optimal Asymmetric Encryption Padding">Optimal Asymmetric Encryption Padding</a> (OAEP), which prevents these attacks. As such, OAEP should be used in any new application, and PKCS#1 v1.5 padding should be replaced wherever possible. The PKCS#1 standard also incorporates processing schemes designed to provide additional security for RSA signatures, e.g. the Probabilistic Signature Scheme for RSA (<a href="/wiki/RSA-PSS" class="mw-redirect" title="RSA-PSS">RSA-PSS</a>). Secure padding schemes such as RSA-PSS are as essential for the security of message signing as they are for message encryption. Two USA patents on PSS were granted (<a rel="nofollow" class="external text" href="https://patents.google.com/patent/US6266771">U.S. patent 6,266,771</a> and <a rel="nofollow" class="external text" href="https://patents.google.com/patent/US7036014">U.S. patent 7,036,014</a>); however, these patents expired on 24 July 2009 and 25 April 2010 respectively. Use of PSS no longer seems to be encumbered by patents.[<a href="/wiki/Wikipedia:No_original_research" title="Wikipedia:No original research">original research?</a>] Note that using different RSA key pairs for encryption and signing is potentially more secure.<a href="#cite_note-31">[26]</a> <div class="mw-heading mw-heading2"><h2 id="Security_and_practical_considerations">Security and practical considerations</h2>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=17" title="Edit section: Security and practical considerations">edit</a>]</div> <div class="mw-heading mw-heading3"><h3 id="Using_the_Chinese_remainder_algorithm">Using the Chinese remainder algorithm</h3>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=18" title="Edit section: Using the Chinese remainder algorithm">edit</a>]</div> For efficiency, many popular crypto libraries (such as <a href="/wiki/OpenSSL" title="OpenSSL">OpenSSL</a>, <a href="/wiki/Java_(programming_language)" title="Java (programming language)">Java</a> and <a href="/wiki/.NET_Framework" title=".NET Framework">.NET</a>) use for decryption and signing the following optimization based on the <a href="/wiki/Chinese_remainder_theorem" title="Chinese remainder theorem">Chinese remainder theorem</a>.<a href="#cite_note-32">[27]</a>[<a href="/wiki/Wikipedia:Citation_needed" title="Wikipedia:Citation needed">citation needed</a>] The following values are precomputed and stored as part of the private key: <ul><li><math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle p}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mi>p</mi> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle p}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/81eac1e205430d1f40810df36a0edffdc367af36" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; margin-left: -0.089ex; width:1.259ex; height:2.009ex;" alt="{\displaystyle p}"> and <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle q}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mi>q</mi> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle q}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/06809d64fa7c817ffc7e323f85997f783dbdf71d" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:1.07ex; height:2.009ex;" alt="{\displaystyle q}"> – the primes from the key generation,</li> <li><math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle d_{P}=d{\pmod {p-1}},}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <msub> <mi>d</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>P</mi> </mrow> </msub> <mo>=</mo> <mi>d</mi> <mrow class="MJX-TeXAtom-ORD"> <mspace width="1em" /> <mo stretchy="false">(</mo> <mi>mod</mi> <mspace width="0.333em" /> <mi>p</mi> <mo>−</mo> <mn>1</mn> <mo stretchy="false">)</mo> </mrow> <mo>,</mo> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle d_{P}=d{\pmod {p-1}},}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/36a61d36357d76808d97222ba626855a788a0a2f" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:22.493ex; height:2.843ex;" alt="{\displaystyle d_{P}=d{\pmod {p-1}},}"></li> <li><math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle d_{Q}=d{\pmod {q-1}},}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <msub> <mi>d</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>Q</mi> </mrow> </msub> <mo>=</mo> <mi>d</mi> <mrow class="MJX-TeXAtom-ORD"> <mspace width="1em" /> <mo stretchy="false">(</mo> <mi>mod</mi> <mspace width="0.333em" /> <mi>q</mi> <mo>−</mo> <mn>1</mn> <mo stretchy="false">)</mo> </mrow> <mo>,</mo> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle d_{Q}=d{\pmod {q-1}},}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/03712c1d05b0c3206c5627cd44aafefb85b14561" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -1.005ex; width:22.459ex; height:3.009ex;" alt="{\displaystyle d_{Q}=d{\pmod {q-1}},}"></li> <li><math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle q_{\text{inv}}=q^{-1}{\pmod {p}}.}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <msub> <mi>q</mi> <mrow class="MJX-TeXAtom-ORD"> <mtext>inv</mtext> </mrow> </msub> <mo>=</mo> <msup> <mi>q</mi> <mrow class="MJX-TeXAtom-ORD"> <mo>−</mo> <mn>1</mn> </mrow> </msup> <mrow class="MJX-TeXAtom-ORD"> <mspace width="1em" /> <mo stretchy="false">(</mo> <mi>mod</mi> <mspace width="0.333em" /> <mi>p</mi> <mo stretchy="false">)</mo> </mrow> <mo>.</mo> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle q_{\text{inv}}=q^{-1}{\pmod {p}}.}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/539477e9a5a38ccba5f7a8f55d85661b235077b4" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:21.52ex; height:3.176ex;" alt="{\displaystyle q_{\text{inv}}=q^{-1}{\pmod {p}}.}"></li></ul> These values allow the recipient to compute the exponentiation m = cd (mod pq) more efficiently as follows:      <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m_{1}=c^{d_{P}}{\pmod {p}}}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <msub> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mn>1</mn> </mrow> </msub> <mo>=</mo> <msup> <mi>c</mi> <mrow class="MJX-TeXAtom-ORD"> <msub> <mi>d</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>P</mi> </mrow> </msub> </mrow> </msup> <mrow class="MJX-TeXAtom-ORD"> <mspace width="1em" /> <mo stretchy="false">(</mo> <mi>mod</mi> <mspace width="0.333em" /> <mi>p</mi> <mo stretchy="false">)</mo> </mrow> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle m_{1}=c^{d_{P}}{\pmod {p}}}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/f35c63607cbb474d1b8ff435b50f72906a7b641c" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:20.307ex; height:3.176ex;" alt="{\displaystyle m_{1}=c^{d_{P}}{\pmod {p}}}">,      <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m_{2}=c^{d_{Q}}{\pmod {q}}}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <msub> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mn>2</mn> </mrow> </msub> <mo>=</mo> <msup> <mi>c</mi> <mrow class="MJX-TeXAtom-ORD"> <msub> <mi>d</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>Q</mi> </mrow> </msub> </mrow> </msup> <mrow class="MJX-TeXAtom-ORD"> <mspace width="1em" /> <mo stretchy="false">(</mo> <mi>mod</mi> <mspace width="0.333em" /> <mi>q</mi> <mo stretchy="false">)</mo> </mrow> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle m_{2}=c^{d_{Q}}{\pmod {q}}}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/faecb0fbba8c059f1cb50bd896945fb09799aec8" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:20.26ex; height:3.176ex;" alt="{\displaystyle m_{2}=c^{d_{Q}}{\pmod {q}}}">,      <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle h=q_{\text{inv}}(m_{1}-m_{2}){\pmod {p}}}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mi>h</mi> <mo>=</mo> <msub> <mi>q</mi> <mrow class="MJX-TeXAtom-ORD"> <mtext>inv</mtext> </mrow> </msub> <mo stretchy="false">(</mo> <msub> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mn>1</mn> </mrow> </msub> <mo>−</mo> <msub> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mn>2</mn> </mrow> </msub> <mo stretchy="false">)</mo> <mrow class="MJX-TeXAtom-ORD"> <mspace width="1em" /> <mo stretchy="false">(</mo> <mi>mod</mi> <mspace width="0.333em" /> <mi>p</mi> <mo stretchy="false">)</mo> </mrow> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle h=q_{\text{inv}}(m_{1}-m_{2}){\pmod {p}}}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/87403030faa7d6f210767e7c0a70772a119d8bf9" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:29.638ex; height:2.843ex;" alt="{\displaystyle h=q_{\text{inv}}(m_{1}-m_{2}){\pmod {p}}}">,<a href="#cite_note-33">[c]</a>      <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m=m_{2}+hq}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <mi>m</mi> <mo>=</mo> <msub> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mn>2</mn> </mrow> </msub> <mo>+</mo> <mi>h</mi> <mi>q</mi> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle m=m_{2}+hq}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/0fd14852ac81bb85b8051d12e296b7426e130e60" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:13.482ex; height:2.509ex;" alt="{\displaystyle m=m_{2}+hq}">. This is more efficient than computing <a href="/wiki/Exponentiation_by_squaring" title="Exponentiation by squaring">exponentiation by squaring</a>, even though two modular exponentiations have to be computed. The reason is that these two modular exponentiations both use a smaller exponent and a smaller modulus. <div class="mw-heading mw-heading3"><h3 id="Integer_factorization_and_the_RSA_problem">Integer factorization and the RSA problem</h3>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=19" title="Edit section: Integer factorization and the RSA problem">edit</a>]</div> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1236090951"><div role="note" class="hatnote navigation-not-searchable">See also: <a href="/wiki/RSA_Factoring_Challenge" title="RSA Factoring Challenge">RSA Factoring Challenge</a>, <a href="/wiki/Integer_factorization_records" title="Integer factorization records">Integer factorization records</a>, and <a href="/wiki/Shor%27s_algorithm" title="Shor's algorithm">Shor's algorithm</a></div> The security of the RSA cryptosystem is based on two mathematical problems: the problem of <a href="/wiki/Integer_factorization" title="Integer factorization">factoring large numbers</a> and the <a href="/wiki/RSA_problem" title="RSA problem">RSA problem</a>. Full decryption of an RSA ciphertext is thought to be infeasible on the assumption that both of these problems are <a href="/wiki/Computational_hardness_assumption" title="Computational hardness assumption">hard</a>, i.e., no efficient algorithm exists for solving them. Providing security against partial decryption may require the addition of a secure <a href="/wiki/Padding_(cryptography)" title="Padding (cryptography)">padding scheme</a>.<a href="#cite_note-34">[28]</a> The <a href="/wiki/RSA_problem" title="RSA problem">RSA problem</a> is defined as the task of taking eth roots modulo a composite n: recovering a value m such that c ≡ me (mod n), where (n, e) is an RSA public key, and c is an RSA ciphertext. Currently the most promising approach to solving the RSA problem is to factor the modulus n. With the ability to recover prime factors, an attacker can compute the secret exponent d from a public key (n, e), then decrypt c using the standard procedure. To accomplish this, an attacker factors n into p and q, and computes lcm(p − 1, q − 1) that allows the determination of d from e. No polynomial-time method for factoring large integers on a classical computer has yet been found, but it has not been proven that none exists; see <a href="/wiki/Integer_factorization" title="Integer factorization">integer factorization</a> for a discussion of this problem. Multiple polynomial quadratic sieve (MPQS) can be used to factor the public modulus n. The first RSA-512 factorization in 1999 used hundreds of computers and required the equivalent of 8,400 MIPS years, over an elapsed time of about seven months.<a href="#cite_note-35">[29]</a> By 2009, Benjamin Moody could factor an 512-bit RSA key in 73 days using only public software (GGNFS) and his desktop computer (a dual-core <a href="/wiki/Athlon64" class="mw-redirect" title="Athlon64">Athlon64</a> with a 1,900 MHz CPU). Just less than 5 gigabytes of disk storage was required and about 2.5 gigabytes of RAM for the sieving process. Rivest, Shamir, and Adleman noted<a href="#cite_note-rsa-1">[1]</a> that Miller has shown that – assuming the truth of the <a href="/wiki/Generalized_Riemann_hypothesis" title="Generalized Riemann hypothesis">extended Riemann hypothesis</a> – finding d from n and e is as hard as factoring n into p and q (up to a polynomial time difference).<a href="#cite_note-36">[30]</a> However, Rivest, Shamir, and Adleman noted, in section IX/D of their paper, that they had not found a proof that inverting RSA is as hard as factoring. As of 2020<a class="external text" href="https://en.wikipedia.org/w/index.php?title=RSA_(cryptosystem)&action=edit">[update]</a>, the largest publicly known factored <a href="/wiki/RSA_number" class="mw-redirect" title="RSA number">RSA number</a> had 829 bits (250 decimal digits, <a href="/wiki/RSA-250" class="mw-redirect" title="RSA-250">RSA-250</a>).<a href="#cite_note-37">[31]</a> Its factorization, by a state-of-the-art distributed implementation, took about 2,700 CPU-years. In practice, RSA keys are typically 1024 to 4096 bits long. In 2003, <a href="/wiki/RSA_Security" title="RSA Security">RSA Security</a> estimated that 1024-bit keys were likely to become crackable by 2010.<a href="#cite_note-twirl-38">[32]</a> As of 2020, it is not known whether such keys can be cracked, but minimum recommendations have moved to at least 2048 bits.<a href="#cite_note-keymanagement-39">[33]</a> It is generally presumed that RSA is secure if n is sufficiently large, outside of quantum computing. If n is 300 <a href="/wiki/Bit" title="Bit">bits</a> or shorter, it can be factored in a few hours on a <a href="/wiki/Personal_computer" title="Personal computer">personal computer</a>, using software already freely available. Keys of 512 bits have been shown to be practically breakable in 1999, when <a href="/wiki/RSA-155" class="mw-redirect" title="RSA-155">RSA-155</a> was factored by using several hundred computers, and these are now factored in a few weeks using common hardware. Exploits using 512-bit code-signing certificates that may have been factored were reported in 2011.<a href="#cite_note-40">[34]</a> A theoretical hardware device named <a href="/wiki/TWIRL" title="TWIRL">TWIRL</a>, described by Shamir and Tromer in 2003, called into question the security of 1024-bit keys.<a href="#cite_note-twirl-38">[32]</a> In 1994, <a href="/wiki/Peter_Shor" title="Peter Shor">Peter Shor</a> showed that a <a href="/wiki/Quantum_computer" class="mw-redirect" title="Quantum computer">quantum computer</a> – if one could ever be practically created for the purpose – would be able to factor in <a href="/wiki/Polynomial_time" class="mw-redirect" title="Polynomial time">polynomial time</a>, breaking RSA; see <a href="/wiki/Shor%27s_algorithm" title="Shor's algorithm">Shor's algorithm</a>. <div class="mw-heading mw-heading3"><h3 id="Faulty_key_generation">Faulty key generation</h3>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=20" title="Edit section: Faulty key generation">edit</a>]</div> <style data-mw-deduplicate="TemplateStyles:r1251242444">.mw-parser-output .ambox{border:1px solid #a2a9b1;border-left:10px solid #36c;background-color:#fbfbfb;box-sizing:border-box}.mw-parser-output .ambox+link+.ambox,.mw-parser-output .ambox+link+style+.ambox,.mw-parser-output .ambox+link+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+style+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+link+.ambox{margin-top:-1px}html body.mediawiki .mw-parser-output .ambox.mbox-small-left{margin:4px 1em 4px 0;overflow:hidden;width:238px;border-collapse:collapse;font-size:88%;line-height:1.25em}.mw-parser-output .ambox-speedy{border-left:10px solid #b32424;background-color:#fee7e6}.mw-parser-output .ambox-delete{border-left:10px solid #b32424}.mw-parser-output .ambox-content{border-left:10px solid #f28500}.mw-parser-output .ambox-style{border-left:10px solid #fc3}.mw-parser-output .ambox-move{border-left:10px solid #9932cc}.mw-parser-output .ambox-protection{border-left:10px solid #a2a9b1}.mw-parser-output .ambox .mbox-text{border:none;padding:0.25em 0.5em;width:100%}.mw-parser-output .ambox .mbox-image{border:none;padding:2px 0 2px 0.5em;text-align:center}.mw-parser-output .ambox .mbox-imageright{border:none;padding:2px 0.5em 2px 0;text-align:center}.mw-parser-output .ambox .mbox-empty-cell{border:none;padding:0;width:1px}.mw-parser-output .ambox .mbox-image-div{width:52px}@media(min-width:720px){.mw-parser-output .ambox{margin:0 10%}}@media print{body.ns-0 .mw-parser-output .ambox{display:none!important}}</style><table class="box-More_citations_needed plainlinks metadata ambox ambox-content ambox-Refimprove" role="presentation"><tbody><tr><td class="mbox-image"><div class="mbox-image-div"><a href="/wiki/File:Question_book-new.svg" class="mw-file-description"><img alt="" src="//upload.wikimedia.org/wikipedia/en/thumb/9/99/Question_book-new.svg/50px-Question_book-new.svg.png" decoding="async" width="50" height="39" class="mw-file-element" srcset="//upload.wikimedia.org/wikipedia/en/thumb/9/99/Question_book-new.svg/75px-Question_book-new.svg.png 1.5x, //upload.wikimedia.org/wikipedia/en/thumb/9/99/Question_book-new.svg/100px-Question_book-new.svg.png 2x" data-file-width="512" data-file-height="399" /></a></div></td><td class="mbox-text"><div class="mbox-text-span">This section needs additional citations for <a href="/wiki/Wikipedia:Verifiability" title="Wikipedia:Verifiability">verification</a>. Please help <a href="/wiki/Special:EditPage/RSA_(cryptosystem)" title="Special:EditPage/RSA (cryptosystem)">improve this article</a> by <a href="/wiki/Help:Referencing_for_beginners" title="Help:Referencing for beginners">adding citations to reliable sources</a> in this section. Unsourced material may be challenged and removed. Find sources: <a rel="nofollow" class="external text" href="https://www.google.com/search?as_eq=wikipedia&q=%22RSA%22+cryptosystem">"RSA" cryptosystem</a> – <a rel="nofollow" class="external text" href="https://www.google.com/search?tbm=nws&q=%22RSA%22+cryptosystem+-wikipedia&tbs=ar:1">news</a> · <a rel="nofollow" class="external text" href="https://www.google.com/search?&q=%22RSA%22+cryptosystem&tbs=bkt:s&tbm=bks">newspapers</a> · <a rel="nofollow" class="external text" href="https://www.google.com/search?tbs=bks:1&q=%22RSA%22+cryptosystem+-wikipedia">books</a> · <a rel="nofollow" class="external text" href="https://scholar.google.com/scholar?q=%22RSA%22+cryptosystem">scholar</a> · <a rel="nofollow" class="external text" href="https://www.jstor.org/action/doBasicSearch?Query=%22RSA%22+cryptosystem&acc=on&wc=on">JSTOR</a> (October 2017) (<a href="/wiki/Help:Maintenance_template_removal" title="Help:Maintenance template removal">Learn how and when to remove this message</a>)</div></td></tr></tbody></table> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1236090951"><div role="note" class="hatnote navigation-not-searchable">See also: <a href="/wiki/Coppersmith%27s_attack" title="Coppersmith's attack">Coppersmith's attack</a> and <a href="/wiki/Wiener%27s_attack" title="Wiener's attack">Wiener's attack</a></div> Finding the large primes p and q is usually done by testing random numbers of the correct size with probabilistic <a href="/wiki/Primality_test" title="Primality test">primality tests</a> that quickly eliminate virtually all of the nonprimes. The numbers p and q should not be "too close", lest the <a href="/wiki/Fermat_factorization" class="mw-redirect" title="Fermat factorization">Fermat factorization</a> for n be successful. If p − q is less than 2n1/4 (n = p⋅q, which even for "small" 1024-bit values of n is 3×1077), solving for p and q is trivial. Furthermore, if either p − 1 or q − 1 has only small prime factors, n can be factored quickly by <a href="/wiki/Pollard%27s_p_%E2%88%92_1_algorithm" title="Pollard's p − 1 algorithm">Pollard's p − 1 algorithm</a>, and hence such values of p or q should be discarded. It is important that the private exponent d be large enough. Michael J. Wiener showed that if p is between q and 2q (which is quite typical) and d < n1/4/3, then d can be computed efficiently from n and e.<a href="#cite_note-wiener-41">[35]</a> There is no known attack against small public exponents such as e = 3, provided that the proper padding is used. <a href="/wiki/Coppersmith%27s_attack" title="Coppersmith's attack">Coppersmith's attack</a> has many applications in attacking RSA specifically if the public exponent e is small and if the encrypted message is short and not padded. <a href="/wiki/65537" class="mw-redirect" title="65537">65537</a> is a commonly used value for e; this value can be regarded as a compromise between avoiding potential small-exponent attacks and still allowing efficient encryptions (or signature verification). The NIST Special Publication on Computer Security (SP 800-78 Rev. 1 of August 2007) does not allow public exponents e smaller than 65537, but does not state a reason for this restriction. In October 2017, a team of researchers from <a href="/wiki/Masaryk_University" title="Masaryk University">Masaryk University</a> announced the <a href="/wiki/ROCA_vulnerability" title="ROCA vulnerability">ROCA vulnerability</a>, which affects RSA keys generated by an algorithm embodied in a library from <a href="/wiki/Infineon" class="mw-redirect" title="Infineon">Infineon</a> known as RSALib. A large number of <a href="/wiki/Smart_card" title="Smart card">smart cards</a> and <a href="/wiki/Trusted_platform_module" class="mw-redirect" title="Trusted platform module">trusted platform modules</a> (TPM) were shown to be affected. Vulnerable RSA keys are easily identified using a test program the team released.<a href="#cite_note-nemecsys-42">[36]</a> <div class="mw-heading mw-heading3"><h3 id="Importance_of_strong_random_number_generation">Importance of strong random number generation</h3>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=21" title="Edit section: Importance of strong random number generation">edit</a>]</div> A cryptographically strong <a href="/wiki/Random_number_generator" class="mw-redirect" title="Random number generator">random number generator</a>, which has been properly seeded with adequate entropy, must be used to generate the primes p and q. An analysis comparing millions of public keys gathered from the Internet was carried out in early 2012 by <a href="/wiki/Arjen_Klaas_Lenstra" class="mw-redirect" title="Arjen Klaas Lenstra">Arjen K. Lenstra</a>, James P. Hughes, Maxime Augier, Joppe W. Bos, Thorsten Kleinjung and Christophe Wachter. They were able to factor 0.2% of the keys using only Euclid's algorithm.<a href="#cite_note-43">[37]</a><a href="#cite_note-44">[38]</a>[<a href="/wiki/Wikipedia:Verifiability#Self-published_sources" title="Wikipedia:Verifiability">self-published source?</a>] They exploited a weakness unique to cryptosystems based on integer factorization. If n = pq is one public key, and n′ = p′q′ is another, then if by chance p = p′ (but q is not equal to q'), then a simple computation of gcd(n, n′) = p factors both n and n', totally compromising both keys. Lenstra et al. note that this problem can be minimized by using a strong random seed of bit length twice the intended security level, or by employing a deterministic function to choose q given p, instead of choosing p and q independently. <a href="/wiki/Nadia_Heninger" title="Nadia Heninger">Nadia Heninger</a> was part of a group that did a similar experiment. They used an idea of <a href="/wiki/Daniel_J._Bernstein" title="Daniel J. Bernstein">Daniel J. Bernstein</a> to compute the GCD of each RSA key n against the product of all the other keys n' they had found (a 729-million-digit number), instead of computing each gcd(n, n′) separately, thereby achieving a very significant speedup, since after one large division, the GCD problem is of normal size. Heninger says in her blog that the bad keys occurred almost entirely in embedded applications, including "firewalls, routers, VPN devices, remote server administration devices, printers, projectors, and VOIP phones" from more than 30 manufacturers. Heninger explains that the one-shared-prime problem uncovered by the two groups results from situations where the pseudorandom number generator is poorly seeded initially, and then is reseeded between the generation of the first and second primes. Using seeds of sufficiently high entropy obtained from key stroke timings or electronic diode noise or <a href="/wiki/Atmospheric_noise" title="Atmospheric noise">atmospheric noise</a> from a radio receiver tuned between stations should solve the problem.<a href="#cite_note-45">[39]</a> Strong random number generation is important throughout every phase of public-key cryptography. For instance, if a weak generator is used for the symmetric keys that are being distributed by RSA, then an eavesdropper could bypass RSA and guess the symmetric keys directly. <div class="mw-heading mw-heading3"><h3 id="Timing_attacks">Timing attacks</h3>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=22" title="Edit section: Timing attacks">edit</a>]</div> <a href="/wiki/Paul_Carl_Kocher" title="Paul Carl Kocher">Kocher</a> described a new attack on RSA in 1995: if the attacker Eve knows Alice's hardware in sufficient detail and is able to measure the decryption times for several known ciphertexts, Eve can deduce the decryption key d quickly. This attack can also be applied against the RSA signature scheme. In 2003, <a href="/wiki/Dan_Boneh" title="Dan Boneh">Boneh</a> and <a href="/wiki/David_Brumley" title="David Brumley">Brumley</a> demonstrated a more practical attack capable of recovering RSA factorizations over a network connection (e.g., from a <a href="/wiki/Secure_Sockets_Layer" class="mw-redirect" title="Secure Sockets Layer">Secure Sockets Layer</a> (SSL)-enabled webserver).<a href="#cite_note-Boneh03-46">[40]</a> This attack takes advantage of information leaked by the <a href="/wiki/Chinese_remainder_theorem" title="Chinese remainder theorem">Chinese remainder theorem</a> optimization used by many RSA implementations. One way to thwart these attacks is to ensure that the decryption operation takes a constant amount of time for every ciphertext. However, this approach can significantly reduce performance. Instead, most RSA implementations use an alternate technique known as <a href="/wiki/Blinding_(cryptography)" title="Blinding (cryptography)">cryptographic blinding</a>. RSA blinding makes use of the multiplicative property of RSA. Instead of computing cd (mod n), Alice first chooses a secret random value r and computes (rec)d (mod n). The result of this computation, after applying <a href="/wiki/Euler%27s_theorem" title="Euler's theorem">Euler's theorem</a>, is rcd (mod n), and so the effect of r can be removed by multiplying by its inverse. A new value of r is chosen for each ciphertext. With blinding applied, the decryption time is no longer correlated to the value of the input ciphertext, and so the timing attack fails. <div class="mw-heading mw-heading3"><h3 id="Adaptive_chosen-ciphertext_attacks">Adaptive chosen-ciphertext attacks</h3>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=23" title="Edit section: Adaptive chosen-ciphertext attacks">edit</a>]</div> In 1998, <a href="/wiki/Daniel_Bleichenbacher" title="Daniel Bleichenbacher">Daniel Bleichenbacher</a> described the first practical <a href="/wiki/Adaptive_chosen-ciphertext_attack" title="Adaptive chosen-ciphertext attack">adaptive chosen-ciphertext attack</a> against RSA-encrypted messages using the PKCS #1 v1 <a href="/wiki/Padding_(cryptography)" title="Padding (cryptography)">padding scheme</a> (a padding scheme randomizes and adds structure to an RSA-encrypted message, so it is possible to determine whether a decrypted message is valid). Due to flaws with the PKCS #1 scheme, Bleichenbacher was able to mount a practical attack against RSA implementations of the <a href="/wiki/Secure_Sockets_Layer" class="mw-redirect" title="Secure Sockets Layer">Secure Sockets Layer</a> protocol and to recover session keys. As a result of this work, cryptographers now recommend the use of provably secure padding schemes such as <a href="/wiki/Optimal_Asymmetric_Encryption_Padding" class="mw-redirect" title="Optimal Asymmetric Encryption Padding">Optimal Asymmetric Encryption Padding</a>, and RSA Laboratories has released new versions of PKCS #1 that are not vulnerable to these attacks. A variant of this attack, dubbed "BERserk", came back in 2014.<a href="#cite_note-47">[41]</a><a href="#cite_note-48">[42]</a> It impacted the Mozilla NSS Crypto Library, which was used notably by Firefox and Chrome. <div class="mw-heading mw-heading3"><h3 id="Side-channel_analysis_attacks">Side-channel analysis attacks</h3>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=24" title="Edit section: Side-channel analysis attacks">edit</a>]</div> A side-channel attack using branch-prediction analysis (BPA) has been described. Many processors use a <a href="/wiki/Branch_predictor" title="Branch predictor">branch predictor</a> to determine whether a conditional branch in the instruction flow of a program is likely to be taken or not. Often these processors also implement <a href="/wiki/Simultaneous_multithreading" title="Simultaneous multithreading">simultaneous multithreading</a> (SMT). Branch-prediction analysis attacks use a spy process to discover (statistically) the private key when processed with these processors. Simple Branch Prediction Analysis (SBPA) claims to improve BPA in a non-statistical way. In their paper, "On the Power of Simple Branch Prediction Analysis",<a href="#cite_note-49">[43]</a> the authors of SBPA (Onur Aciicmez and Cetin Kaya Koc) claim to have discovered 508 out of 512 bits of an RSA key in 10 iterations. A power-fault attack on RSA implementations was described in 2010.<a href="#cite_note-50">[44]</a> The author recovered the key by varying the CPU power voltage outside limits; this caused multiple power faults on the server. <div class="mw-heading mw-heading3"><h3 id="Tricky_implementation">Tricky implementation</h3>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=25" title="Edit section: Tricky implementation">edit</a>]</div> There are many details to keep in mind in order to implement RSA securely (strong <a href="/wiki/Pseudorandom_number_generator" title="Pseudorandom number generator">PRNG</a>, acceptable public exponent, etc.). This makes the implementation challenging, to the point the book Practical Cryptography With Go suggests avoiding RSA if possible.<a href="#cite_note-51">[45]</a> <div class="mw-heading mw-heading2"><h2 id="Implementations">Implementations</h2>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=26" title="Edit section: Implementations">edit</a>]</div> Some cryptography libraries that provide support for RSA include: <ul><li><a href="/wiki/Botan_(programming_library)" title="Botan (programming library)">Botan</a></li> <li><a href="/wiki/Bouncy_Castle_(cryptography)" title="Bouncy Castle (cryptography)">Bouncy Castle</a></li> <li><a href="/wiki/Cryptlib" title="Cryptlib">cryptlib</a></li> <li><a href="/wiki/Crypto%2B%2B" title="Crypto++">Crypto++</a></li> <li><a href="/wiki/Libgcrypt" title="Libgcrypt">Libgcrypt</a></li> <li><a href="/wiki/Nettle_(cryptographic_library)" title="Nettle (cryptographic library)">Nettle</a></li> <li><a href="/wiki/OpenSSL" title="OpenSSL">OpenSSL</a></li> <li><a href="/wiki/WolfSSL#wolfCrypt" title="WolfSSL">wolfCrypt</a></li> <li><a href="/wiki/GnuTLS" title="GnuTLS">GnuTLS</a></li> <li><a href="/wiki/Mbed_TLS" title="Mbed TLS">mbed TLS</a></li> <li><a href="/wiki/LibreSSL" title="LibreSSL">LibreSSL</a></li></ul> <div class="mw-heading mw-heading2"><h2 id="See_also">See also</h2>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=27" title="Edit section: See also">edit</a>]</div> <style data-mw-deduplicate="TemplateStyles:r1259569809">.mw-parser-output .portalbox{padding:0;margin:0.5em 0;display:table;box-sizing:border-box;max-width:175px;list-style:none}.mw-parser-output .portalborder{border:1px solid var(--border-color-base,#a2a9b1);padding:0.1em;background:var(--background-color-neutral-subtle,#f8f9fa)}.mw-parser-output .portalbox-entry{display:table-row;font-size:85%;line-height:110%;height:1.9em;font-style:italic;font-weight:bold}.mw-parser-output .portalbox-image{display:table-cell;padding:0.2em;vertical-align:middle;text-align:center}.mw-parser-output .portalbox-link{display:table-cell;padding:0.2em 0.2em 0.2em 0.3em;vertical-align:middle}@media(min-width:720px){.mw-parser-output .portalleft{clear:left;float:left;margin:0.5em 1em 0.5em 0}.mw-parser-output .portalright{clear:right;float:right;margin:0.5em 0 0.5em 1em}}</style><ul role="navigation" aria-label="Portals" class="noprint portalbox portalborder portalright"> <li class="portalbox-entry"><a href="/wiki/File:Nuvola_apps_edu_mathematics_blue-p.svg" class="mw-file-description"><img alt="icon" src="//upload.wikimedia.org/wikipedia/commons/thumb/3/3e/Nuvola_apps_edu_mathematics_blue-p.svg/28px-Nuvola_apps_edu_mathematics_blue-p.svg.png" decoding="async" width="28" height="28" class="mw-file-element" srcset="//upload.wikimedia.org/wikipedia/commons/thumb/3/3e/Nuvola_apps_edu_mathematics_blue-p.svg/42px-Nuvola_apps_edu_mathematics_blue-p.svg.png 1.5x, //upload.wikimedia.org/wikipedia/commons/thumb/3/3e/Nuvola_apps_edu_mathematics_blue-p.svg/56px-Nuvola_apps_edu_mathematics_blue-p.svg.png 2x" data-file-width="128" data-file-height="128" /></a><a href="/wiki/Portal:Mathematics" title="Portal:Mathematics">Mathematics portal</a></li></ul> <ul><li><a href="/wiki/Acoustic_cryptanalysis" title="Acoustic cryptanalysis">Acoustic cryptanalysis</a></li> <li><a href="/wiki/Computational_complexity_theory" title="Computational complexity theory">Computational complexity theory</a></li> <li><a href="/wiki/Diffie%E2%80%93Hellman_key_exchange" title="Diffie–Hellman key exchange">Diffie–Hellman key exchange</a></li> <li><a href="/wiki/Digital_Signature_Algorithm" title="Digital Signature Algorithm">Digital Signature Algorithm</a></li> <li><a href="/wiki/Elliptic-curve_cryptography" title="Elliptic-curve cryptography">Elliptic-curve cryptography</a></li> <li><a href="/wiki/Key_exchange" title="Key exchange">Key exchange</a></li> <li><a href="/wiki/Key_management" title="Key management">Key management</a></li> <li><a href="/wiki/Key_size" title="Key size">Key size</a></li> <li><a href="/wiki/Public-key_cryptography" title="Public-key cryptography">Public-key cryptography</a></li> <li><a href="/wiki/Rabin_cryptosystem" title="Rabin cryptosystem">Rabin cryptosystem</a></li> <li><a href="/wiki/Trapdoor_function" title="Trapdoor function">Trapdoor function</a></li></ul> <div class="mw-heading mw-heading2"><h2 id="Notes_2">Notes</h2>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=28" title="Edit section: Notes">edit</a>]</div> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1239543626"><div class="reflist reflist-lower-alpha"> <div class="mw-references-wrap"><ol class="references"> <li id="cite_note-22"><a href="#cite_ref-22">^</a> Namely, the values of m which are equal to −1, 0, or 1 modulo p while also equal to −1, 0, or 1 modulo q. There will be more values of m having c = m if p − 1 or q − 1 has other divisors in common with e − 1 besides 2 because this gives more values of m such that <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m^{e-1}{\bmod {p}}=1}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <msup> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>e</mi> <mo>−</mo> <mn>1</mn> </mrow> </msup> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mi>p</mi> </mrow> </mrow> <mo>=</mo> <mn>1</mn> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle m^{e-1}{\bmod {p}}=1}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/82dc6b4f57ca66c6d0b2ceade95727dedf4609d7" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:16.251ex; height:3.009ex;" alt="{\displaystyle m^{e-1}{\bmod {p}}=1}"> or <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m^{e-1}{\bmod {q}}=1}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <msup> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mi>e</mi> <mo>−</mo> <mn>1</mn> </mrow> </msup> <mrow class="MJX-TeXAtom-ORD"> <mo lspace="thickmathspace" rspace="thickmathspace">mod</mo> <mrow class="MJX-TeXAtom-ORD"> <mi>q</mi> </mrow> </mrow> <mo>=</mo> <mn>1</mn> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle m^{e-1}{\bmod {q}}=1}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/f92bac76b3755ce20b8469c200d05bbacb8f3a8d" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:16.151ex; height:3.009ex;" alt="{\displaystyle m^{e-1}{\bmod {q}}=1}"> respectively. </li> <li id="cite_note-23"><a href="#cite_ref-23">^</a> The parameters used here are artificially small, but one can also <a href="https://en.wikibooks.org/wiki/Cryptography/Generate_a_keypair_using_OpenSSL" class="extiw" title="b:Cryptography/Generate a keypair using OpenSSL">OpenSSL can also be used to generate and examine a real keypair</a>. </li> <li id="cite_note-33"><a href="#cite_ref-33">^</a> If <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m_{1}<m_{2}}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <msub> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mn>1</mn> </mrow> </msub> <mo><</mo> <msub> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mn>2</mn> </mrow> </msub> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle m_{1}<m_{2}}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/cd7232ffc9b33b8a6f8f0fc7e669ba2b6efbb331" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:9.288ex; height:2.176ex;" alt="{\displaystyle m_{1}<m_{2}}">, then some[<a href="/wiki/Wikipedia:Please_clarify" title="Wikipedia:Please clarify">clarification needed</a>] libraries compute h as <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle q_{\text{inv}}\left[\left(m_{1}+\left\lceil {\frac {q}{p}}\right\rceil p\right)-m_{2}\right]{\pmod {p}}}"> <semantics> <mrow class="MJX-TeXAtom-ORD"> <mstyle displaystyle="true" scriptlevel="0"> <msub> <mi>q</mi> <mrow class="MJX-TeXAtom-ORD"> <mtext>inv</mtext> </mrow> </msub> <mrow> <mo>[</mo> <mrow> <mrow> <mo>(</mo> <mrow> <msub> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mn>1</mn> </mrow> </msub> <mo>+</mo> <mrow> <mo>⌈</mo> <mrow class="MJX-TeXAtom-ORD"> <mfrac> <mi>q</mi> <mi>p</mi> </mfrac> </mrow> <mo>⌉</mo> </mrow> <mi>p</mi> </mrow> <mo>)</mo> </mrow> <mo>−</mo> <msub> <mi>m</mi> <mrow class="MJX-TeXAtom-ORD"> <mn>2</mn> </mrow> </msub> </mrow> <mo>]</mo> </mrow> <mrow class="MJX-TeXAtom-ORD"> <mspace width="1em" /> <mo stretchy="false">(</mo> <mi>mod</mi> <mspace width="0.333em" /> <mi>p</mi> <mo stretchy="false">)</mo> </mrow> </mstyle> </mrow> <annotation encoding="application/x-tex">{\displaystyle q_{\text{inv}}\left[\left(m_{1}+\left\lceil {\frac {q}{p}}\right\rceil p\right)-m_{2}\right]{\pmod {p}}}</annotation> </semantics> </math><img src="https://wikimedia.org/api/rest_v1/media/math/render/svg/558556a5788b5b96164298b93014f13beb27af12" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -2.505ex; width:39.155ex; height:6.176ex;" alt="{\displaystyle q_{\text{inv}}\left[\left(m_{1}+\left\lceil {\frac {q}{p}}\right\rceil p\right)-m_{2}\right]{\pmod {p}}}">. </li> </ol></div></div> <div class="mw-heading mw-heading2"><h2 id="References">References</h2>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=29" title="Edit section: References">edit</a>]</div> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1239543626"><div class="reflist reflist-columns references-column-width" style="column-width: 30em;"> <ol class="references"> <li id="cite_note-rsa-1">^ <a href="#cite_ref-rsa_1-0">a</a> <a href="#cite_ref-rsa_1-1">b</a> <a href="#cite_ref-rsa_1-2">c</a> <a href="#cite_ref-rsa_1-3">d</a> <a href="#cite_ref-rsa_1-4">e</a> <a href="#cite_ref-rsa_1-5">f</a> <a href="#cite_ref-rsa_1-6">g</a> <style data-mw-deduplicate="TemplateStyles:r1238218222">.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("//upload.wikimedia.org/wikipedia/commons/6/65/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("//upload.wikimedia.org/wikipedia/commons/d/d6/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("//upload.wikimedia.org/wikipedia/commons/a/aa/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("//upload.wikimedia.org/wikipedia/commons/4/4c/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}</style><cite id="CITEREFRivestShamirAdleman1978" class="citation journal cs1">Rivest, R.; Shamir, A.; Adleman, L. (February 1978). <a rel="nofollow" class="external text" href="https://web.archive.org/web/20230127011251/http://people.csail.mit.edu/rivest/Rsapaper.pdf">"A Method for Obtaining Digital Signatures and Public-Key Cryptosystems"</a> (PDF). <a href="/wiki/Communications_of_the_ACM" title="Communications of the ACM">Communications of the ACM</a>. 21 (2): 120–126. <a href="/wiki/CiteSeerX_(identifier)" class="mw-redirect" title="CiteSeerX (identifier)">CiteSeerX</a> <a rel="nofollow" class="external text" href="https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.607.2677">10.1.1.607.2677</a>. <a href="/wiki/Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F359340.359342">10.1145/359340.359342</a>. <a href="/wiki/S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:2873616">2873616</a>. Archived from <a rel="nofollow" class="external text" href="http://people.csail.mit.edu/rivest/Rsapaper.pdf">the original</a> (PDF) on 2023-01-27.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.jtitle=Communications+of+the+ACM&rft.atitle=A+Method+for+Obtaining+Digital+Signatures+and+Public-Key+Cryptosystems&rft.volume=21&rft.issue=2&rft.pages=120-126&rft.date=1978-02&rft_id=https%3A%2F%2Fciteseerx.ist.psu.edu%2Fviewdoc%2Fsummary%3Fdoi%3D10.1.1.607.2677%23id-name%3DCiteSeerX&rft_id=https%3A%2F%2Fapi.semanticscholar.org%2FCorpusID%3A2873616%23id-name%3DS2CID&rft_id=info%3Adoi%2F10.1145%2F359340.359342&rft.aulast=Rivest&rft.aufirst=R.&rft.au=Shamir%2C+A.&rft.au=Adleman%2C+L.&rft_id=http%3A%2F%2Fpeople.csail.mit.edu%2Frivest%2FRsapaper.pdf&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-2"><a href="#cite_ref-2">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFSmart2008" class="citation web cs1">Smart, Nigel (February 19, 2008). <a rel="nofollow" class="external text" href="http://www.bristol.ac.uk/graduation/honorary-degrees/hondeg08/cocks.html">"Dr Clifford Cocks CB"</a>. <a href="/wiki/Bristol_University" class="mw-redirect" title="Bristol University">Bristol University</a>. Retrieved August 14, 2011.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=Dr+Clifford+Cocks+CB&rft.pub=Bristol+University&rft.date=2008-02-19&rft.aulast=Smart&rft.aufirst=Nigel&rft_id=http%3A%2F%2Fwww.bristol.ac.uk%2Fgraduation%2Fhonorary-degrees%2Fhondeg08%2Fcocks.html&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-3"><a href="#cite_ref-3">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFCastelvecchi2020" class="citation journal cs1">Castelvecchi, Davide (2020-10-30). <a rel="nofollow" class="external text" href="https://www.nature.com/articles/d41586-020-03068-9">"Quantum-computing pioneer warns of complacency over Internet security"</a>. Nature. 587 (7833): 189. <a href="/wiki/Bibcode_(identifier)" class="mw-redirect" title="Bibcode (identifier)">Bibcode</a>:<a rel="nofollow" class="external text" href="https://ui.adsabs.harvard.edu/abs/2020Natur.587..189C">2020Natur.587..189C</a>. <a href="/wiki/Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1038%2Fd41586-020-03068-9">10.1038/d41586-020-03068-9</a>. <a href="/wiki/PMID_(identifier)" class="mw-redirect" title="PMID (identifier)">PMID</a> <a rel="nofollow" class="external text" href="https://pubmed.ncbi.nlm.nih.gov/33139910">33139910</a>. <a href="/wiki/S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:226243008">226243008</a>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.jtitle=Nature&rft.atitle=Quantum-computing+pioneer+warns+of+complacency+over+Internet+security&rft.volume=587&rft.issue=7833&rft.pages=189&rft.date=2020-10-30&rft_id=info%3Adoi%2F10.1038%2Fd41586-020-03068-9&rft_id=https%3A%2F%2Fapi.semanticscholar.org%2FCorpusID%3A226243008%23id-name%3DS2CID&rft_id=info%3Apmid%2F33139910&rft_id=info%3Abibcode%2F2020Natur.587..189C&rft.aulast=Castelvecchi&rft.aufirst=Davide&rft_id=https%3A%2F%2Fwww.nature.com%2Farticles%2Fd41586-020-03068-9&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> 2020 interview of <a href="/wiki/Peter_Shor" title="Peter Shor">Peter Shor</a>. </li> <li id="cite_note-4"><a href="#cite_ref-4">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFDiffieHellman1976" class="citation journal cs1">Diffie, W.; Hellman, M. E. (November 1976). "New directions in cryptography". IEEE Transactions on Information Theory. 22 (6): 644–654. <a href="/wiki/CiteSeerX_(identifier)" class="mw-redirect" title="CiteSeerX (identifier)">CiteSeerX</a> <a rel="nofollow" class="external text" href="https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.37.9720">10.1.1.37.9720</a>. <a href="/wiki/Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1109%2FTIT.1976.1055638">10.1109/TIT.1976.1055638</a>. <a href="/wiki/ISSN_(identifier)" class="mw-redirect" title="ISSN (identifier)">ISSN</a> <a rel="nofollow" class="external text" href="https://search.worldcat.org/issn/0018-9448">0018-9448</a>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.jtitle=IEEE+Transactions+on+Information+Theory&rft.atitle=New+directions+in+cryptography&rft.volume=22&rft.issue=6&rft.pages=644-654&rft.date=1976-11&rft_id=https%3A%2F%2Fciteseerx.ist.psu.edu%2Fviewdoc%2Fsummary%3Fdoi%3D10.1.1.37.9720%23id-name%3DCiteSeerX&rft.issn=0018-9448&rft_id=info%3Adoi%2F10.1109%2FTIT.1976.1055638&rft.aulast=Diffie&rft.aufirst=W.&rft.au=Hellman%2C+M.+E.&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-5"><a href="#cite_ref-5">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFRivest" class="citation web cs1">Rivest, Ronald. <a rel="nofollow" class="external text" href="https://people.csail.mit.edu/rivest/pubs/ARS03.rivest-slides.pdf">"The Early Days of RSA – History and Lessons"</a> (PDF).</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=The+Early+Days+of+RSA+%E2%80%93+History+and+Lessons&rft.aulast=Rivest&rft.aufirst=Ronald&rft_id=https%3A%2F%2Fpeople.csail.mit.edu%2Frivest%2Fpubs%2FARS03.rivest-slides.pdf&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-6"><a href="#cite_ref-6">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFCalderbank2007" class="citation web cs1">Calderbank, Michael (2007-08-20). <a rel="nofollow" class="external text" href="http://www.math.uchicago.edu/~may/VIGRE/VIGRE2007/REUPapers/FINALAPP/Calderbank.pdf">"The RSA Cryptosystem: History, Algorithm, Primes"</a> (PDF).</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=The+RSA+Cryptosystem%3A+History%2C+Algorithm%2C+Primes&rft.date=2007-08-20&rft.aulast=Calderbank&rft.aufirst=Michael&rft_id=http%3A%2F%2Fwww.math.uchicago.edu%2F~may%2FVIGRE%2FVIGRE2007%2FREUPapers%2FFINALAPP%2FCalderbank.pdf&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-SIAM-7">^ <a href="#cite_ref-SIAM_7-0">a</a> <a href="#cite_ref-SIAM_7-1">b</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFRobinson2003" class="citation journal cs1">Robinson, Sara (June 2003). <a rel="nofollow" class="external text" href="http://www.msri.org/people/members/sara/articles/rsa.pdf">"Still Guarding Secrets after Years of Attacks, RSA Earns Accolades for its Founders"</a> (PDF). SIAM News. 36 (5).</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.jtitle=SIAM+News&rft.atitle=Still+Guarding+Secrets+after+Years+of+Attacks%2C+RSA+Earns+Accolades+for+its+Founders&rft.volume=36&rft.issue=5&rft.date=2003-06&rft.aulast=Robinson&rft.aufirst=Sara&rft_id=http%3A%2F%2Fwww.msri.org%2Fpeople%2Fmembers%2Fsara%2Farticles%2Frsa.pdf&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-8"><a href="#cite_ref-8">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFCocks1973" class="citation web cs1"><a href="/wiki/Clifford_Cocks" title="Clifford Cocks">Cocks, C. C.</a> (20 November 1973). <a rel="nofollow" class="external text" href="https://web.archive.org/web/20180928121748/https://www.gchq.gov.uk/sites/default/files/document_files/Cliff%20Cocks%20paper%2019731120.pdf">"A Note on Non-Secret Encryption"</a> (PDF). www.gchq.gov.uk. Archived from <a rel="nofollow" class="external text" href="https://www.gchq.gov.uk/sites/default/files/document_files/Cliff%20Cocks%20paper%2019731120.pdf">the original</a> (PDF) on 28 September 2018. Retrieved 2017-05-30.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=www.gchq.gov.uk&rft.atitle=A+Note+on+Non-Secret+Encryption&rft.date=1973-11-20&rft.aulast=Cocks&rft.aufirst=C.+C.&rft_id=https%3A%2F%2Fwww.gchq.gov.uk%2Fsites%2Fdefault%2Ffiles%2Fdocument_files%2FCliff%2520Cocks%2520paper%252019731120.pdf&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-9"><a href="#cite_ref-9">^</a> Jim Sauerberg. <a rel="nofollow" class="external text" href="https://ww2.amstat.org/mam/06/Sauerberg_PKC-essay.html">"From Private to Public Key Ciphers in Three Easy Steps"</a>. </li> <li id="cite_note-10"><a href="#cite_ref-10">^</a> Margaret Cozzens and Steven J. Miller. <a rel="nofollow" class="external text" href="https://books.google.com/books?id=GbKyAAAAQBAJ">"The Mathematics of Encryption: An Elementary Introduction"</a>. p. 180. </li> <li id="cite_note-11"><a href="#cite_ref-11">^</a> Alasdair McAndrew. <a rel="nofollow" class="external text" href="https://books.google.com/books?id=9lTRBQAAQBAJ">"Introduction to Cryptography with Open-Source Software"</a>. p. 12. </li> <li id="cite_note-12"><a href="#cite_ref-12">^</a> Surender R. Chiluka. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20220319203917/https://www.cs.uri.edu/cryptography/publickeykidkrypto.htm">"Public key Cryptography"</a>. </li> <li id="cite_note-13"><a href="#cite_ref-13">^</a> Neal Koblitz. <a rel="nofollow" class="external text" href="https://sites.math.washington.edu/~koblitz/crlogia.html">"Cryptography As a Teaching Tool"</a>. Cryptologia, Vol. 21, No. 4 (1997). </li> <li id="cite_note-14"><a href="#cite_ref-14">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://web.archive.org/web/20070621021111/http://www.rsa.com/press_release.aspx?id=261">"RSA Security Releases RSA Encryption Algorithm into Public Domain"</a>. Archived from <a rel="nofollow" class="external text" href="http://www.rsa.com/press_release.aspx?id=261">the original</a> on June 21, 2007. Retrieved 2010-03-03.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=RSA+Security+Releases+RSA+Encryption+Algorithm+into+Public+Domain&rft_id=http%3A%2F%2Fwww.rsa.com%2Fpress_release.aspx%3Fid%3D261&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-Boneh99-15">^ <a href="#cite_ref-Boneh99_15-0">a</a> <a href="#cite_ref-Boneh99_15-1">b</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFBoneh1999" class="citation journal cs1">Boneh, Dan (1999). <a rel="nofollow" class="external text" href="http://crypto.stanford.edu/~dabo/abstracts/RSAattack-survey.html">"Twenty Years of attacks on the RSA Cryptosystem"</a>. <a href="/wiki/Notices_of_the_American_Mathematical_Society" title="Notices of the American Mathematical Society">Notices of the American Mathematical Society</a>. 46 (2): 203–213.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.jtitle=Notices+of+the+American+Mathematical+Society&rft.atitle=Twenty+Years+of+attacks+on+the+RSA+Cryptosystem&rft.volume=46&rft.issue=2&rft.pages=203-213&rft.date=1999&rft.aulast=Boneh&rft.aufirst=Dan&rft_id=http%3A%2F%2Fcrypto.stanford.edu%2F~dabo%2Fabstracts%2FRSAattack-survey.html&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-16"><a href="#cite_ref-16">^</a> Applied Cryptography, John Wiley & Sons, New York, 1996. <a href="/wiki/Bruce_Schneier" title="Bruce Schneier">Bruce Schneier</a>, p. 467. </li> <li id="cite_note-17"><a href="#cite_ref-17">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFMcKeePinch1998" class="citation web cs1">McKee, James; Pinch, Richard (1998). <a rel="nofollow" class="external text" href="https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=64294c404088b69a519614510b8d12b4809a6b10">"Further Attacks on Server-Aided RSA Cryptosystems"</a>. <a href="/wiki/CiteSeerX_(identifier)" class="mw-redirect" title="CiteSeerX (identifier)">CiteSeerX</a> <a rel="nofollow" class="external text" href="https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.33.1333">10.1.1.33.1333</a>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=Further+Attacks+on+Server-Aided+RSA+Cryptosystems&rft.date=1998&rft_id=https%3A%2F%2Fciteseerx.ist.psu.edu%2Fviewdoc%2Fsummary%3Fdoi%3D10.1.1.33.1333%23id-name%3DCiteSeerX&rft.aulast=McKee&rft.aufirst=James&rft.au=Pinch%2C+Richard&rft_id=https%3A%2F%2Fciteseerx.ist.psu.edu%2Fdocument%3Frepid%3Drep1%26type%3Dpdf%26doi%3D64294c404088b69a519614510b8d12b4809a6b10&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-18"><a href="#cite_ref-18">^</a> A Course in Number Theory and Cryptography, Graduate Texts in Math. No. 114, Springer-Verlag, New York, 1987. <a href="/wiki/Neal_Koblitz" title="Neal Koblitz">Neal Koblitz</a>, Second edition, 1994. p. 94. </li> <li id="cite_note-19"><a href="#cite_ref-19">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFDukhovni2015" class="citation mailinglist cs1">Dukhovni, Viktor (July 31, 2015). <a rel="nofollow" class="external text" href="https://mta.openssl.org/pipermail/openssl-dev/2015-July/002266.html">"common factors in (p − 1) and (q − 1)"</a>. openssl-dev (Mailing list).</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=common+factors+in+%28p+%E2%88%92+1%29+and+%28q+%E2%88%92+1%29&rft.date=2015-07-31&rft.aulast=Dukhovni&rft.aufirst=Viktor&rft_id=https%3A%2F%2Fmta.openssl.org%2Fpipermail%2Fopenssl-dev%2F2015-July%2F002266.html&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-20"><a href="#cite_ref-20">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFDukhovni2015" class="citation mailinglist cs1">Dukhovni, Viktor (August 1, 2015). <a rel="nofollow" class="external text" href="https://mta.openssl.org/pipermail/openssl-dev/2015-August/002277.html">"common factors in (p − 1) and (q − 1)"</a>. openssl-dev (Mailing list).</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=common+factors+in+%28p+%E2%88%92+1%29+and+%28q+%E2%88%92+1%29&rft.date=2015-08-01&rft.aulast=Dukhovni&rft.aufirst=Viktor&rft_id=https%3A%2F%2Fmta.openssl.org%2Fpipermail%2Fopenssl-dev%2F2015-August%2F002277.html&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-21"><a href="#cite_ref-21">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFJohnsonKaliski2003" class="citation cs1">Johnson, J.; Kaliski, B. (February 2003). <a rel="nofollow" class="external text" href="https://datatracker.ietf.org/doc/html/rfc3447">Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1</a>. Network Working Group. <a href="/wiki/Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.17487%2FRFC3447">10.17487/RFC3447</a>. <a href="/wiki/Request_for_Comments" title="Request for Comments">RFC</a> <a rel="nofollow" class="external text" href="https://datatracker.ietf.org/doc/html/rfc3447">3447</a>. Retrieved 9 March 2016.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=book&rft.btitle=Public-Key+Cryptography+Standards+%28PKCS%29+%231%3A+RSA+Cryptography+Specifications+Version+2.1&rft.pub=Network+Working+Group&rft.date=2003-02&rft_id=info%3Adoi%2F10.17487%2FRFC3447&rft.aulast=Johnson&rft.aufirst=J.&rft.au=Kaliski%2C+B.&rft_id=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Frfc3447&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-27"><a href="#cite_ref-27">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFHåstad1986" class="citation book cs1">Håstad, Johan (1986). "On using RSA with Low Exponent in a Public Key Network". Advances in Cryptology – CRYPTO '85 Proceedings. Lecture Notes in Computer Science. Vol. 218. pp. 403–408. <a href="/wiki/Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1007%2F3-540-39799-X_29">10.1007/3-540-39799-X_29</a>. <a href="/wiki/ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <a href="/wiki/Special:BookSources/978-3-540-16463-0" title="Special:BookSources/978-3-540-16463-0"><bdi>978-3-540-16463-0</bdi></a>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=bookitem&rft.atitle=On+using+RSA+with+Low+Exponent+in+a+Public+Key+Network&rft.btitle=Advances+in+Cryptology+%E2%80%93+CRYPTO+%2785+Proceedings&rft.series=Lecture+Notes+in+Computer+Science&rft.pages=403-408&rft.date=1986&rft_id=info%3Adoi%2F10.1007%2F3-540-39799-X_29&rft.isbn=978-3-540-16463-0&rft.aulast=H%C3%A5stad&rft.aufirst=Johan&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-28"><a href="#cite_ref-28">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFCoppersmith1997" class="citation journal cs1">Coppersmith, Don (1997). <a rel="nofollow" class="external text" href="https://www.di.ens.fr/~fouque/ens-rennes/coppersmith.pdf">"Small Solutions to Polynomial Equations, and Low Exponent RSA Vulnerabilities"</a> (PDF). <a href="/wiki/Journal_of_Cryptology" title="Journal of Cryptology">Journal of Cryptology</a>. 10 (4): 233–260. <a href="/wiki/CiteSeerX_(identifier)" class="mw-redirect" title="CiteSeerX (identifier)">CiteSeerX</a> <a rel="nofollow" class="external text" href="https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.298.4806">10.1.1.298.4806</a>. <a href="/wiki/Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1007%2Fs001459900030">10.1007/s001459900030</a>. <a href="/wiki/S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:15726802">15726802</a>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.jtitle=Journal+of+Cryptology&rft.atitle=Small+Solutions+to+Polynomial+Equations%2C+and+Low+Exponent+RSA+Vulnerabilities&rft.volume=10&rft.issue=4&rft.pages=233-260&rft.date=1997&rft_id=https%3A%2F%2Fciteseerx.ist.psu.edu%2Fviewdoc%2Fsummary%3Fdoi%3D10.1.1.298.4806%23id-name%3DCiteSeerX&rft_id=https%3A%2F%2Fapi.semanticscholar.org%2FCorpusID%3A15726802%23id-name%3DS2CID&rft_id=info%3Adoi%2F10.1007%2Fs001459900030&rft.aulast=Coppersmith&rft.aufirst=Don&rft_id=https%3A%2F%2Fwww.di.ens.fr%2F~fouque%2Fens-rennes%2Fcoppersmith.pdf&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-29"><a href="#cite_ref-29">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFGoldwasserMicali1982" class="citation book cs1"><a href="/wiki/Shafi_Goldwasser" title="Shafi Goldwasser">Goldwasser, Shafi</a>; <a href="/wiki/Silvio_Micali" title="Silvio Micali">Micali, Silvio</a> (1982-05-05). <a rel="nofollow" class="external text" href="https://doi.org/10.1145/800070.802212">"Probabilistic encryption & how to play mental poker keeping secret all partial information"</a>. Proceedings of the fourteenth annual ACM symposium on Theory of computing - STOC '82. New York, NY, USA: Association for Computing Machinery. pp. 365–377. <a href="/wiki/Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F800070.802212">10.1145/800070.802212</a>. <a href="/wiki/ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <a href="/wiki/Special:BookSources/978-0-89791-070-5" title="Special:BookSources/978-0-89791-070-5"><bdi>978-0-89791-070-5</bdi></a>. <a href="/wiki/S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:10316867">10316867</a>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=bookitem&rft.atitle=Probabilistic+encryption+%26+how+to+play+mental+poker+keeping+secret+all+partial+information&rft.btitle=Proceedings+of+the+fourteenth+annual+ACM+symposium+on+Theory+of+computing+-+STOC+%2782&rft.place=New+York%2C+NY%2C+USA&rft.pages=365-377&rft.pub=Association+for+Computing+Machinery&rft.date=1982-05-05&rft_id=https%3A%2F%2Fapi.semanticscholar.org%2FCorpusID%3A10316867%23id-name%3DS2CID&rft_id=info%3Adoi%2F10.1145%2F800070.802212&rft.isbn=978-0-89791-070-5&rft.aulast=Goldwasser&rft.aufirst=Shafi&rft.au=Micali%2C+Silvio&rft_id=https%3A%2F%2Fdoi.org%2F10.1145%2F800070.802212&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-30"><a href="#cite_ref-30">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFCoronJoyeNaccachePaillier2000" class="citation book cs1">Coron, Jean-Sébastien; Joye, Marc; Naccache, David; Paillier, Pascal (2000). "New Attacks on PKCS#1 v1.5 Encryption". In Preneel, Bart (ed.). Advances in Cryptology — EUROCRYPT 2000. Lecture Notes in Computer Science. Vol. 1807. Berlin, Heidelberg: Springer. pp. 369–381. <a href="/wiki/Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1007%2F3-540-45539-6_25">10.1007/3-540-45539-6_25</a>. <a href="/wiki/ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <a href="/wiki/Special:BookSources/978-3-540-45539-4" title="Special:BookSources/978-3-540-45539-4"><bdi>978-3-540-45539-4</bdi></a>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=bookitem&rft.atitle=New+Attacks+on+PKCS%231+v1.5+Encryption&rft.btitle=Advances+in+Cryptology+%E2%80%94+EUROCRYPT+2000&rft.place=Berlin%2C+Heidelberg&rft.series=Lecture+Notes+in+Computer+Science&rft.pages=369-381&rft.pub=Springer&rft.date=2000&rft_id=info%3Adoi%2F10.1007%2F3-540-45539-6_25&rft.isbn=978-3-540-45539-4&rft.aulast=Coron&rft.aufirst=Jean-S%C3%A9bastien&rft.au=Joye%2C+Marc&rft.au=Naccache%2C+David&rft.au=Paillier%2C+Pascal&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-31"><a href="#cite_ref-31">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.di-mgt.com.au/rsa_alg.html#weaknesses">"RSA Algorithm"</a>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=RSA+Algorithm&rft_id=https%3A%2F%2Fwww.di-mgt.com.au%2Frsa_alg.html%23weaknesses&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-32"><a href="#cite_ref-32">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://github.com/openssl/openssl/blob/422a13fb5cd668cdc4c1eebce8accb4d25c3d8eb/crypto/bn/bn_s390x.c#L70">"OpenSSL bn_s390x.c"</a>. Github. Retrieved 2 August 2024.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=Github&rft.atitle=OpenSSL+bn_s390x.c&rft_id=https%3A%2F%2Fgithub.com%2Fopenssl%2Fopenssl%2Fblob%2F422a13fb5cd668cdc4c1eebce8accb4d25c3d8eb%2Fcrypto%2Fbn%2Fbn_s390x.c%23L70&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-34"><a href="#cite_ref-34">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFMachie2013" class="citation book cs1">Machie, Edmond K. (29 March 2013). <a rel="nofollow" class="external text" href="https://books.google.com/books?id=AK5MySZbbuMC&pg=PA167">Network security traceback attack and react in the United States Department of Defense network</a>. Trafford. p. 167. <a href="/wiki/ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <a href="/wiki/Special:BookSources/978-1466985742" title="Special:BookSources/978-1466985742"><bdi>978-1466985742</bdi></a>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=book&rft.btitle=Network+security+traceback+attack+and+react+in+the+United+States+Department+of+Defense+network&rft.pages=167&rft.pub=Trafford&rft.date=2013-03-29&rft.isbn=978-1466985742&rft.aulast=Machie&rft.aufirst=Edmond+K.&rft_id=https%3A%2F%2Fbooks.google.com%2Fbooks%3Fid%3DAK5MySZbbuMC%26pg%3DPA167&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-35"><a href="#cite_ref-35">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFLenstra2000" class="citation web cs1">Lenstra, Arjen; et al. (Group) (2000). <a rel="nofollow" class="external text" href="https://www.iacr.org/archive/eurocrypt2000/1807/18070001-new.pdf">"Factorization of a 512-bit RSA Modulus"</a> (PDF). Eurocrypt.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=Factorization+of+a+512-bit+RSA+Modulus&rft.pub=Eurocrypt&rft.date=2000&rft.aulast=Lenstra&rft.aufirst=Arjen&rft_id=https%3A%2F%2Fwww.iacr.org%2Farchive%2Feurocrypt2000%2F1807%2F18070001-new.pdf&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-36"><a href="#cite_ref-36">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFMiller1975" class="citation conference cs1">Miller, Gary L. (1975). <a rel="nofollow" class="external text" href="https://www.cs.cmu.edu/~glmiller/Publications/Papers/Mi75.pdf">"Riemann's Hypothesis and Tests for Primality"</a> (PDF). Proceedings of Seventh Annual ACM Symposium on Theory of Computing. pp. 234–239.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=conference&rft.atitle=Riemann%27s+Hypothesis+and+Tests+for+Primality&rft.btitle=Proceedings+of+Seventh+Annual+ACM+Symposium+on+Theory+of+Computing&rft.pages=234-239&rft.date=1975&rft.aulast=Miller&rft.aufirst=Gary+L.&rft_id=https%3A%2F%2Fwww.cs.cmu.edu%2F~glmiller%2FPublications%2FPapers%2FMi75.pdf&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-37"><a href="#cite_ref-37">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFZimmermann2020" class="citation web cs1">Zimmermann, Paul (2020-02-28). <a rel="nofollow" class="external text" href="https://web.archive.org/web/20200228234716/https://lists.gforge.inria.fr/pipermail/cado-nfs-discuss/2020-February/001166.html">"Factorization of RSA-250"</a>. Cado-nfs-discuss. Archived from <a rel="nofollow" class="external text" href="https://lists.gforge.inria.fr/pipermail/cado-nfs-discuss/2020-February/001166.html">the original</a> on 2020-02-28. Retrieved 2020-07-12.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=Factorization+of+RSA-250&rft.pub=Cado-nfs-discuss&rft.date=2020-02-28&rft.aulast=Zimmermann&rft.aufirst=Paul&rft_id=https%3A%2F%2Flists.gforge.inria.fr%2Fpipermail%2Fcado-nfs-discuss%2F2020-February%2F001166.html&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-twirl-38">^ <a href="#cite_ref-twirl_38-0">a</a> <a href="#cite_ref-twirl_38-1">b</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFKaliski2003" class="citation web cs1">Kaliski, Burt (2003-05-06). <a rel="nofollow" class="external text" href="https://web.archive.org/web/20170417095741/https://www.emc.com/emc-plus/rsa-labs/historical/twirl-and-rsa-key-size.htm">"TWIRL and RSA Key Size"</a>. <a href="/wiki/RSA_Security" title="RSA Security">RSA Laboratories</a>. Archived from <a rel="nofollow" class="external text" href="http://emc.com/emc-plus/rsa-labs/historical/twirl-and-rsa-key-size.htm">the original</a> on 2017-04-17. Retrieved 2017-11-24.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=TWIRL+and+RSA+Key+Size&rft.pub=RSA+Laboratories&rft.date=2003-05-06&rft.aulast=Kaliski&rft.aufirst=Burt&rft_id=http%3A%2F%2Femc.com%2Femc-plus%2Frsa-labs%2Fhistorical%2Ftwirl-and-rsa-key-size.htm&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-keymanagement-39"><a href="#cite_ref-keymanagement_39-0">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFBarkerDang2015" class="citation web cs1">Barker, Elaine; Dang, Quynh (2015-01-22). <a rel="nofollow" class="external text" href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf">"NIST Special Publication 800-57 Part 3 Revision 1: Recommendation for Key Management: Application-Specific Key Management Guidance"</a> (PDF). <a href="/wiki/National_Institute_of_Standards_and_Technology" title="National Institute of Standards and Technology">National Institute of Standards and Technology</a>. p. 12. <a href="/wiki/Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.6028%2FNIST.SP.800-57pt3r1">10.6028/NIST.SP.800-57pt3r1</a>. Retrieved 2017-11-24.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=NIST+Special+Publication+800-57+Part+3+Revision+1%3A+Recommendation+for+Key+Management%3A+Application-Specific+Key+Management+Guidance&rft.pages=12&rft.pub=National+Institute+of+Standards+and+Technology&rft.date=2015-01-22&rft_id=info%3Adoi%2F10.6028%2FNIST.SP.800-57pt3r1&rft.aulast=Barker&rft.aufirst=Elaine&rft.au=Dang%2C+Quynh&rft_id=http%3A%2F%2Fnvlpubs.nist.gov%2Fnistpubs%2FSpecialPublications%2FNIST.SP.800-57Pt3r1.pdf&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-40"><a href="#cite_ref-40">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFSandee2011" class="citation web cs1">Sandee, Michael (November 21, 2011). <a rel="nofollow" class="external text" href="https://blog.fox-it.com/2011/11/21/rsa-512-certificates-abused-in-the-wild/">"RSA-512 certificates abused in-the-wild"</a>. Fox-IT International blog.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=Fox-IT+International+blog&rft.atitle=RSA-512+certificates+abused+in-the-wild&rft.date=2011-11-21&rft.aulast=Sandee&rft.aufirst=Michael&rft_id=https%3A%2F%2Fblog.fox-it.com%2F2011%2F11%2F21%2Frsa-512-certificates-abused-in-the-wild%2F&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-wiener-41"><a href="#cite_ref-wiener_41-0">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFWiener1990" class="citation journal cs1">Wiener, Michael J. (May 1990). <a rel="nofollow" class="external text" href="http://www.cits.rub.de/imperia/md/content/may/krypto2ss08/shortsecretexponents.pdf">"Cryptanalysis of short RSA secret exponents"</a> (PDF). IEEE Transactions on Information Theory. 36 (3): 553–558. <a href="/wiki/Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1109%2F18.54902">10.1109/18.54902</a>. <a href="/wiki/S2CID_(identifier)" class="mw-redirect" title="S2CID (identifier)">S2CID</a> <a rel="nofollow" class="external text" href="https://api.semanticscholar.org/CorpusID:7120331">7120331</a>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.jtitle=IEEE+Transactions+on+Information+Theory&rft.atitle=Cryptanalysis+of+short+RSA+secret+exponents&rft.volume=36&rft.issue=3&rft.pages=553-558&rft.date=1990-05&rft_id=info%3Adoi%2F10.1109%2F18.54902&rft_id=https%3A%2F%2Fapi.semanticscholar.org%2FCorpusID%3A7120331%23id-name%3DS2CID&rft.aulast=Wiener&rft.aufirst=Michael+J.&rft_id=http%3A%2F%2Fwww.cits.rub.de%2Fimperia%2Fmd%2Fcontent%2Fmay%2Fkrypto2ss08%2Fshortsecretexponents.pdf&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-nemecsys-42"><a href="#cite_ref-nemecsys_42-0">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFNemecSysSvendaKlinec2017" class="citation conference cs1">Nemec, Matus; Sys, Marek; Svenda, Petr; Klinec, Dusan; Matyas, Vashek (November 2017). <a rel="nofollow" class="external text" href="https://crocs.fi.muni.cz/_media/public/papers/nemec_roca_ccs17_preprint.pdf">"The Return of Coppersmith's Attack: Practical Factorization of Widely Used RSA Moduli"</a> (PDF). Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. CCS '17. <a href="/wiki/Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F3133956.3133969">10.1145/3133956.3133969</a>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=conference&rft.atitle=The+Return+of+Coppersmith%27s+Attack%3A+Practical+Factorization+of+Widely+Used+RSA+Moduli&rft.btitle=Proceedings+of+the+2017+ACM+SIGSAC+Conference+on+Computer+and+Communications+Security&rft.series=CCS+%2717&rft.date=2017-11&rft_id=info%3Adoi%2F10.1145%2F3133956.3133969&rft.aulast=Nemec&rft.aufirst=Matus&rft.au=Sys%2C+Marek&rft.au=Svenda%2C+Petr&rft.au=Klinec%2C+Dusan&rft.au=Matyas%2C+Vashek&rft_id=https%3A%2F%2Fcrocs.fi.muni.cz%2F_media%2Fpublic%2Fpapers%2Fnemec_roca_ccs17_preprint.pdf&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-43"><a href="#cite_ref-43">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFMarkoff2012" class="citation web cs1">Markoff, John (February 14, 2012). <a rel="nofollow" class="external text" href="https://www.nytimes.com/2012/02/15/technology/researchers-find-flaw-in-an-online-encryption-method.html">"Flaw Found in an Online Encryption Method"</a>. <a href="/wiki/The_New_York_Times" title="The New York Times">The New York Times</a>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=The+New+York+Times&rft.atitle=Flaw+Found+in+an+Online+Encryption+Method&rft.date=2012-02-14&rft.aulast=Markoff&rft.aufirst=John&rft_id=https%3A%2F%2Fwww.nytimes.com%2F2012%2F02%2F15%2Ftechnology%2Fresearchers-find-flaw-in-an-online-encryption-method.html&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-44"><a href="#cite_ref-44">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFLenstraHughesAugierBos2012" class="citation web cs1">Lenstra, Arjen K.; Hughes, James P.; Augier, Maxime; Bos, Joppe W.; Kleinjung, Thorsten; Wachter, Christophe (2012). <a rel="nofollow" class="external text" href="http://eprint.iacr.org/2012/064.pdf">"Ron was wrong, Whit is right"</a> (PDF).</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=Ron+was+wrong%2C+Whit+is+right&rft.date=2012&rft.aulast=Lenstra&rft.aufirst=Arjen+K.&rft.au=Hughes%2C+James+P.&rft.au=Augier%2C+Maxime&rft.au=Bos%2C+Joppe+W.&rft.au=Kleinjung%2C+Thorsten&rft.au=Wachter%2C+Christophe&rft_id=http%3A%2F%2Feprint.iacr.org%2F2012%2F064.pdf&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-45"><a href="#cite_ref-45">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFHeninger2012" class="citation web cs1">Heninger, Nadia (February 15, 2012). <a rel="nofollow" class="external text" href="https://freedom-to-tinker.com/blog/nadiah/new-research-theres-no-need-panic-over-factorable-keys-just-mind-your-ps-and-qs">"New research: There's no need to panic over factorable keys–just mind your Ps and Qs"</a>. Freedom to Tinker.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=Freedom+to+Tinker&rft.atitle=New+research%3A+There%27s+no+need+to+panic+over+factorable+keys%E2%80%93just+mind+your+Ps+and+Qs&rft.date=2012-02-15&rft.aulast=Heninger&rft.aufirst=Nadia&rft_id=https%3A%2F%2Ffreedom-to-tinker.com%2Fblog%2Fnadiah%2Fnew-research-theres-no-need-panic-over-factorable-keys-just-mind-your-ps-and-qs&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-Boneh03-46"><a href="#cite_ref-Boneh03_46-0">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFBrumleyBoneh2003" class="citation conference cs1">Brumley, David; Boneh, Dan (2003). <a rel="nofollow" class="external text" href="http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf">"Remote timing attacks are practical"</a> (PDF). Proceedings of the 12th Conference on USENIX Security Symposium. SSYM'03.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=conference&rft.atitle=Remote+timing+attacks+are+practical&rft.btitle=Proceedings+of+the+12th+Conference+on+USENIX+Security+Symposium&rft.series=SSYM%2703&rft.date=2003&rft.aulast=Brumley&rft.aufirst=David&rft.au=Boneh%2C+Dan&rft_id=http%3A%2F%2Fcrypto.stanford.edu%2F~dabo%2Fpapers%2Fssl-timing.pdf&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-47"><a href="#cite_ref-47">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.darkreading.com/attacks-breaches/-berserk-bug-uncovered-in-mozilla-nss-crypto-library-impacts-firefox-chrome">"'BERserk' Bug Uncovered In Mozilla NSS Crypto Library Impacts Firefox, Chrome"</a>. 25 September 2014. Retrieved 4 January 2022.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=%27BERserk%27+Bug+Uncovered+In+Mozilla+NSS+Crypto+Library+Impacts+Firefox%2C+Chrome&rft.date=2014-09-25&rft_id=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2F-berserk-bug-uncovered-in-mozilla-nss-crypto-library-impacts-firefox-chrome&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-48"><a href="#cite_ref-48">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.mozilla.org/en-US/security/advisories/mfsa2014-73/">"RSA Signature Forgery in NSS"</a>. Mozilla.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=unknown&rft.jtitle=Mozilla&rft.atitle=RSA+Signature+Forgery+in+NSS&rft_id=https%3A%2F%2Fwww.mozilla.org%2Fen-US%2Fsecurity%2Fadvisories%2Fmfsa2014-73%2F&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-49"><a href="#cite_ref-49">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFAcıiçmezKoçSeifert2007" class="citation conference cs1">Acıiçmez, Onur; Koç, Çetin Kaya; Seifert, Jean-Pierre (2007). "On the power of simple branch prediction analysis". Proceedings of the 2nd ACM Symposium on Information, Computer and Communications Security. ASIACCS '07. pp. 312–320. <a href="/wiki/CiteSeerX_(identifier)" class="mw-redirect" title="CiteSeerX (identifier)">CiteSeerX</a> <a rel="nofollow" class="external text" href="https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.80.1438">10.1.1.80.1438</a>. <a href="/wiki/Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F1229285.1266999">10.1145/1229285.1266999</a>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=conference&rft.atitle=On+the+power+of+simple+branch+prediction+analysis&rft.btitle=Proceedings+of+the+2nd+ACM+Symposium+on+Information%2C+Computer+and+Communications+Security&rft.series=ASIACCS+%2707&rft.pages=312-320&rft.date=2007&rft_id=https%3A%2F%2Fciteseerx.ist.psu.edu%2Fviewdoc%2Fsummary%3Fdoi%3D10.1.1.80.1438%23id-name%3DCiteSeerX&rft_id=info%3Adoi%2F10.1145%2F1229285.1266999&rft.aulast=Ac%C4%B1i%C3%A7mez&rft.aufirst=Onur&rft.au=Ko%C3%A7%2C+%C3%87etin+Kaya&rft.au=Seifert%2C+Jean-Pierre&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-50"><a href="#cite_ref-50">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFPellegriniBertaccoAustin2010" class="citation journal cs1">Pellegrini, Andrea; Bertacco, Valeria; Austin, Todd (March 2010). <a rel="nofollow" class="external text" href="https://ieeexplore.ieee.org/document/5456933">"Fault-based attack of RSA authentication"</a>. 2010 Design, Automation & Test in Europe Conference & Exhibition (DATE 2010). <a href="/wiki/Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1109%2FDATE.2010.5456933">10.1109/DATE.2010.5456933</a>. Retrieved 21 November 2024.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.jtitle=2010+Design%2C+Automation+%26amp%3B+Test+in+Europe+Conference+%26amp%3B+Exhibition+%28DATE+2010%29&rft.atitle=Fault-based+attack+of+RSA+authentication&rft.date=2010-03&rft_id=info%3Adoi%2F10.1109%2FDATE.2010.5456933&rft.aulast=Pellegrini&rft.aufirst=Andrea&rft.au=Bertacco%2C+Valeria&rft.au=Austin%2C+Todd&rft_id=https%3A%2F%2Fieeexplore.ieee.org%2Fdocument%2F5456933&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> <li id="cite_note-51"><a href="#cite_ref-51">^</a> <link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFIsom" class="citation web cs1">Isom, Kyle. <a rel="nofollow" class="external text" href="https://leanpub.com/gocrypto/read#leanpub-auto-rsa">"Practical Cryptography With Go"</a>. Retrieved 4 January 2022.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=unknown&rft.btitle=Practical+Cryptography+With+Go&rft.aulast=Isom&rft.aufirst=Kyle&rft_id=https%3A%2F%2Fleanpub.com%2Fgocrypto%2Fread%23leanpub-auto-rsa&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"> </li> </ol></div> <div class="mw-heading mw-heading2"><h2 id="Further_reading">Further reading</h2>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=30" title="Edit section: Further reading">edit</a>]</div> <ul><li><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFMenezesvan_OorschotVanstone1996" class="citation book cs1">Menezes, Alfred; van Oorschot, Paul C.; Vanstone, Scott A. (October 1996). <a rel="nofollow" class="external text" href="https://archive.org/details/handbookofapplie0000mene">Handbook of Applied Cryptography</a>. CRC Press. <a href="/wiki/ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <a href="/wiki/Special:BookSources/978-0-8493-8523-0" title="Special:BookSources/978-0-8493-8523-0"><bdi>978-0-8493-8523-0</bdi></a>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=book&rft.btitle=Handbook+of+Applied+Cryptography&rft.pub=CRC+Press&rft.date=1996-10&rft.isbn=978-0-8493-8523-0&rft.aulast=Menezes&rft.aufirst=Alfred&rft.au=van+Oorschot%2C+Paul+C.&rft.au=Vanstone%2C+Scott+A.&rft_id=https%3A%2F%2Farchive.org%2Fdetails%2Fhandbookofapplie0000mene&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"></li> <li><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1238218222"><cite id="CITEREFCormenLeisersonRivestStein2001" class="citation book cs1"><a href="/wiki/Thomas_H._Cormen" title="Thomas H. Cormen">Cormen, Thomas H.</a>; <a href="/wiki/Charles_E._Leiserson" title="Charles E. Leiserson">Leiserson, Charles E.</a>; <a href="/wiki/Ronald_L._Rivest" class="mw-redirect" title="Ronald L. Rivest">Rivest, Ronald L.</a>; <a href="/wiki/Clifford_Stein" title="Clifford Stein">Stein, Clifford</a> (2001). <a href="/wiki/Introduction_to_Algorithms" title="Introduction to Algorithms">Introduction to Algorithms</a> (2nd ed.). MIT Press and McGraw-Hill. pp. <a rel="nofollow" class="external text" href="https://archive.org/details/introductiontoal00corm_691/page/n903">881</a>–887. <a href="/wiki/ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <a href="/wiki/Special:BookSources/978-0-262-03293-3" title="Special:BookSources/978-0-262-03293-3"><bdi>978-0-262-03293-3</bdi></a>.</cite><span title="ctx_ver=Z39.88-2004&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=book&rft.btitle=Introduction+to+Algorithms&rft.pages=881-887&rft.edition=2nd&rft.pub=MIT+Press+and+McGraw-Hill&rft.date=2001&rft.isbn=978-0-262-03293-3&rft.aulast=Cormen&rft.aufirst=Thomas+H.&rft.au=Leiserson%2C+Charles+E.&rft.au=Rivest%2C+Ronald+L.&rft.au=Stein%2C+Clifford&rfr_id=info%3Asid%2Fen.wikipedia.org%3ARSA+%28cryptosystem%29" class="Z3988"></li></ul> <div class="mw-heading mw-heading2"><h2 id="External_links">External links</h2>[<a href="/w/index.php?title=RSA_(cryptosystem)&action=edit&section=31" title="Edit section: External links">edit</a>]</div> <ul><li>The Original RSA Patent as filed with the U.S. Patent Office by Rivest; Ronald L. (Belmont, MA), Shamir; Adi (Cambridge, MA), Adleman; Leonard M. (Arlington, MA), December 14, 1977, <a rel="nofollow" class="external text" href="https://patents.google.com/patent/US4405829">U.S. patent 4,405,829</a>.</li> <li><a rel="nofollow" class="external text" href="https://datatracker.ietf.org/doc/html/rfc8017">RFC 8017: PKCS #1: RSA Cryptography Specifications Version 2.2</a></li> <li><a rel="nofollow" class="external text" href="https://www.youtube.com/watch?v=vgTtHV04xRI">Explanation of RSA using colored lamps</a> on <a href="/wiki/YouTube_video_(identifier)" class="mw-redirect" title="YouTube video (identifier)">YouTube</a></li> <li><a rel="nofollow" class="external text" href="https://www.di-mgt.com.au/rsa_alg.html">Thorough walk through of RSA</a></li> <li><a rel="nofollow" class="external text" href="https://www.muppetlabs.com/~breadbox/txt/rsa.html">Prime Number Hide-And-Seek: How the RSA Cipher Works</a></li> <li><a rel="nofollow" class="external text" href="https://eprint.iacr.org/2006/351">Onur Aciicmez, Cetin Kaya Koc, Jean-Pierre Seifert: On the Power of Simple Branch Prediction Analysis</a></li></ul> <div class="navbox-styles"><style data-mw-deduplicate="TemplateStyles:r1129693374">.mw-parser-output .hlist dl,.mw-parser-output .hlist ol,.mw-parser-output .hlist ul{margin:0;padding:0}.mw-parser-output .hlist dd,.mw-parser-output .hlist dt,.mw-parser-output .hlist li{margin:0;display:inline}.mw-parser-output .hlist.inline,.mw-parser-output .hlist.inline dl,.mw-parser-output .hlist.inline ol,.mw-parser-output .hlist.inline ul,.mw-parser-output .hlist dl dl,.mw-parser-output .hlist dl ol,.mw-parser-output .hlist dl ul,.mw-parser-output .hlist ol dl,.mw-parser-output .hlist ol ol,.mw-parser-output .hlist ol ul,.mw-parser-output .hlist ul dl,.mw-parser-output .hlist ul ol,.mw-parser-output .hlist ul ul{display:inline}.mw-parser-output .hlist .mw-empty-li{display:none}.mw-parser-output .hlist dt::after{content:": "}.mw-parser-output .hlist dd::after,.mw-parser-output .hlist li::after{content:" · ";font-weight:bold}.mw-parser-output .hlist dd:last-child::after,.mw-parser-output .hlist dt:last-child::after,.mw-parser-output .hlist li:last-child::after{content:none}.mw-parser-output .hlist dd dd:first-child::before,.mw-parser-output .hlist dd dt:first-child::before,.mw-parser-output .hlist dd li:first-child::before,.mw-parser-output .hlist dt dd:first-child::before,.mw-parser-output .hlist dt dt:first-child::before,.mw-parser-output .hlist dt li:first-child::before,.mw-parser-output .hlist li dd:first-child::before,.mw-parser-output .hlist li dt:first-child::before,.mw-parser-output .hlist li li:first-child::before{content:" (";font-weight:normal}.mw-parser-output .hlist dd dd:last-child::after,.mw-parser-output .hlist dd dt:last-child::after,.mw-parser-output .hlist dd li:last-child::after,.mw-parser-output .hlist dt dd:last-child::after,.mw-parser-output .hlist dt dt:last-child::after,.mw-parser-output .hlist dt li:last-child::after,.mw-parser-output .hlist li dd:last-child::after,.mw-parser-output .hlist li dt:last-child::after,.mw-parser-output .hlist li li:last-child::after{content:")";font-weight:normal}.mw-parser-output .hlist ol{counter-reset:listitem}.mw-parser-output .hlist ol>li{counter-increment:listitem}.mw-parser-output .hlist ol>li::before{content:" "counter(listitem)"\a0 "}.mw-parser-output .hlist dd ol>li:first-child::before,.mw-parser-output .hlist dt ol>li:first-child::before,.mw-parser-output .hlist li ol>li:first-child::before{content:" ("counter(listitem)"\a0 "}</style><style data-mw-deduplicate="TemplateStyles:r1236075235">.mw-parser-output .navbox{box-sizing:border-box;border:1px solid #a2a9b1;width:100%;clear:both;font-size:88%;text-align:center;padding:1px;margin:1em auto 0}.mw-parser-output .navbox .navbox{margin-top:0}.mw-parser-output .navbox+.navbox,.mw-parser-output .navbox+.navbox-styles+.navbox{margin-top:-1px}.mw-parser-output .navbox-inner,.mw-parser-output .navbox-subgroup{width:100%}.mw-parser-output .navbox-group,.mw-parser-output .navbox-title,.mw-parser-output .navbox-abovebelow{padding:0.25em 1em;line-height:1.5em;text-align:center}.mw-parser-output .navbox-group{white-space:nowrap;text-align:right}.mw-parser-output .navbox,.mw-parser-output .navbox-subgroup{background-color:#fdfdfd}.mw-parser-output .navbox-list{line-height:1.5em;border-color:#fdfdfd}.mw-parser-output .navbox-list-with-group{text-align:left;border-left-width:2px;border-left-style:solid}.mw-parser-output tr+tr>.navbox-abovebelow,.mw-parser-output tr+tr>.navbox-group,.mw-parser-output tr+tr>.navbox-image,.mw-parser-output tr+tr>.navbox-list{border-top:2px solid #fdfdfd}.mw-parser-output .navbox-title{background-color:#ccf}.mw-parser-output .navbox-abovebelow,.mw-parser-output .navbox-group,.mw-parser-output .navbox-subgroup .navbox-title{background-color:#ddf}.mw-parser-output .navbox-subgroup .navbox-group,.mw-parser-output .navbox-subgroup .navbox-abovebelow{background-color:#e6e6ff}.mw-parser-output .navbox-even{background-color:#f7f7f7}.mw-parser-output .navbox-odd{background-color:transparent}.mw-parser-output .navbox .hlist td dl,.mw-parser-output .navbox .hlist td ol,.mw-parser-output .navbox .hlist td ul,.mw-parser-output .navbox td.hlist dl,.mw-parser-output .navbox td.hlist ol,.mw-parser-output .navbox td.hlist ul{padding:0.125em 0}.mw-parser-output .navbox .navbar{display:block;font-size:100%}.mw-parser-output .navbox-title .navbar{float:left;text-align:left;margin-right:0.5em}body.skin--responsive .mw-parser-output .navbox-image img{max-width:none!important}@media print{body.ns-0 .mw-parser-output .navbox{display:none!important}}</style><link rel="mw-deduplicated-inline-style" href="mw-data:TemplateStyles:r1129693374"><style data-mw-deduplicate="TemplateStyles:r1239400231">.mw-parser-output .navbar{display:inline;font-size:88%;font-weight:normal}.mw-parser-output .navbar-collapse{float:left;text-align:left}.mw-parser-output .navbar-boxtext{word-spacing:0}.mw-parser-output .navbar ul{display:inline-block;white-space:nowrap;line-height:inherit}.mw-parser-output .navbar-brackets::before{margin-right:-0.125em;content:"[ "}.mw-parser-output .navbar-brackets::after{margin-left:-0.125em;content:" ]"}.mw-parser-output .navbar li{word-spacing:-0.125em}.mw-parser-output .navbar a>span,.mw-parser-output .navbar a>abbr{text-decoration:inherit}.mw-parser-output .navbar-mini abbr{font-variant:small-caps;border-bottom:none;text-decoration:none;cursor:inherit}.mw-parser-output .navbar-ct-full{font-size:114%;margin:0 7em}.mw-parser-output .navbar-ct-mini{font-size:114%;margin:0 4em}html.skin-theme-clientpref-night .mw-parser-output .navbar li a abbr{color:var(--color-base)!important}@media(prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .navbar li a abbr{color:var(--color-base)!important}}@media print{.mw-parser-output .navbar{display:none!important}}</style></div><div role="navigation" class="navbox" aria-label="Navbox" style="padding:3px"><table class="nowraplinks hlist navbox-inner" style="border-spacing:0;background:transparent;color:inherit"><tbody><tr><td colspan="2" class="navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em"></div><table class="nowraplinks navbox-subgroup" style="border-spacing:0"><tbody><tr><td colspan="2" class="navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em"></div><table class="nowraplinks navbox-subgroup" style="border-spacing:0"><tbody><tr><th scope="col" class="navbox-title" colspan="2"><div class="navbar plainlinks hlist navbar-mini"><ul><li class="nv-view"><a href="/wiki/Template:Cryptography_public-key" title="Template:Cryptography public-key"><abbr title="View this template">v</abbr></a></li><li class="nv-talk"><a href="/wiki/Template_talk:Cryptography_public-key" title="Template talk:Cryptography public-key"><abbr title="Discuss this template">t</abbr></a></li><li class="nv-edit"><a href="/wiki/Special:EditPage/Template:Cryptography_public-key" title="Special:EditPage/Template:Cryptography public-key"><abbr title="Edit this template">e</abbr></a></li></ul></div><div id="Public-key_cryptography" style="font-size:114%;margin:0 4em"><a href="/wiki/Public-key_cryptography" title="Public-key cryptography">Public-key cryptography</a></div></th></tr><tr><th scope="row" class="navbox-group" style="width:1%">Algorithms</th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em"></div><table class="nowraplinks navbox-subgroup" style="border-spacing:0"><tbody><tr><th scope="row" class="navbox-group wraplinks" style="width:1%"><a href="/wiki/Integer_factorization" title="Integer factorization">Integer factorization</a></th><td class="navbox-list-with-group navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em"> <ul><li><a href="/wiki/Benaloh_cryptosystem" title="Benaloh cryptosystem">Benaloh</a></li> <li><a href="/wiki/Blum%E2%80%93Goldwasser_cryptosystem" title="Blum–Goldwasser cryptosystem">Blum–Goldwasser</a></li> <li><a href="/wiki/Cayley%E2%80%93Purser_algorithm" title="Cayley–Purser algorithm">Cayley–Purser</a></li> <li><a href="/wiki/Damg%C3%A5rd%E2%80%93Jurik_cryptosystem" title="Damgård–Jurik cryptosystem">Damgård–Jurik</a></li> <li><a href="/wiki/GMR_(cryptography)" title="GMR (cryptography)">GMR</a></li> <li><a href="/wiki/Goldwasser%E2%80%93Micali_cryptosystem" title="Goldwasser–Micali cryptosystem">Goldwasser–Micali</a></li> <li><a href="/wiki/Naccache%E2%80%93Stern_cryptosystem" title="Naccache–Stern cryptosystem">Naccache–Stern</a></li> <li><a href="/wiki/Paillier_cryptosystem" title="Paillier cryptosystem">Paillier</a></li> <li><a href="/wiki/Rabin_cryptosystem" title="Rabin cryptosystem">Rabin</a></li> <li><a class="mw-selflink selflink">RSA</a></li> <li><a href="/wiki/Okamoto%E2%80%93Uchiyama_cryptosystem" title="Okamoto–Uchiyama cryptosystem">Okamoto–Uchiyama</a></li> <li><a href="/wiki/Schmidt-Samoa_cryptosystem" title="Schmidt-Samoa cryptosystem">Schmidt–Samoa</a></li></ul> </div></td></tr><tr><th scope="row" class="navbox-group wraplinks" style="width:1%"><a href="/wiki/Discrete_logarithm" title="Discrete logarithm">Discrete logarithm</a></th><td class="navbox-list-with-group navbox-list navbox-even" style="width:100%;padding:0"><div style="padding:0 0.25em"> <ul><li><a href="/wiki/Boneh%E2%80%93Lynn%E2%80%93Shacham" class="mw-redirect" title="Boneh–Lynn–Shacham">BLS</a></li> <li><a href="/wiki/Cramer%E2%80%93Shoup_cryptosystem" title="Cramer–Shoup cryptosystem">Cramer–Shoup</a></li> <li><a href="/wiki/Diffie%E2%80%93Hellman_key_exchange" title="Diffie–Hellman key exchange">DH</a></li> <li><a href="/wiki/Digital_Signature_Algorithm" title="Digital Signature Algorithm">DSA</a></li> <li><a href="/wiki/Elliptic-curve_Diffie%E2%80%93Hellman" title="Elliptic-curve Diffie–Hellman">ECDH</a> <ul><li><a href="/wiki/Curve25519" title="Curve25519">X25519</a></li> <li><a href="/wiki/Curve448" title="Curve448">X448</a></li></ul></li> <li><a href="/wiki/Elliptic_Curve_Digital_Signature_Algorithm" title="Elliptic Curve Digital Signature Algorithm">ECDSA</a></li> <li><a href="/wiki/EdDSA" title="EdDSA">EdDSA</a> <ul><li><a href="/wiki/EdDSA#Ed25519" title="EdDSA">Ed25519</a></li> <li><a href="/wiki/EdDSA#Ed448" title="EdDSA">Ed448</a></li></ul></li> <li><a href="/wiki/ECMQV" class="mw-redirect" title="ECMQV">ECMQV</a></li> <li><a href="/wiki/Encrypted_key_exchange" title="Encrypted key exchange">EKE</a></li> <li><a href="/wiki/ElGamal_encryption" title="ElGamal encryption">ElGamal</a> <ul><li><a href="/wiki/ElGamal_signature_scheme" title="ElGamal signature scheme">signature scheme</a></li></ul></li> <li><a href="/wiki/MQV" title="MQV">MQV</a></li> <li><a href="/wiki/Schnorr_signature" title="Schnorr signature">Schnorr</a></li> <li><a href="/wiki/SPEKE" title="SPEKE">SPEKE</a></li> <li><a href="/wiki/Secure_Remote_Password_protocol" title="Secure Remote Password protocol">SRP</a></li> <li><a href="/wiki/Station-to-Station_protocol" title="Station-to-Station protocol">STS</a></li></ul> </div></td></tr><tr><th scope="row" class="navbox-group wraplinks" style="width:1%"><a href="/wiki/Lattice-based_cryptography" title="Lattice-based cryptography">Lattice/SVP/CVP</a>/<a href="/wiki/Learning_with_errors" title="Learning with errors">LWE</a>/<a href="/wiki/Short_integer_solution_problem" title="Short integer solution problem">SIS</a></th><td class="navbox-list-with-group navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em"> <ul><li><a href="/wiki/BLISS_signature_scheme" title="BLISS signature scheme">BLISS</a></li> <li><a href="/wiki/Kyber" title="Kyber">Kyber</a></li> <li><a href="/wiki/NewHope" title="NewHope">NewHope</a></li> <li><a href="/wiki/NTRUEncrypt" title="NTRUEncrypt">NTRUEncrypt</a></li> <li><a href="/wiki/NTRUSign" title="NTRUSign">NTRUSign</a></li> <li><a href="/wiki/RLWE-KEX" class="mw-redirect" title="RLWE-KEX">RLWE-KEX</a></li> <li><a href="/wiki/RLWE-SIG" class="mw-redirect" title="RLWE-SIG">RLWE-SIG</a></li></ul> </div></td></tr><tr><th scope="row" class="navbox-group wraplinks" style="width:1%">Others</th><td class="navbox-list-with-group navbox-list navbox-even" style="width:100%;padding:0"><div style="padding:0 0.25em"> <ul><li><a href="/wiki/Algebraic_Eraser" title="Algebraic Eraser">AE</a></li> <li><a href="/wiki/CEILIDH" title="CEILIDH">CEILIDH</a></li> <li><a href="/wiki/Efficient_Probabilistic_Public-Key_Encryption_Scheme" title="Efficient Probabilistic Public-Key Encryption Scheme">EPOC</a></li> <li><a href="/wiki/Hidden_Field_Equations" title="Hidden Field Equations">HFE</a></li> <li><a href="/wiki/Integrated_Encryption_Scheme" title="Integrated Encryption Scheme">IES</a></li> <li><a href="/wiki/Lamport_signature" title="Lamport signature">Lamport</a></li> <li><a href="/wiki/McEliece_cryptosystem" title="McEliece cryptosystem">McEliece</a></li> <li><a href="/wiki/Merkle%E2%80%93Hellman_knapsack_cryptosystem" title="Merkle–Hellman knapsack cryptosystem">Merkle–Hellman</a></li> <li><a href="/wiki/Naccache%E2%80%93Stern_knapsack_cryptosystem" title="Naccache–Stern knapsack cryptosystem">Naccache–Stern knapsack cryptosystem</a></li> <li><a href="/wiki/Three-pass_protocol" title="Three-pass protocol">Three-pass protocol</a></li> <li><a href="/wiki/XTR" title="XTR">XTR</a></li> <li><a href="/wiki/SQIsign" title="SQIsign">SQIsign</a></li></ul> </div></td></tr></tbody></table><div></div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Theory</th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em"> <ul><li><a href="/wiki/Discrete_logarithm#Cryptography" title="Discrete logarithm">Discrete logarithm cryptography</a></li> <li><a href="/wiki/Elliptic-curve_cryptography" title="Elliptic-curve cryptography">Elliptic-curve cryptography</a></li> <li><a href="/wiki/Hash-based_cryptography" title="Hash-based cryptography">Hash-based cryptography</a></li> <li><a href="/wiki/Non-commutative_cryptography" title="Non-commutative cryptography">Non-commutative cryptography</a></li> <li><a href="/wiki/RSA_problem" title="RSA problem">RSA problem</a></li> <li><a href="/wiki/Trapdoor_function" title="Trapdoor function">Trapdoor function</a></li></ul> </div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Standardization</th><td class="navbox-list-with-group navbox-list navbox-even hlist" style="width:100%;padding:0"><div style="padding:0 0.25em"> <ul><li><a href="/wiki/CRYPTREC" title="CRYPTREC">CRYPTREC</a></li> <li><a href="/wiki/IEEE_P1363" title="IEEE P1363">IEEE P1363</a></li> <li><a href="/wiki/NESSIE" title="NESSIE">NESSIE</a></li> <li><a href="/wiki/NSA_Suite_B_Cryptography" title="NSA Suite B Cryptography">NSA Suite B</a></li> <li><a href="/wiki/Commercial_National_Security_Algorithm_Suite" title="Commercial National Security Algorithm Suite">CNSA</a></li> <li><a href="/wiki/NIST_Post-Quantum_Cryptography_Standardization" title="NIST Post-Quantum Cryptography Standardization">Post-Quantum Cryptography</a></li></ul> </div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Topics</th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em"> <ul><li><a href="/wiki/Digital_signature" title="Digital signature">Digital signature</a></li> <li><a href="/wiki/Optimal_asymmetric_encryption_padding" title="Optimal asymmetric encryption padding">OAEP</a></li> <li><a href="/wiki/Public_key_fingerprint" title="Public key fingerprint">Fingerprint</a></li> <li><a href="/wiki/Public_key_infrastructure" title="Public key infrastructure">PKI</a></li> <li><a href="/wiki/Web_of_trust" title="Web of trust">Web of trust</a></li> <li><a href="/wiki/Key_size" title="Key size">Key size</a></li> <li><a href="/wiki/Identity-based_cryptography" title="Identity-based cryptography">Identity-based cryptography</a></li> <li><a href="/wiki/Post-quantum_cryptography" title="Post-quantum cryptography">Post-quantum cryptography</a></li> <li><a href="/wiki/OpenPGP_card" title="OpenPGP card">OpenPGP card</a></li></ul> </div></td></tr></tbody></table><div></div></td></tr></tbody></table><div></div></td></tr><tr><td colspan="2" class="navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em"></div><table class="nowraplinks mw-collapsible mw-collapsed navbox-subgroup" style="border-spacing:0"><tbody><tr><th scope="col" class="navbox-title" colspan="2"><div class="navbar plainlinks hlist navbar-mini"><ul><li class="nv-view"><a href="/wiki/Template:Cryptography_navbox" title="Template:Cryptography navbox"><abbr title="View this template">v</abbr></a></li><li class="nv-talk"><a href="/wiki/Template_talk:Cryptography_navbox" title="Template talk:Cryptography navbox"><abbr title="Discuss this template">t</abbr></a></li><li class="nv-edit"><a href="/wiki/Special:EditPage/Template:Cryptography_navbox" title="Special:EditPage/Template:Cryptography navbox"><abbr title="Edit this template">e</abbr></a></li></ul></div><div id="Cryptography" style="font-size:114%;margin:0 4em"><a href="/wiki/Cryptography" title="Cryptography">Cryptography</a></div></th></tr><tr><th scope="row" class="navbox-group" style="width:1%">General</th><td class="navbox-list-with-group navbox-list navbox-odd" style="width:100%;padding:0"><div style="padding:0 0.25em"> <ul><li><a href="/wiki/History_of_cryptography" title="History of cryptography">History of cryptography</a></li> <li><a href="/wiki/Outline_of_cryptography" title="Outline of cryptography">Outline of cryptography</a></li> <li><a href="/wiki/Classical_cipher" title="Classical cipher">Classical cipher</a></li> <li><a href="/wiki/Cryptographic_protocol" title="Cryptographic protocol">Cryptographic protocol</a> <ul><li><a href="/wiki/Authentication_protocol" title="Authentication protocol">Authentication protocol</a></li></ul></li> <li><a href="/wiki/Cryptographic_primitive" title="Cryptographic primitive">Cryptographic primitive</a></li> <li><a href="/wiki/Cryptanalysis" title="Cryptanalysis">Cryptanalysis</a></li> <li><a href="/wiki/Cryptocurrency" title="Cryptocurrency">Cryptocurrency</a></li> <li><a href="/wiki/Cryptosystem" title="Cryptosystem">Cryptosystem</a></li> <li><a href="/wiki/Cryptographic_nonce" title="Cryptographic nonce">Cryptographic nonce</a></li> <li><a href="/wiki/Cryptovirology" title="Cryptovirology">Cryptovirology</a></li> <li><a href="/wiki/Hash_function" title="Hash function">Hash function</a> <ul><li><a href="/wiki/Cryptographic_hash_function" title="Cryptographic hash function">Cryptographic hash function</a></li> <li><a href="/wiki/Key_derivation_function" title="Key derivation function">Key derivation function</a></li> <li><a href="/wiki/Secure_Hash_Algorithms" title="Secure Hash Algorithms">Secure Hash Algorithms</a></li></ul></li> <li><a href="/wiki/Digital_signature" title="Digital signature">Digital signature</a></li> <li><a href="/wiki/Kleptography" title="Kleptography">Kleptography</a></li> <li><a href="/wiki/Key_(cryptography)" title="Key (cryptography)">Key (cryptography)</a></li> <li><a href="/wiki/Key_exchange" title="Key exchange">Key exchange</a></li> <li><a href="/wiki/Key_generator" title="Key generator">Key generator</a></li> <li><a href="/wiki/Key_schedule" title="Key schedule">Key schedule</a></li> <li><a href="/wiki/Key_stretching" title="Key stretching">Key stretching</a></li> <li><a href="/wiki/Keygen" title="Keygen">Keygen</a></li> <li><a href="/wiki/Template:Cryptography_machines" title="Template:Cryptography machines">Machines</a></li> <li><a href="/wiki/Cryptojacking_malware" class="mw-redirect" title="Cryptojacking malware">Cryptojacking malware</a></li> <li><a href="/wiki/Ransomware" title="Ransomware">Ransomware</a></li> <li><a href="/wiki/Random_number_generation" title="Random number generation">Random number generation</a> <ul><li><a href="/wiki/Cryptographically_secure_pseudorandom_number_generator" title="Cryptographically secure pseudorandom number generator">Cryptographically secure pseudorandom number generator</a> (CSPRNG)</li></ul></li> <li><a href="/wiki/Pseudorandom_noise" title="Pseudorandom noise">Pseudorandom noise</a> (PRN)</li> <li><a href="/wiki/Secure_channel" title="Secure channel">Secure channel</a></li> <li><a href="/wiki/Insecure_channel" class="mw-redirect" title="Insecure channel">Insecure channel</a></li> <li><a href="/wiki/Subliminal_channel" title="Subliminal channel">Subliminal channel</a></li> <li><a href="/wiki/Encryption" title="Encryption">Encryption</a></li> <li><a href="/wiki/Decryption" class="mw-redirect" title="Decryption">Decryption</a></li> <li><a href="/wiki/End-to-end_encryption" title="End-to-end encryption">End-to-end encryption</a></li> <li><a href="/wiki/Harvest_now,_decrypt_later" title="Harvest now, decrypt later">Harvest now, decrypt later</a></li> <li><a href="/wiki/Information-theoretic_security" title="Information-theoretic security">Information-theoretic security</a></li> <li><a href="/wiki/Plaintext" title="Plaintext">Plaintext</a></li> <li><a href="/wiki/Codetext" class="mw-redirect" title="Codetext">Codetext</a></li> <li><a href="/wiki/Ciphertext" title="Ciphertext">Ciphertext</a></li> <li><a href="/wiki/Shared_secret" title="Shared secret">Shared secret</a></li> <li><a href="/wiki/Trapdoor_function" title="Trapdoor function">Trapdoor function</a></li> <li><a href="/wiki/Trusted_timestamping" title="Trusted timestamping">Trusted timestamping</a></li> <li><a href="/wiki/Key-based_routing" title="Key-based routing">Key-based routing</a></li> <li><a href="/wiki/Onion_routing" title="Onion routing">Onion routing</a></li> <li><a href="/wiki/Garlic_routing" title="Garlic routing">Garlic routing</a></li> <li><a href="/wiki/Kademlia" title="Kademlia">Kademlia</a></li> <li><a href="/wiki/Mix_network" title="Mix network">Mix network</a></li></ul> </div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Mathematics</th><td class="navbox-list-with-group navbox-list navbox-even" style="width:100%;padding:0"><div style="padding:0 0.25em"> <ul><li><a href="/wiki/Cryptographic_hash_function" title="Cryptographic hash function">Cryptographic hash function</a></li> <li><a href="/wiki/Block_cipher" title="Block cipher">Block cipher</a></li> <li><a href="/wiki/Stream_cipher" title="Stream cipher">Stream cipher</a></li> <li><a href="/wiki/Symmetric-key_algorithm" title="Symmetric-key algorithm">Symmetric-key algorithm</a></li> <li><a href="/wiki/Authenticated_encryption" title="Authenticated encryption">Authenticated encryption</a></li> <li><a href="/wiki/Public-key_cryptography" title="Public-key cryptography">Public-key cryptography</a></li> <li><a href="/wiki/Quantum_key_distribution" title="Quantum key distribution">Quantum key distribution</a></li> <li><a href="/wiki/Quantum_cryptography" title="Quantum cryptography">Quantum cryptography</a></li> <li><a href="/wiki/Post-quantum_cryptography" title="Post-quantum cryptography">Post-quantum cryptography</a></li> <li><a href="/wiki/Message_authentication_code" title="Message authentication code">Message authentication code</a></li> <li><a href="/wiki/Cryptographically_secure_pseudorandom_number_generator" title="Cryptographically secure pseudorandom number generator">Random numbers</a></li> <li><a href="/wiki/Steganography" title="Steganography">Steganography</a></li></ul> </div></td></tr><tr><td class="navbox-abovebelow" colspan="2"><div> <ul><li><img alt="" src="//upload.wikimedia.org/wikipedia/en/thumb/9/96/Symbol_category_class.svg/16px-Symbol_category_class.svg.png" decoding="async" width="16" height="16" class="mw-file-element" srcset="//upload.wikimedia.org/wikipedia/en/thumb/9/96/Symbol_category_class.svg/23px-Symbol_category_class.svg.png 1.5x, //upload.wikimedia.org/wikipedia/en/thumb/9/96/Symbol_category_class.svg/31px-Symbol_category_class.svg.png 2x" data-file-width="180" data-file-height="185" /> <a href="/wiki/Category:Cryptography" title="Category:Cryptography">Category</a></li></ul> </div></td></tr></tbody></table><div></div></td></tr></tbody></table></div>    </div><noscript><img src="https://login.wikimedia.org/wiki/Special:CentralAutoLogin/start?type=1x1&useformat=desktop" alt="" width="1" height="1" style="border: none; position: absolute;"></noscript> <div class="printfooter" data-nosnippet="">Retrieved from "<a dir="ltr" href="https://en.wikipedia.org/w/index.php?title=RSA_(cryptosystem)&oldid=1258725874">https://en.wikipedia.org/w/index.php?title=RSA_(cryptosystem)&oldid=1258725874</a>"</div></div> <div id="catlinks" class="catlinks" data-mw="interface"><div id="mw-normal-catlinks" class="mw-normal-catlinks"><a href="/wiki/Help:Category" title="Help:Category">Categories</a>: <ul><li><a href="/wiki/Category:Public-key_encryption_schemes" title="Category:Public-key encryption schemes">Public-key encryption schemes</a></li><li><a href="/wiki/Category:Digital_signature_schemes" title="Category:Digital signature schemes">Digital signature schemes</a></li></ul></div><div id="mw-hidden-catlinks" class="mw-hidden-catlinks mw-hidden-cats-hidden">Hidden categories: <ul><li><a href="/wiki/Category:Wikipedia_articles_needing_clarification_from_June_2020" title="Category:Wikipedia articles needing clarification from June 2020">Wikipedia articles needing clarification from June 2020</a></li><li><a href="/wiki/Category:Articles_with_short_description" title="Category:Articles with short description">Articles with short description</a></li><li><a href="/wiki/Category:Short_description_matches_Wikidata" title="Category:Short description matches Wikidata">Short description matches Wikidata</a></li><li><a href="/wiki/Category:All_articles_with_self-published_sources" title="Category:All articles with self-published sources">All articles with self-published sources</a></li><li><a href="/wiki/Category:Articles_with_self-published_sources_from_December_2023" title="Category:Articles with self-published sources from December 2023">Articles with self-published sources from December 2023</a></li><li><a href="/wiki/Category:All_articles_with_failed_verification" title="Category:All articles with failed verification">All articles with failed verification</a></li><li><a href="/wiki/Category:Articles_with_failed_verification_from_April_2022" title="Category:Articles with failed verification from April 2022">Articles with failed verification from April 2022</a></li><li><a href="/wiki/Category:All_articles_with_unsourced_statements" title="Category:All articles with unsourced statements">All articles with unsourced statements</a></li><li><a href="/wiki/Category:Articles_with_unsourced_statements_from_February_2015" title="Category:Articles with unsourced statements from February 2015">Articles with unsourced statements from February 2015</a></li><li><a href="/wiki/Category:All_articles_that_may_contain_original_research" title="Category:All articles that may contain original research">All articles that may contain original research</a></li><li><a href="/wiki/Category:Articles_that_may_contain_original_research_from_August_2019" title="Category:Articles that may contain original research from August 2019">Articles that may contain original research from August 2019</a></li><li><a href="/wiki/Category:Articles_with_unsourced_statements_from_December_2023" title="Category:Articles with unsourced statements from December 2023">Articles with unsourced statements from December 2023</a></li><li><a href="/wiki/Category:Articles_containing_potentially_dated_statements_from_2020" title="Category:Articles containing potentially dated statements from 2020">Articles containing potentially dated statements from 2020</a></li><li><a href="/wiki/Category:All_articles_containing_potentially_dated_statements" title="Category:All articles containing potentially dated statements">All articles containing potentially dated statements</a></li><li><a href="/wiki/Category:Articles_needing_additional_references_from_October_2017" title="Category:Articles needing additional references from October 2017">Articles needing additional references from October 2017</a></li><li><a href="/wiki/Category:All_articles_needing_additional_references" title="Category:All articles needing additional references">All articles needing additional references</a></li></ul></div></div> </div> </main> </div> <div class="mw-footer-container"> <footer id="footer" class="mw-footer" > <ul id="footer-info"> <li id="footer-info-lastmod"> This page was last edited on 21 November 2024, at 07:32 (UTC).</li> <li id="footer-info-copyright">Text is available under the <a href="/wiki/Wikipedia:Text_of_the_Creative_Commons_Attribution-ShareAlike_4.0_International_License" title="Wikipedia:Text of the Creative Commons Attribution-ShareAlike 4.0 International License">Creative Commons Attribution-ShareAlike 4.0 License</a>; additional terms may apply. By using this site, you agree to the <a href="https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Terms_of_Use" class="extiw" title="foundation:Special:MyLanguage/Policy:Terms of Use">Terms of Use</a> and <a href="https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Privacy_policy" class="extiw" title="foundation:Special:MyLanguage/Policy:Privacy policy">Privacy Policy</a>. Wikipedia® is a registered trademark of the <a rel="nofollow" class="external text" href="https://wikimediafoundation.org/">Wikimedia Foundation, Inc.</a>, a non-profit organization.</li> </ul> <ul id="footer-places"> <li id="footer-places-privacy"><a href="https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Privacy_policy">Privacy policy</a></li> <li id="footer-places-about"><a href="/wiki/Wikipedia:About">About Wikipedia</a></li> <li id="footer-places-disclaimers"><a href="/wiki/Wikipedia:General_disclaimer">Disclaimers</a></li> <li id="footer-places-contact"><a href="//en.wikipedia.org/wiki/Wikipedia:Contact_us">Contact Wikipedia</a></li> <li id="footer-places-wm-codeofconduct"><a href="https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Universal_Code_of_Conduct">Code of Conduct</a></li> <li id="footer-places-developers"><a href="https://developer.wikimedia.org">Developers</a></li> <li id="footer-places-statslink"><a href="https://stats.wikimedia.org/#/en.wikipedia.org">Statistics</a></li> <li id="footer-places-cookiestatement"><a href="https://foundation.wikimedia.org/wiki/Special:MyLanguage/Policy:Cookie_statement">Cookie statement</a></li> <li id="footer-places-mobileview"><a href="//en.m.wikipedia.org/w/index.php?title=RSA_(cryptosystem)&mobileaction=toggle_view_mobile" class="noprint stopMobileRedirectToggle">Mobile view</a></li> </ul> <ul id="footer-icons" class="noprint"> <li id="footer-copyrightico"><a href="https://wikimediafoundation.org/" class="cdx-button cdx-button--fake-button cdx-button--size-large cdx-button--fake-button--enabled"><img src="/static/images/footer/wikimedia-button.svg" width="84" height="29" alt="Wikimedia Foundation" loading="lazy"></a></li> <li id="footer-poweredbyico"><a href="https://www.mediawiki.org/" class="cdx-button cdx-button--fake-button cdx-button--size-large cdx-button--fake-button--enabled"><img src="/w/resources/assets/poweredby_mediawiki.svg" alt="Powered by MediaWiki" width="88" height="31" loading="lazy"></a></li> </ul> </footer> </div> </div> </div> <div class="vector-settings" id="p-dock-bottom"> <ul></ul> </div><script>(RLQ=window.RLQ||[]).push(function(){mw.config.set({"wgHostname":"mw-web.codfw.main-7fc47fc68d-wmsbr","wgBackendResponseTime":141,"wgPageParseReport":{"limitreport":{"cputime":"1.150","walltime":"1.471","ppvisitednodes":{"value":12946,"limit":1000000},"postexpandincludesize":{"value":227544,"limit":2097152},"templateargumentsize":{"value":22154,"limit":2097152},"expansiondepth":{"value":18,"limit":100},"expensivefunctioncount":{"value":16,"limit":500},"unstrip-depth":{"value":1,"limit":20},"unstrip-size":{"value":168783,"limit":5000000},"entityaccesscount":{"value":0,"limit":400},"timingprofile":["100.00% 1196.337 1 -total"," 28.95% 346.291 3 Template:Reflist"," 15.14% 181.101 4 Template:Navbox"," 14.54% 173.937 119 Template:Math"," 10.50% 125.615 1 Template:Short_description"," 10.15% 121.462 8 Template:Cite_journal"," 9.01% 107.735 1 Template:Cryptography_navbox"," 7.21% 86.285 19 Template:Cite_web"," 6.11% 73.136 1 Template:Infobox_block_cipher"," 6.05% 72.335 7 Template:Fix"]},"scribunto":{"limitreport-timeusage":{"value":"0.592","limit":"10.000"},"limitreport-memusage":{"value":10336824,"limit":52428800}},"cachereport":{"origin":"mw-web.eqiad.main-565d46677b-kpwws","timestamp":"20241128120305","ttl":2592000,"transientcontent":false}}});});</script> <script type="application/ld+json">{"@context":"https:\/\/schema.org","@type":"Article","name":"RSA (cryptosystem)","url":"https:\/\/en.wikipedia.org\/wiki\/RSA_(cryptosystem)","sameAs":"http:\/\/www.wikidata.org\/entity\/Q181551","mainEntity":"http:\/\/www.wikidata.org\/entity\/Q181551","author":{"@type":"Organization","name":"Contributors to Wikimedia projects"},"publisher":{"@type":"Organization","name":"Wikimedia Foundation, Inc.","logo":{"@type":"ImageObject","url":"https:\/\/www.wikimedia.org\/static\/images\/wmf-hor-googpub.png"}},"datePublished":"2001-02-21T12:39:36Z","dateModified":"2024-11-21T07:32:46Z","headline":"algorithm for public-key cryptography"}</script> </body> </html>