 Solution

In the Rabin cryptosystem, the public key is $N=pq$, usually with distinct secret primes $p,q\equiv 3(\mathrm{mod}4)$. A message $m$ is encrypted asKnowing $p$ and $q$, the receiver finds the two square roots of $c$ modulo each prime and combines them by the Chinese remainder theorem, obtaining the four square roots modulo $N$; redundancy identifies the intended message.

Factoring $N$ plainly enables this decryption. Conversely, suppose an algorithm returns a square root of a chosen quadratic residue. Choose random invertible $x$, submit $x^2\mathrm{mod}N$, and receive a root $y$. With probability at least $1/2$, $y\not\equiv \pm x(\mathrm{mod}N)$; thenis a nontrivial factor. Thus decryption and factoring are equivalent up to a randomized polynomial-time reduction.