Past exam of the mathematics course of the University of Cambridge / 2021 / ii / Paper 4 / 3K (Coding and Cryptography)

For Rabin cryptosystem, choose primes $p,q\equiv 3(\mathrm{mod}4)$, publish $N=pq$, and encrypt $x$ as $x^2\mathrm{mod}N$. The factors let the receiver take square roots modulo $p$ and $q$ and combine them using the Chinese remainder theorem; redundancy identifies the intended one of four roots.

For RSA cryptosystem, choose $N=pq$, select $e$ coprime to $\phi (N)$ and $d$ with $ed\equiv 1(\mathrm{mod}\phi (N))$. Encrypt $x$ as $x^e$ and decrypt by raising to $d$ modulo $N$. Rabin inversion is provably equivalent to factoring, while ordinary RSA lacks that reduction; Rabin's disadvantage is its fourfold decryption ambiguity.