Repeated-message attack on the Rabin cryptosystem ($m^2\mathrm{mod}N,m^2\mathrm{mod}{N}^{\prime }$)

For coprime moduli $N,N^{\prime }$ and $0<m<\min (N,N^{\prime })$, the Chinese remainder theorem recovers the integer $m^2$ uniquely in $[0,N{N}^{\prime })$ from the two ciphertexts. An ordinary integer square root then recovers the message. If distinct semiprime moduli share a factor, their greatest common divisor instead reveals factors of both moduli. Learning one message in the coprime case does not by itself give a general factoring algorithm or a decryption key for other ciphertexts.