RSA cryptosystem

For $N=pq$, choose $e$ coprime to $\varphi (N)$ and a private exponent $d$ with $ed\equiv 1(\mathrm{mod}\varphi (N))$. Encryption and decryption are

An attack exploiting preservation of an algebraic operation by encryption or signing. The textbook RSA cryptosystem has $E(m_1{m}_2)=E(m_1)E(m_2)(\mathrm{mod}N)$, so unprotected ciphertexts can be modified multiplicatively. Authentication must be verified before accepting a modified message.

If the same invertible message $m$ is sent under one RSA modulus with coprime public exponents $e_1,e_2$, choose integers $a,b$ with $a{e}_1+b{e}_2=1$. From $c_i=m^{e_i}(\mathrm{mod}N)$ one recoversusing modular inverses for negative exponents.

Knowledge of a valid public and private exponent gives $ed-1$, a nonzero multiple of $\lambda (N)$. Writing it as $2^{s}t$ with $t$ odd and testing random bases produces a nontrivial square root of one modulo $N$ with high probability; a greatest common divisor then factors $N$. Thus one customer's private key under a shared semiprime modulus compromises every exponent using that modulus.

An RSA fixed point satisfies $m^e\equiv m(\mathrm{mod}N)$. Since every valid public exponent $e$ is odd, $(-m{)}^e\equiv -m^e\equiv -m(\mathrm{mod}N)$; therefore $N-m$ is a fixed point whenever $m$ is.