RSA private exponent reveals the factorization
= RSA private exponent reveals the factorization
{c}
Knowledge of a valid public and private exponent gives $ed-1$, a nonzero multiple of $\lambda(N)$. Writing it as $2^st$ with $t$ odd and testing random bases produces a nontrivial square root of one modulo $N$ with high probability; a greatest common divisor then factors $N$. Thus one customer's private key under a shared semiprime modulus compromises every exponent using that modulus.