Calculate d from n, e, p, q in RSA?

Question

Not sure if this is the correct place to ask a cryptography question, but here goes.

I am trying to work out "d" in RSA, I have worked out p, q, e, n and ø(n);

p = 79, q = 113, e = 2621

n = pq                   ø(n) = (p-1)(q-1)
n = 79 x 113 = 8927      ø(n) = 78 x 112 = 8736

e = 2621
d = ???

I cant seem to find d, I know that d is meant to be a value that.. ed mod ø(n) = 1. Any help will be appreciated

As an example would be e = 17, d = 2753, ø(n) = 3120

17 * 2753 mod 3120 = 1

This question appears to be off-topic because it is about [cryptography](http://crypto.stackexchange.com) — Maarten Bodewes, Apr 25 '14 at 10:49
Possible duplicate of [How to find d, given p, q, and e in RSA?](https://stackoverflow.com/q/16310871/608639) — jww, Sep 24 '19 at 00:27

user448810 · Accepted Answer · 2014-04-25T01:29:02.050

15

You are looking for the modular inverse of e (mod n), which can be computed using the extended Euclidean algorithm:

function inverse(x, m)
    a, b, u := 0, m, 1
    while x > 0
        q := b // x # integer division
        x, a, b, u := b % x, u, x, a - q * u
    if b == 1 return a % m
    error "must be coprime"

Thus, in your examples, inverse(17, 3120) = 2753 and inverse(2621, 8736) = 4373. If you don't want to implement the algorithm, you can ask Wolfram|Alpha for the answer.

edited Apr 25 '14 at 01:29

answered Apr 24 '14 at 22:52

user448810

17,381
4
34
59

Cheers, I heard of wolfram alpha I thought it was a program you had to install so i never bothered with it until now. the answer I got was 4373, by using the command - inverse of 2621 modulo 8736. However if I recheck the answer i get 0, isn't it supposed to be 1? "ed mod ø(n) = 1". Also I believe that you are meant to have 2 figured in RSA a small and large number. the one im trying to work out I have a large "e" but in the example the "e" is small and the "d" is large – user3423572 Apr 24 '14 at 23:11
My original solution misread the numbers; the answer has now been fixed. Sorry for the confusion. In RSA typically _e_ has only a small number of 1-bits in its binary representation, because there is no calculation to do for 0-bits. Thus, e = 3 = 11b or e = 65537 = 10000000000000001b are common. – user448810 Apr 25 '14 at 01:23
@user3423572: I still had it wrong; the dyslexia must be strong dotay. It's fixed now, I hope. Humbug. – user448810 Apr 25 '14 at 01:30

score 4 · Answer 2 · answered Apr 24 '14 at 21:44

4

The algorithm you need is the Extended Euclidean Algorithm. This allows you to compute the coefficients of Bézout's identity which states that for any two non-zero integers a and b, there exist integers x and y such that:

ax + by = gcd(a,b)

This might not seem immediately useful, however we know that e and φ(n) are coprime, gcd(e,φ(n)) = 1. So the algorithm gives us x and y such that:

ex + φ(n)y = gcd(e,φ(n))
           = 1
Re-arrange:
ex = -φ(n)y + 1

This is equivalent to saying ex mod φ(n) = 1, so x = d.

answered Apr 24 '14 at 21:44

Iridium

23,323
6
52
74

Thanks for the reply. I got a little lost your explanation I'm struggling to apply the formula you provided to my problem. I have come across Euclid's algorithm in the past but it was only to calculate a greatest common divisor - gcd – user3423572 Apr 24 '14 at 22:07
@user3423572 My answer is really a description of why the algorithm works - the link in the first line to the "Extended Euclidean Algorithm" should point you in the right direction. You're right that the usual Euclidean algorithm gives you the GCD, however the "extended" version gives you the coefficients for Bézout's identity - one of which is the `d` you need. – Iridium Apr 24 '14 at 22:36
@Iridium how to know which one is the one I need ? – Ariel Alvarez Oct 25 '19 at 11:56

score 3 · Answer 3 · edited Jun 08 '22 at 21:34

For example you need to get d in the next:
3*d = 1 (mod 9167368)

this is equally:
3*d = 1 + k * 9167368, where k = 1, 2, 3, ...

rewrite it:
d = (1 + k * 9167368)/3

Your d must be the integer with the lowest k.
Let's write the formula:
d = (1 + k * fi)/e

public static int MultiplicativeInverse(int e, int fi) {
    double result;
    int k = 1;
    while (true) {
        result = (1 + (k * fi)) / (double) e;
        if ((Math.Round(result, 5) % 1) == 0) {
            //integer 
            return (int)result;
        } else {
            k++;
        }
    }
}

let's test this code:

Assert.AreEqual(Helper.MultiplicativeInverse(3, 9167368), 6111579); // passed

Calculate d from n, e, p, q in RSA?

3 Answers3

Linked