The problem illustrates a simple application of the chosen ciphertext attack. Bob intercepts a ciphertext \(C\) intended for Alice and encrypted with Alice's public key \(e\). Bob wants to obtain the original message \(M=C^{d} \bmod n\). Bob chooses a random value \(r\) less than \(n\) and computes

Next, Bob gets Alice to authenticate (sign) \(X\) with her private key, thereby decrypting \(X\). Alice returns \(Y=X^{d} \bmod n\). Show how Bob can use the information now available to him to determine \(M\).

Z = r mod n X=ZC mod n -1 t=r mod n