Consider an RSA cryptosystem with two public keys (n,e) and (n,f) such that gcd(e, f ) = 1. Suppose that a plaintext M is encrypted twice using these keys:

the ciphertext obtained with (n, e) is Ce = M e mod n;

the ciphertext obtained with (n,f) is Cf = Mf mod n.

Then M can be recovered from Ce and Cf. How? Hint. Since gcd(e,f) = 1, there are B ezout coefficients x and y such that ex + f y = 1.