RSA Toy Cipher (Educational) mechanism

Model scope

The honest-label warning is appropriate and should remain prominent. Verdict is NEEDS_REVIEW because the exact input constraints, invalid-input behavior, and arithmetic type are unspecified; the stated RSA formulas are correct under the listed assumptions.

• The core RSA formulas are standard, but the specification does not require p and q to be distinct primes; if p=q, φ(n)=(p-1)(q-1) is generally incorrect for n=pq.
• The specification does not state the required domain 0≤m<n for the message representative.
• The specification says to choose e coprime to φ(n) but does not require an explicit validation that gcd(e,φ(n))=1 before computing d.
• The modular inverse d=e⁻¹ mod φ(n) is undefined when gcd(e,φ(n))≠1, and the specification does not define the error behavior.
• The phrase “BigInt-safe primes (<2^20)” is ambiguous: primes below 2^20 are not sufficient for ordinary JavaScript Number arithmetic during modular multiplication, although they are safe as BigInt operands.

Units and conventions

• p, q, e, m, n, φ(n), d, and ciphertext are dimensionless integers; RSA has no physical units or unit conversions.
• p and q are assumed positive prime integers, distinct from each other.
• e is assumed to be an integer with 1<e<φ(n) and gcd(e,φ(n))=1.
• The message is assumed to be an integer representative satisfying 0≤m<n.
• All modular arithmetic is assumed to use exact integer arithmetic, preferably JavaScript BigInt rather than Number.

Inspectable vector

One of 4 source-bound review vectors:

{
  "inputs": {
    "p": 5,
    "q": 11,
    "e": 3,
    "message": 7
  },
  "expected_outputs": {
    "n": 55,
    "phi": 40,
    "d": 27,
    "ciphertext": 13,
    "decrypted_plaintext": 7
  },
  "working": "n=p·q=5·11=55. φ(n)=(5-1)(11-1)=4·10=40. gcd(3,40)=1. Find d: 3·27=81=2·40+1, so d=27. Encryption: c=7^3 mod 55. 7^2=49, 7^3=49·7=343=6·55+13, so c=13. Decryption: 13^2=169 mod55=4; 13^4=4^2=16; 13^8=16^2=256 mod55=36; 13^16=36^2=1296 mod55=31. Since 27=16+8+2+1, 13^27 mod55=((31·36 mod55)·4 mod55)·13 mod55=(16·4 mod55)·13 mod55=9·13 mod55=117 mod55=7."
}

Failure boundary

BREAK_CLAIMED · SELF_FLAGGED

Invalid exponents can produce an undefined private exponent, so the instrument must reject e values with gcd(e,φ(n))≠1. Inputs at or beyond the canonical message boundary can also silently lose information: message 15 encrypts and decrypts to 0 modulo 15. Negative-message handling is convention-dependent and can expose a mismatch between residue output 14 and signed plaintext −1.

Other records

Sources and evidence

These pointers bind the page to evidence. They do not grant authority or collapse verification into deployment.

• VERIFIED_LEDGER.json
• evidence-tranche4/tranche4-results.json
• BOUNDARY_HAZARD_CATALOG.json