RSA figuring out the recipient of a ciphertext I have this question I am trying to figure out the answer about RSA. I'd be grateful if someone could actually help me understand how the procedure would work. I am new to cryptography and with all the maths in it, I am barely understanding it.

Assuming that we have a sender A and 2 recipients B and C. This sender wants to send 12 messages.

If A wants to send to B he'd use B's public key $(n_B,e_B)$. Meaning:
$$\text{ciphertext}_i = (\text{plaintext}_i)^{e_B} \bmod n_B$$

If A wants to send to C he'd use C's public key $(n_C,e_C)$. Meaning:
$$\text{ciphertext}_i = (\text{plaintext}_i)^{e_C} \bmod n_C$$

An attacker gets the 12 ciphertexts A encrypted. He also knows the public key of B and C.

How can he determine whether A sent her messages to B or C?
First, we'll assume that $n_B &gt; n_C$, and we'll assume that he has no knowledge of the plaintext messages (which, if $A$ uses randomized padding, which he ought, is an appropriate assumption, even if the adversary knows the text of the message).

Then, if any of the 12 messages $\mathit{ciphertext}_i \ge n_C$, then he knows that message cannot be to $n_C$ (because the result of the RSA encryption process is always an integer less then the modulus.  Hence, if all messages were to the same endpoint, then they all must be to $B$.

In contrast, if all 12 messages $\mathit{ciphertext}_i &lt; C$, then it is possible that the messages were to either, however it is somewhat more plausible that there were to $C$, because of the possibility that, if there were to $B$, that fact would be leaked above.

Now, we can actually estimate the probability that the messages were actually towards $B$, but that fact wasn't leaked; RSA encrypted messages can be modeled as random values between $0$ and the modulus size.  Hence, the probability that all 12 encrypted messages happen to be $&lt; n_C$ is approximately $(1 - n_C/n_B)^{12}$; how large that is depends on the relative magnitude of the two modulii.