RSA given d and d = p Assume we have a somehow unorthodox implementation of RSA whereby:

$p$ and $q$ are chosen primes of length $n/2$ where $n$ is the number of bits desired in $N=p\,q$ and
$$\begin{align}
\phi &amp;= (p-1)(q-1)\\
d &amp;= p\\
e &amp;= d^{-1}\bmod \phi
\end{align}$$

I can see that there is a weakness here but I'm unsure of how it translates. Playing around a bit I see that I end up with:

$$e = \frac{\phi j + 1}p $$

Further assuming that $\frac{1}p$ can be considered infinitesimal:
$$e ≈ j\left(q\left(1+\frac{1}p\right) -1\right)$$

So basically:
$$e ≈ j(q-1)$$

Is that right? Am I missing something?
Yes, it's broken.  Here is the approach I see:

$$p = \text{gcd}( n, r^e - r \bmod n)$$

with quite high probability, for random $r$.

This happens because $e \equiv 1 \bmod p-1$, and hence $r^e \equiv r \pmod p$ (for any $r$).  It is unlikely that $r^e \equiv r \pmod q$, and hence $r^e - r$ has $p$ as a factor, but (probably) doesn't have $q$.