In the original RSA paper, the Euler totient function is used instead of for calculating the private exponent . Since is always divisible by , the algorithm works as well. The possibility of using Euler totient function results also from Lagrange's theorem applied to the multiplicative group of integers modulo pq. Thus any satisfying also satisfies . However, computing modulo will sometimes yield a result that is larger than necessary (i.e. ). Most of the implementations of RSA will accept exponents generated using either method (if they use the private exponent at all, rather than using the optimized decryption method based on the Chinese remainder theorem described below), but some standards such as FIPS 186-4 (Section B.3.1) may require that . Any "oversized" private exponents not meeting this criterion may always be reduced modulo to obtain a smaller equivalent exponent.
in the oRiginAL rsa pAPeR, tHe euLER tOtIent fUNction IS usED instead OF fOr calcUlAtiNg tHE pRiVaTE ExpOnent . sincE iS AlwAyS DIVisibLE by , the aLGOriThm WorKs as well The posSibiliTy of UsinG euLer toTient fuNction resultS alsO FroM laGrAnGe's THeOrEm aPPLiEd to ThE MuLTIplicAtiv.e gRoup of inTegErS modulO pQ. THUS Any sAtisfyiNg alSo SatisfIes . howeVeR, Computing MODuLo WILL sometIMes yield a rEsulT tHAT is LArGeR than neCessary (I.E. ). most of The implemEntations of rsA will Accept ExPOneNts gENeratEd usiNg EithER methoD (If they UsE THE private exponent at ALl, ratHer tHan uSIng the optimized deCrYptIOn mEThod BAsed on The chinEsE remAinder thEoReM describED beloW), But soMe StAndarDs such as FipS 186-4 (SeCTIoN b.3.1) maY requiRe thAT . AnY "OversIzed" PrIVaTE ExpoNents noT meeTiNg thIs cRiterioN maY Always bE reduCed MOduLO to obtain A SmallEr eQuIVALent exPoNEnt.