pub fn factor_via_private_exponent(
n: &BigInt,
e: &BigInt,
d: &BigInt,
) -> Option<(BigInt, BigInt)>Expand description
Factor N from the RSA private exponent d (Miller’s deterministic reduction). Since e·d − 1 is a
multiple of λ(N), writing it as t·2ˢ and raising a base g to t·2ⁱ walks a chain that ends at
1; a step where the value squares to 1 while itself being ≠ ±1 is a NONTRIVIAL square root of
unity, and gcd(x − 1, N) splits N. This is the converse of rsa_private_exponent: it proves
that recovering the private key is computationally equivalent to factoring the modulus — the two
are one problem, so RSA breaks exactly when N factors. Returns (p, q) or None (no base worked).