Relevant excerpt from stackexchange answer [1]: Some (Undesirable) Properties of Textbook RSA: It is malleable. I.e., if you give me a ciphertext 𝑐 which enc

Relevant excerpt from stackexchange answer [1]: Some (Undesirable) Properties of Textbook RSA: It is malleable. I.e., if you give me a ciphertext 𝑐 which encrypts 𝑚, I can compute 𝑐′≡𝑐⋅2𝑒mod𝑛. When the owner of the private key decrypts 𝑐′, she will get 2𝑚mod𝑛. In other words, I can make predictable changes to ciphertexts. It is deterministic, and thus not semantically secure. I.e., I can distinguish between the encryptions of 0 and 1 (simply by encrypting both values myself and comparing the ciphertexts). Differences with Deployed RSA: Padding Chinese Remainder Theorem is sometimes used in deployed systems for more efficient decryption. 𝑒 is often statically set to 65537=2^16+1 for encryption speed (since there are only two set bits in that number). Side-channel attack mitigations can be put in place for deployed systems too. [1] https://crypto.stackexchange.com/a/1449 https://crypto.stackexchange.com/a/1449