# Nick Szabo - Contracts With Bearer (Highlights)  ## Highlights - We can check that the blind signature property holds: `gSf(m) = (m(ke))d * k-1 = md * k * k-1 = md`, which is the valid RSA signature of private key d on m. ([View Highlight](https://read.readwise.io/read/01kb06ebb9avcg3ygqxp3vbxsa)) ^961114591 Because of how the RSA exponents are chosen and how arithmetic modulo $n$ works. In RSA, you pick $n = pq$ (where $p$ and $q$ are distinct primes) and choose integers $e$ and $d$ such that $ed \equiv 1 \pmod{\varphi(n)}, \quad \text{where } \varphi(n) = (p-1)(q-1).$ This means there exists an integer $t$ such that $ed = 1 + t\varphi(n).$ For any message $k$ that is coprime to $n$, $k^{ed} = k^{\,1 + t\varphi(n)} = k \cdot \left(k^{\varphi(n)}\right)^t.$ By [[Euler's theorem]], since $\gcd(k, n) = 1$, we have $k^{\varphi(n)} \equiv 1 \pmod{n},$ so $k^{ed} \equiv k \cdot 1^t \equiv k \pmod{n}.$ Thus, modulo $n$, raising a message to the power $e$ (encryption) and then to the power $d$ (decryption) recovers the original message $k$.