Exercise 1: Trapdoor Functions and RSA's Direction of Difficulty — Possible Solution
====================================================================

A trapdoor function is a function that is easy to compute in one
direction for anyone, but computationally infeasible to reverse for
anyone WITHOUT a specific secret piece of information -- the
"trapdoor" -- while being easy to reverse for anyone who DOES have
it. The public key effectively publishes the easy forward direction
to the whole world; the private key is the trapdoor that makes the
otherwise-infeasible reverse direction tractable for its owner alone.

Why RSA specifically needs multiplication-easy/factoring-hard, not the
reverse:

For a trapdoor function to be useful, the FORWARD direction (the one
anyone with just the public key needs to perform -- encrypting data,
or verifying a signature) must be fast and practical for everyone,
including someone with no special knowledge at all. The REVERSE
direction (decrypting, or forging a signature) must be infeasible for
everyone EXCEPT whoever holds the trapdoor.

Multiplying two large primes together is fast and simple -- exactly
the property needed for the PUBLIC, forward-facing operation that
everyone (including attackers) needs to be able to do easily just to
use the system at all (in RSA's case, generating the public modulus
in the first place, and the modular exponentiation operations built on
top of it). Factoring that product back into its two original primes,
by contrast, has no known efficient general algorithm once the primes
are large enough -- exactly the property needed for the operation only
the key's legitimate owner (who already knows the two factors, because
they generated them) can perform efficiently.

If the difficulty ran the OTHER way -- if multiplying were hard and
factoring were easy -- the system wouldn't work at all: generating a
key pair in the first place would itself be computationally
infeasible for the legitimate owner, while an attacker would find
reversing the operation just as easy as everyone else, defeating the
entire point of a trapdoor.

WHY THIS WORKS AS AN ANSWER
------------------------------
This connects the chapter's abstract trapdoor-function definition
directly to WHY RSA's specific asymmetry (easy multiply, hard factor)
is the correct shape for a trapdoor rather than an arbitrary choice --
the direction of difficulty has to match which party (everyone, vs.
only the key owner) needs which operation to be fast, which the
chapter's own public-key/private-key breakdown implies but doesn't
spell out explicitly.