What is a double signature by multiplicative splitting of the secret exponent, and what problem does it solve?
The signing key $d$ is factored into two shares $d_1$ and $d_2$ with $d \equiv d_1 \cdot d_2 \pmod{\varphi(N)}$, so a valid signature exists only if both holders sign in turn — neither party can sign alone, like a safe needing two keys.
* The shares multiply in the exponent, so signing is sequential: Partner 2 raises Partner 1's partial signature to d2, landing on m^d. *
Some documents — an employment contract is the classic example — should only count as signed once two distinct parties have signed. RSA can enforce this by never giving either party the whole private exponent. A trusted third party splits $d$ multiplicatively into $d_1$ and $d_2$ (so $d \equiv d_1 \cdot d_2 \bmod \varphi(N)$) and hands one share to each signer; nobody ever holds $d$ itself.
Signing is then sequential, because the shares multiply in the exponent:
- Party 1 produces a partial signature $s_1 \equiv m^{d_1} \bmod N$.
- Party 2 finishes it: $s \equiv s_1^{d_2} \equiv m^{d_1 \cdot d_2} \equiv m^d \bmod N$.
The result is an ordinary RSA signature, so anyone verifies it the normal way with $m \equiv s^e \bmod N$ — verifiers need not even know it was produced jointly. This works thanks to RSA's multiplicative homomorphism in the exponent: raising $m^{d_1}$ to $d_2$ adds the exponents' product, landing exactly on $m^d$. The catch, and the reason a trusted third party is unavoidable, is that the shares cannot be generated independently: splitting $d$ requires knowing $d$, and recovering the second share from the first ($d_2 \equiv d \cdot d_1^{-1} \bmod \varphi(N)$) needs $d$ as well. A share on its own leaks nothing about $d$, which is what keeps the scheme secure.
Go deeper:
Threshold cryptosystem — the general "split the key so k of n parties must cooperate to sign" family this two-party split belongs to.