# Why does the PKCS1 RSA private key structure contain more than just exponent and modulus?

The ASN.1 spec for the PKCS1 RSA private key format is as follows:

RSAPrivateKey ::= SEQUENCE {
version           Version,
modulus           INTEGER,  -- n
publicExponent    INTEGER,  -- e
privateExponent   INTEGER,  -- d
prime1            INTEGER,  -- p
prime2            INTEGER,  -- q
exponent1         INTEGER,  -- d mod (p-1)
exponent2         INTEGER,  -- d mod (q-1)
coefficient       INTEGER,  -- (inverse of q) mod p
otherPrimeInfos   OtherPrimeInfos OPTIONAL
}


As far as I understand, only the modulus and public exponent are required for encryption, and only the modulus and private exponent are required for decryption. Why does the key file contain all these additional fields and what are they used for?

-
The text "only the modulus and public exponent is required for encryption" is correct, but has nothing to do with the rest of the question: the party doing encryption does not use or know the RSAPrivateKey. – fgrieu Jan 24 '12 at 17:13

It turns out that using the Chinese Remainder Theorem with $p$, $q$, $d\pmod{p-1}$, and $d\pmod{q-1}$ (i.e., prime1, prime2, exponent1, exponent2 from the data structure in the question) to run the decryption operation faster than if you only had $d,n$.