Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The ASN.1 spec for the PKCS1 RSA private key format is as follows:

RSAPrivateKey ::= SEQUENCE {
    version           Version,
    modulus           INTEGER,  -- n
    publicExponent    INTEGER,  -- e
    privateExponent   INTEGER,  -- d
    prime1            INTEGER,  -- p
    prime2            INTEGER,  -- q
    exponent1         INTEGER,  -- d mod (p-1)
    exponent2         INTEGER,  -- d mod (q-1)
    coefficient       INTEGER,  -- (inverse of q) mod p
    otherPrimeInfos   OtherPrimeInfos OPTIONAL

As far as I understand, only the modulus and public exponent are required for encryption, and only the modulus and private exponent are required for decryption. Why does the key file contain all these additional fields and what are they used for?

share|improve this question
The text "only the modulus and public exponent is required for encryption" is correct, but has nothing to do with the rest of the question: the party doing encryption does not use or know the RSAPrivateKey. – fgrieu Jan 24 '12 at 17:13
up vote 12 down vote accepted

It has to do with optimizing RSA.

It turns out that using the Chinese Remainder Theorem with $p$, $q$, $d\pmod{p-1}$, and $d\pmod{q-1}$ (i.e., prime1, prime2, exponent1, exponent2 from the data structure in the question) to run the decryption operation faster than if you only had $d,n$.

For more information on how it is done, I found this reference

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.