The ASN.1 spec for the PKCS1 RSA private key format is as follows:

RSAPrivateKey ::= SEQUENCE {
    version           Version,
    modulus           INTEGER,  -- n
    publicExponent    INTEGER,  -- e
    privateExponent   INTEGER,  -- d
    prime1            INTEGER,  -- p
    prime2            INTEGER,  -- q
    exponent1         INTEGER,  -- d mod (p-1)
    exponent2         INTEGER,  -- d mod (q-1)
    coefficient       INTEGER,  -- (inverse of q) mod p
    otherPrimeInfos   OtherPrimeInfos OPTIONAL

As far as I understand, only the modulus and public exponent are required for encryption, and only the modulus and private exponent are required for decryption. Why does the key file contain all these additional fields and what are they used for?

  • $\begingroup$ The text "only the modulus and public exponent is required for encryption" is correct, but has nothing to do with the rest of the question: the party doing encryption does not use or know the RSAPrivateKey. $\endgroup$
    – fgrieu
    Jan 24, 2012 at 17:13

1 Answer 1


It has to do with optimizing RSA.

It turns out that using the Chinese Remainder Theorem with $p$, $q$, $d\pmod{p-1}$, and $d\pmod{q-1}$ (i.e., prime1, prime2, exponent1, exponent2 from the data structure in the question) to run the decryption operation faster than if you only had $d,n$.

For more information on how it is done, I found this reference http://www.di-mgt.com.au/crt_rsa.html


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.