# Use cases and implementations of RSA CRT

I discovered the chinese remainder theorem (CRT) version of RSA cryptosystem which is used in many crypto libraries (OpenSSL, Java...).

The use of this theorem improves the speed of decryption so, why is it not always applied? What are the disadvantages of this version which would explain that it's not always implemented?

The following potential reasons occur to me why someone might not choose to use the CRT optimization:

• The implementor worries about induced faults (but not quite enough to implement the obvious protection against it). That is, with the CRT optimization, we process the RSA block both mod p and mod q separately, and then combine them. That means that if the attacker can induce a miscomputation in one of the sides, we'll get the correct answer mod p (say), but not mod q. This can leak the factorization of the modulus

• The CRT optimization requires us to hold the prime factors; perhaps the implementer has restrictions on the amount of memory that can be used for a private key. Note that it's possible to factor the modulus anyways if you have both the public and private keys, and so security isn't likely to be an issue here.

• More reasons, especially in Smart Cards: $\;$ a) It is slightly involved to derive the CRT key $(p,q,dp,dp,qInv)$ from $(n,d)$, which may be the specified form for key injection. $\;$ b) If all we know is that the key is per PKCS#1 and $N$ is $k$-bit, $p$ might still be much more than $k/2$ bits, so perhaps for some keys it does not fit the available hardware well and CRT gives no time savings. $\;$ c) As mentioned in answer, the CRT form of the key requires more space, about +75% more since $(N,e)$ needs to be available in order to check the result as a countermeasure against fault attacks. – fgrieu Oct 25 '14 at 15:49