compact rsa private key format

Question

As shown in Why does my SSH private key still work after changing some bytes in the file? a typical RSA private key file contains.

• The public modulus $n$ and exponent $e$;
• The private exponent $d$;
• The prime factors $p$ and $q$ of $n$;
• The "reduced" private exponents $d_p=d\bmod(p-1)$ and $d_q=d\bmod(q-1)$;
• The "CRT coefficient" $q_{\text{inv}}=q^{-1}\bmod p$.

Looking at his annotated file I see

• $e$ is negligible in size
• $d$ is roughly the same size as $n$
• $p$ and $q$ are each half the size of $n$
• $d_p$ and $d_q$ are similar in size to $p$ and $q$
• $q_{\text{inv}}$ is roughly the same size is $q$

Overall the parameters stored in the file seem to be just over 4.5 times the size of $m$.

From the RSA key generation process we can clearly see that all you really need to store are $p$, $q$, and $e$. All the other parameters can be derived from them. This results in a keyfile that is only slightly larger than $m$.

Now for the question:

Has anyone specified a format for storing such a "compact" private key and/or produced tools for converting between compact and regular keys?

Answer 1

In some ways, PuTTY's private key format is more concise as it doesn't include the "reduced" private exponents. BUT, because it includes the OpenSSH formatted public key, it basically has the modulo twice. See this URL for details.

Beyond that I don't think there's any standardized / widely used format that format stores keys in the way that you're proposing. Not MSBLOB, not PKCS1, not PKCS8 (which, for RSA, is basically a wrapper for PKCS1) and not XKMS. If there's a widely used RSA private key format that I missed lmk but of the ones I know about none support the kind of minimalist key you're describing.