3

The RSA private key contains 2 primes (of about 4096 bits each), and I only know their product (called modulus) and the modular inverse (called coefficient).

How do I recover the RSA primes from the modulus and the coefficient, i.e. how do I implement get_primes below?

def get_modulus_and_coefficient(prime1, prime2):
  assert prime1 > prime2
  coefficient = modinv(prime2, prime1)  # Modular inverse of prime2 modulo prime1.
  assert coefficient * prime2 % prime1 == 1
  modulus = prime1 * prime2
  return modulus, coefficient

def get_primes(modulus, coefficient):
  ... prime1, prime2 = ...
  assert get_modulus_and_coefficient(prime1, prime2) == (modulus, coefficient)
  return prime1, prime2

Is there a well known-recovery method published for this?

FYI This question is different from https://crypto.stackexchange.com/a/25910 . The other question asks for recovery of the primes $p_1$ and $p_2$ from $n$, $e$, $d$. This question asks for recovery of the primes $p_1$ and $p_2$ from $n$ and $q_\mathrm{inv}=p_2^{-1}\mod p_1$. The answer for the other question doesn't help at all with this question.

pts
  • 223
  • 1
  • 8
  • Do you have any background for this problem? The quantity $p_2^{-1}\bmod p_1$ is rather atypical to show up in RSA. – Mark Schultz-Wu Apr 25 '20 at 04:03
  • @Mark: Wikipedia has coefficient as $q_\mathrm{inv}$, and explains how it is useful: https://en.wikipedia.org/wiki/RSA_(cryptosystem)#Example . openssl rsa -text also shows that coefficient is one of the numbers in PEM and DER files. It's also part of GPG private keys, as u in https://tools.ietf.org/html/rfc4880#section-5.5.3 . – pts Apr 25 '20 at 09:09
  • @Mark: There is no specific cryptanalysis project I need this for, I'm just curious. I'm inspired by https://gist.github.com/flavienbwk/54671449419e1576c2708c9a3a711d78 and https://www.kangacrypt.info/files/NH.pdf and https://eprint.iacr.org/2004/147.pdf , which indicate that the primes can be recovered from other RSA private key fields. Why not coefficient then? – pts Apr 25 '20 at 09:16

0 Answers0