RSA-CRT

from Crypto.Util.number import getPrime, getRandomRange
from ptrlib import crt

p = getPrime(512)
q = getPrime(512)

e = 65537
n = p * q

m = getRandomRange(0, n)
c = pow(m, e, n)

# decrypt by rsa-crt
d_p = pow(e, -1, p-1)
d_q = pow(e, -1, q-1)
m_p = pow(c, d_p, p)
m_q = pow(c, d_q, q)

assert m == crt([(m_p, p), (m_q, q)])[0]

RSA-CRTのパラメータ同士の関係

 ed_p = 1 + k_p(p-1), k_p < e

 ed_q = 1 + k_q(q-1), k_q < e

 (ed_p - 1 + k_p)(ed_q - 1 - k_q) = k_pk_qN \leftrightarrow (k_p-1)(k_q-1) \equiv k_pk_qN \mod e

 (ed_p - 1)(ed_q - 1) = k_p(p-1)k_q(q-1)

 k \equiv -k_pk_q \mod e

 p = gcd((ed_p - 1)/k_p+1, N)

 p = gcd(a^{ed_p-1}-1, N)