RSA Restore Private Exponent

RSA Restore Private Exponent is a one-line piece of arithmetic wearing a node costume: given the public exponent e and the two primes p and q, it computes d. That's the missing piece when you've factored a modulus but the puzzle still wants a private key.

The scenario

Classic RSA break, in three moves. You have n and e. You factor n - maybe it was sloppily generated, maybe a challenge handed you one prime. Now you have p and q and you still can't decrypt, because decryption needs d, the modular inverse of e modulo λ(n).

Computing it by hand is a text editor and a bad time. This node is the shortcut, and it's part of AzelusLightvale's ComfyUI ARG Toolkit (ARG Toolkit/Cryptography/Modern/Asymmetric) - the pack that treats ComfyUI as a crypto workbench for ARG puzzles rather than just an image pipeline.

Mechanism

The whole implementation:

return (rsa.rsa_recover_private_exponent(public_exponent, var_p, var_q),)

That's pyca's cryptography doing the work. Internally it's the modular inverse of e modulo the Carmichael function of n, computed as lcm(p-1, q-1) - which gives the same decryption results as the textbook φ(n) = (p-1)(q-1) but yields a smaller d, and every modern implementation uses it. For e = 65537 and standard primes it's fast enough that you'll never notice it running.

What the function does not do is check your work. It doesn't verify that p and q are prime, or that their product is the modulus you actually care about. It just does the inverse with whatever you handed it, and if e and lcm(p-1, q-1) aren't coprime, pyca raises rather than returning something bogus - that's your one automatic safety net.

Inputs and output

Three integer widgets: public_exponent (default 65537 - correct), var_p and var_q (the two primes, defaulting to 1, which is a placeholder and will never produce a usable result). Out comes a single output, d.

All three inputs are widgets capped at 4,294,967,296. Which is the thing to be upfront about: those caps are 32-bit, and real RSA primes are hundreds of digits. So this node is practical for small educational keys and for values arriving over wires from RSA Private Numbers Values or RSA Restore Prime Factors; it is not a place you'll type a 1024-bit prime, because you can't.

Where does the output go? Straight into RSA Private Numbers into Key's private_exponent socket, which is how you finish the rebuild - you'll need the public numbers container for that node too. At that point you have a working private key and RSA Decrypt Data will accept it.

A worked chain

Factor recovery in this pack looks like this, and it's worth seeing once:

RSA Public Numbers into Key  → public_numbers ─┐
                                               ├→ RSA Private Numbers into Key → (key object)
RSA Restore Prime Factors → p, q ──────────────┤
RSA Restore Private Exponent (e, p, q) → d ────┘

You'd use whatever gave you p and q - this node, or the factor-recovery one, or a clue you typed in. The point is that the whole family speaks INT and NUMOBJ, so chaining them is just wires.

Install

Manager → ComfyUI ARG Toolkit → install → restart → refresh the browser. Manual:

cd ComfyUI/custom_nodes
git clone https://github.com/AzelusLightvale/ComfyUI-ARG-Toolkit
pip install -r requirements.txt

No models. The only library that matters here is cryptography. Do read requirements.txt before a manual install, though - it's a full uv lock that pins torch and torchaudio next to the crypto libraries, so pip install -r can quietly replace your CUDA torch build with a different one. Manager is the safer install; if you go manual, check that CUDA still works afterwards.

Common issues

ValueError from the modular inverse. e shares a factor with lcm(p-1, q-1). In practice that means p or q is wrong, or isn't prime, or is 1 because you never edited the default.

It computes a d, but the key I built doesn't decrypt. d is only correct for the (p, q) you gave it. If you factored one modulus and are rebuilding against a different public_numbers container, the mismatch surfaces later as a validation error or a failed decryption, not here. This node has no way to know.

Numbers truncated on entry. The 32-bit widget cap again. Feed them from wires.

The pack is young, single-author and barely discussed publicly, so you're not going to find a Stack Overflow answer for an odd error - reading the source is quicker, and it's about fifteen lines long.