Recall that in RSA, for *n = pq*, the private exponent *d* is chosen such that

$$ed\equiv1\pmod{\text{lcm}(p-1,q-1)}$$

i.e. for some integer *k*,

$$ed=1+k(p-1)(q-1)$$

Thus,

$$ed_a-1=k_a(p-1)(q-1)$$
$$ed_b-1=k_b(p-1)(r-1)$$

**[Read the full writeup](https://zeyu2001.gitbook.io/ctfs/2021/zh3ro-ctf-v2/alice_bob_dave)**

Original writeup (https://zeyu2001.gitbook.io/ctfs/2021/zh3ro-ctf-v2/alice_bob_dave).