Recall that in RSA, for *n = pq*, the private exponent *d* is chosen such that
$$ed\equiv1\pmod{\text{lcm}(p-1,q-1)}$$
i.e. for some integer *k*,
$$ed=1+k(p-1)(q-1)$$
Thus,
$$ed_a-1=k_a(p-1)(q-1)$$$$ed_b-1=k_b(p-1)(r-1)$$
**[Read the full writeup](https://zeyu2001.gitbook.io/ctfs/2021/zh3ro-ctf-v2/alice_bob_dave)**