[contravariant]

Well, obviously something went wrong. But the way I understand it RSA shouldn't work at all if you used a composite factor, decrypting a message will just give a wrong result.

Unless, by some incredible fluke, they managed to find a carmichael number.

[dfox]

RSA without CRT optimization of private operations will work regardless of how many factors modulus has, if key was generated correctly. With "correctly" meaning using correct value of phi(n), which is not (p-1)*(q-1) when either of p or q are composite (which in effect means that it will not work at all with essentially all interesting implementations).

IIRC PKCS#1 even supports more than two modulus factors in it's private key format (not that it is particularly useful for anything).