Can an RSA OpenSSL key generated with C/C++ be decrypted with PHP?

Question

In a number of situations security software involves the interaction between (desktop) applications and web interfaces. For (RSA) asymmetric encryption we use the C library of OpenSSL (version 1.0.2d at present) and we use the openssl PHP library .

All the standard stuff:

private encrypt (C++) data and public decrypt (PHP)
public encrypt (C++) data and private decrypt (PHP)

works. And also the other way around: PHP -> C++ and C++ -> PHP

In addition generating an encrypted private key with PHP and decrypting that key with C/C++ also works. But not the other way around: I want to decrypt with PHP a private key that is generated and encrypted with C++. Note: this is different from encrypting/decrypting data with the keys.

The problem seems to be the way C OpenSSL encrypts a private key. It is not enough to know the algorithm with which the key is encrypted (aes-256-cbc in our case). The password is also stretched. The way the key is encrypted by OpenSSL has changed over time. I will give an example how it looks now.

Part of the the header of the private key generated with OpenSSL C/C++ looks like:

-----BEGIN ENCRYPTED PRIVATE KEY-----
MIISnzBJBgkqhkiG9w0BBQ0wPDAbBgkqhkiG9w0BBQwwDgQI/epYUO8+LygCAggA

Whereas part of the header of a pem-encoded private key generated with openssl PHP looks like:

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,372DA3A61BEB36AA

bc9NsTtdfcMW9t9isDPgl86aME223ockk9pIGDduEyrTS7zh1gwHWSWnD2efbxLd

I have tried to use some PHP extensions, like phpseclib , but I still cannot use a private key generated with C OpenSSL in PHP programs. The public keys are not encrypted and they can be exchanged between the two languages without any problem.

For generating RSA keys with C OpenSSL we use the EVP_PKEY structure.

Edited by author on August 12, 2015

In reply to neubert I have generated an encrypted private RSA key with the OpenSSL utility "openssl genpkey":

OpenSSL> genpkey -algorithm RSA -out c:\temp\test512.pem -aes-256-cbc -pass pass:1234 -pkeyopt rsa_keygen_bits:512

So key length is 512 bits and password "1234".

To get the unencrypted form of the key I used "openssl pkey":

OpenSSL> pkey -in c:\temp\test512.pem  -out c:\temp\test512naked.pem

Note on Windows the openssl executable is called "openssl.exe".

Here are the keys:

and

Answer 1

The -----BEGIN ENCRYPTED PRIVATE KEY----- key is PKCS8 encoded. The symmetric cipher being used (and the IV) is embedded in the key. phpseclib currently only supports pbeWithMD5AndDES-CBC. The pbe part means that it's using PBKDF1. Maybe that's what your key is using, too, hard to say.

Basically, if you can generate another identical key and post it - along with the password to unlock it - that'd be helpful. I can add support to that cipher / pbkdf to phpseclib.

If you want to try modifying phpseclib yourself feel free to do so. Check the following switch statement:

https://github.com/phpseclib/phpseclib/blob/1.0.0/phpseclib/Crypt/RSA.php#L1225

But like I said, tho - I can do it too - I just need you to provide the key (or an identically formatted one!)

Can an RSA OpenSSL key generated with C/C++ be decrypted with PHP?

Question

1 answers

solution1
1 2015-08-07 15:08:20

Can an RSA OpenSSL key generated with C/C++ be decrypted with PHP?

Question

1 answers

solution1 1 2015-08-07 15:08:20

solution1
1 2015-08-07 15:08:20