node-rsa and openssl compatibility

Question

I have a set of public/private keys, that works flawless when encrypting/decrypting some data using only one of the 2 ways for both encryption and decryption.

I still have no luck trying to encrypt the data with the one of the two and decrypt it with the other.

Example schenario:

a) I create some encrypted data using the public key with the following node.js code:

#!/usr/bin/env node

var NodeRSA = require('node-rsa');
var fs = require('fs');

function createUsingPubKey(Pub, data) {
    var pk = new NodeRSA();
    pk.importKey(Pub);
    encrypted = pk.encrypt(data, 'base64');
    return encrypted;
}

var sampledata = "SECRET STUFF";

var genkey = createUsingPubKey(fs.readFileSync('id_rsa.pub'), sampledata)
console.log(genkey);

b) Then i try to decrypt it using openssl utility with this:

node test.js | openssl base64 -d -A | openssl rsautl -inkey id_rsa

But i get:

RSA operation error
1068:error:0406706C:rsa routines:RSA_EAY_PUBLIC_DECRYPT:data greater than mod len:.\crypto\rsa\rsa_eay.c:680:

I thought that they probably would use different algorithms for the encryption/decryption procedure so i headed to the node-rsa documentation here: https://www.npmjs.com/package/node-rsa and i found this option:

encryptionScheme — padding scheme for encrypt/decrypt. Can be 'pkcs1_oaep' or 'pkcs1'. Default 'pkcs1_oaep'.

I then tried to decrypt passing the -oaep option in openssl util like this:

node test.js | openssl base64 -d -A | openssl rsautl -oaep -inkey id_rsa

But i still get:

RSA operation error
5216:error:0406706C:rsa routines:RSA_EAY_PUBLIC_DECRYPT:data greater than mod len:.\crypto\rsa\rsa_eay.c:680:

My knowledge on cryptography is really basic. Any help would be appreciated :)

EDIT 1: The node.js module can be found here: https://github.com/rzcoder/node-rsa

EDIT 2: As Maarten Bodewes requested, here is some sample data:

Plaintext data to be encrypted:

You're no good, you're no good, you're no good Baby, you're no good (I'm gonna say it again) You're no good, you're no good, you're no good Baby, you're no good

A private key generated with

openssl genrsa -out key 512

-----BEGIN RSA PRIVATE KEY-----
MIIBOgIBAAJBALOUBygyX11BsDoEIKoZzn2/HAXPorNR/X8wCDaBlcPtOHxKAZFk
Vra1+Pem1urtSlnEqc07DwAP6v0GEGHpxbkCAwEAAQJAGAZ17qrOl2tyaFClDhzl
w20OErj0y4jsoVeLwb8UimG48JslS14hfM9XxE/fG6qypN8u7LUhlnBC68ZcQ9Jg
AQIhAORaVlB7trWp6n7dETvdY9J2p8ubOuyLTX0BA2jF8agxAiEAyVHzDWQPWx/s
gt+ABErqN+ZUWS016DD34QUVGyp9nAkCIQC39JpSDcd7gx1YA8jNXCT9N/8mg6+t
PO84g2d2sPdjEQIgXwWMF/TzfopJ4tfFH8GQXYQcqd66A/cg+Jeih6j9kqkCIGD4
hBAO0haqnqeSO65Mm1IjY/6Z77pKxzJAGys5XeXk
-----END RSA PRIVATE KEY-----

And its equivalent pub key

openssl rsa -in key -pubout > key.pub

-----BEGIN PUBLIC KEY-----
MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALOUBygyX11BsDoEIKoZzn2/HAXPorNR
/X8wCDaBlcPtOHxKAZFkVra1+Pem1urtSlnEqc07DwAP6v0GEGHpxbkCAwEAAQ==
-----END PUBLIC KEY-----

The above plaintext data encrypted with the given public key using the node.js rsa library:

nbp1tBlcev9PvD3xDmEQkcBd8ewNxW8Xm7oZWVcsFika3dU/H3VFoxdeH75DPy4/xLvN1Gxqfb/bXTnfKZLZBYV1q4XfmR4p3ji41MAybpMiEl5h4fSFYacg5SiQ/KxxmQr0SLs4rttwcbaGBLG6rcIU+6SSYBYu1GhC+XBlBG94zbqFV9ZvohEbnlnqDDW1Kg9hGT9/vBBtiLEQnTiKDwztIgY3DhqadsVW0g37PFFwuQKXtHw/lQqrRhc+Pb03g+Oq8nIpX8eaurL8lo3lZNkhlY4NfFCYwP7v12MYwSrMeWPMe20LDDQ6NXbJnrsLGl5x08aYn7liS5qsYdtqRpYv+JbJc3EoXIZEyHv17gU1R0OmLsSd/Teln9VAvM+jt4jwQjlvE1WF8g9Qc/WNo28RR4KaNOvUpLDwfuc3gTgkG90ac8EchmKB3LAgU47kQComyphuPAI/G4phqeXOeYnbBrB1aqwxAkAwOIvanGjCY6FXlV8Cve1jao0ejQ0EFE1180yjhltgh5U2EErQLDd5S4y5YLbLz4xIiKo3k06Yktk4dSJsBalHPxi7Z+kofjT3KdeHyGMynodGzOmH5CaAAS2enZpp2VytcawlDu84EvrPYIRPWah9cA6dtxARx6us8EytrNIDv7UVGXw/cQEPR1nZamz6HROqT4Fpwfc=

id_rsa.pub is your ssh public key, right? So it isn't PEM encoded. — Artjom B., Mar 17 '15 at 12:48
What's the output of `node test.js | openssl base64 -d -A`? Could you provide output of `node test.js`? In that case it is easy to find out ourselves. — Maarten Bodewes, Mar 17 '15 at 15:06

score 3 · Accepted Answer · answered Mar 17 '15 at 16:32

3

Just add -decrypt argument for openssl

node test.js | openssl base64 -d -A | openssl rsautl -decrypt -oaep -inkey id_rsa

works pretty nice for me.

answered Mar 17 '15 at 16:32

RzCoDer

145
1
7

Your data should be less than key size in bytes minus some bytes for padding. You can see max data length (in bytes) for key-padding pair in NodeRSA by .getMaxMessageSize() method. If data size in bytes greater than this number NodeRSA devide data to smaller pieces and make several encrypt rounds, then concatenate results. But it not defined in RSA spec, if you want using openssl with NodeRSA you should pay attention for your data size. – RzCoDer Mar 17 '15 at 16:45
Fantastic! So to decrypt my data that were encoded using node-rsa i have to spit them in chucks of <= .getMaxMessageSize(), decrypt every chunk and then concatenate them back again? – Fr0stBit Mar 17 '15 at 16:51
Yes, f.e. you initial data size 120 bytes, and result of .getMaxMessageSize() == 50 bytes, it means nodersa will divide your data to 3 piece, encrypt each and concatenate results. Result size will be 3*key_size. So, if you want decrypt it, you should divide encrypted data for 3 equal chunks (each chunk will be equal of your key lenght in bytes), decrypt one by one and concatenate results. OR better — don't encrypt data larger than .getMaxMessageSize(). – RzCoDer Mar 17 '15 at 17:04
Lol, the `RSA_EAY_PUBLIC_DECRYPT` routine was probably called because of the private key, but it may have struggled with the padded message :) – Maarten Bodewes Mar 17 '15 at 19:42
Have you managed to use node-rssa to decrypt data encrypted with openssl? Could you share the code? Thanks, – ieugen Sep 16 '15 at 22:36

node-rsa and openssl compatibility

1 Answers1