What is the encrypted RSA PEM format from OpenSSL `genrsa`?

Question

I have some encrypted private keys and passphrases that I would like to load into .NET without OpenSSL, but I am having trouble finding the format and specification for them.

I can parse and decode the binary data from PEM, and originally I was thinking I would get PKCS#8, but that seems to not be the case.

The OpenSSL command to create them is such as openssl genrsa -des3 -out test.key 2048 resulting in a file like:

As far as I can tell, the base64 encoded data is not valid DER/ASN, tools I found just say the data is invalid, including openssl asn1parse -inform PEM.. I assume those two "headers" are the distinguishing feature, but what is the format? What are the common values?

RFC 1421 seems to call such headers "encapsulated header", I didn't find them otherwise.

score 4 · Accepted Answer · edited Oct 07 '21 at 08:58

This is OpenSSL's 'traditional' or 'legacy' format private key file (or one of several, depending how you count). It is documented in the man page, on your system or on the web, for the related routines -- nominally man 3 PEM_{read,write}{,_bio}_{RSA,DSA,EC}PrivateKey although this page is duplicated or symlinked under numerous names -- in the 'PEM ENCRYPTION FORMAT' section. Briefly, the data is encrypted (with a chosen symmetric algorithm, in this example DES3 aka DESede aka triple-DES, with CBC and IV) using a key derived from the password (with salt equal to the IV or part of it, which is unusual, and only one iteration, which is weak). The password-based key derivation function used, EVP_BytesToKey, has its own man page.

This is not PKCS8. In addition to being encrypted differently than PKCS8-encrypted (formally, EncryptedPrivateKeyInfo) the clear data that you get after decrypting (or if you don't encrypt to start with, e.g. genrsa without -$cipher) is not PKCS8-clear PrivateKeyInfo. It is instead an algorithm-dependent data format; for RSA it is the format defined in PKCS1 appendix A.1.2, and for DSA and EC it has other formats not relevant here.

OpenSSL also supports PKCS8 privatekey files, both clear and encrypted, which have different PEM types: BEGIN/END PRIVATE KEY and BEGIN/END ENCRYPTED PRIVATE KEY but not BEGIN/END {RSA,DSA,EC} PRIVATE KEY. For the API see that same man page. You can convert at command line with

openssl pkcs8 -topk8 <tradfile >pk8file [-nocrypt | -v1 pbcipher | -v2 plaincipher]`
# since 1.0.0 in 2010 you can add -iter N
# or since 1.0.0 simply
openssl pkey <tradfile >pk8file [-$cipher]

PKCS8 is both more standard (and interchangeable) and more secure, thus recommended -- as that same man page says in the immediately preceding NOTES section.

The Java version of BouncyCastle supports OpenSSL PEM formats in bcpkix. I don't know for the dotnet version but it might be worth looking.

If not, or if you can't use it, you can convert the (decrypted) PKCS1 format to PKCS8 by adding a mostly-fixed header; in ASN.1 terms, PKCS8 is a wrapper that contains some metadata plus an OCTET STRING containing for RSA the PKCS1 encoding. I don't have a dotnet solution for this but you can probably adapt from Java using my list of links at Algid parse error, not a sequence and perhaps Converting a string private key to PrivateKey type .

What is the encrypted RSA PEM format from OpenSSL `genrsa`?

1 Answers1