Using Open Source Crypto ++ RSA Keys on OpenSSL

Question

Is there a way to use the RSA keys that I created using the Crypto ++ API in OpenSSL? I am looking for a way to save keys in a format that Crypto ++ and OpenSSL can easily open.

I am writing a licensing scheme and I want to verify signatures and decrypt files using the Crypto ++ API, but to create license files I would like to use the web interface (possibly using PHP that supports OpenSSL) to generate and encrypt / sign licenses.

I would write both applications using Crypto ++ and call it from PHP, but since the private key will be stored in encrypted form, the password should be passed to the application, and passing it on the command line does not seem to be a good idea for me.

Answer 1

Both Crypto ++ and OpenSSL can handle PKCS # 8 encoded keys. In crypto ++ you can generate keys and convert to PKCS # 8 buffer like this,

AutoSeededRandomPool rng; RSAES_OAEP_SHA_Decryptor priv(rng, 2048); string der; StringSink der_sink(der); priv.DEREncode(der_sink); der_sink.MessageEnd(); // der.data() is the bytes you need 

Now you just need to pass the bytes to PHP. You can save it in a file, send a message.

The only problem is that the PHP OpenSSL interface accepts only PEM encoded PKCS # 8. You can easily convert DER-encoded buffer to PEM, like it is in PHP,

 <?php function pkcs8_to_pem($der) { static $BEGIN_MARKER = "-----BEGIN PRIVATE KEY-----"; static $END_MARKER = "-----END PRIVATE KEY-----"; $value = base64_encode($der); $pem = $BEGIN_MARKER . "\n"; $pem .= chunk_split($value, 64, "\n"); $pem .= $END_MARKER . "\n"; return $pem; } ?> 

You can also convert PKCS # 8 to PEM in C ++ if you want. The algorithm is very simple, as you can see from the PHP code.

OpenSSL is so common these days. I see no reason to use Crypto ++ for common cryptographic applications like this.

Answer 2

Is there a way to use the RSA keys that I created using the Crypto ++ API in OpenSSL? I am looking for a way to save keys in a format that Crypto ++ and OpenSSL can easily open.

Yes. In addition to the X.509 and PKCS # 8 encoded keys (ZZ Coder's answer), you can also use PEM encoded keys, including encrypted keys. Support for PEM encoded keys was transferred to the project in July 2014 for OpenSSL interoperability.

To use the encoded PEM keys, you need to get the Crypto ++ PEM Pack and recompile the library. The PEM package is not part of the Crypto ++ library provided by Wei Dai on the Crypto ++ website.

After installing and recompiling it, you can simply:

 // Load a RSA public key FileSource fs1("rsa-pub.pem", true); RSA::PublicKey k1; PEM_Load(fs1, k1); // Load a encrypted RSA private key FileSource fs2("rsa-enc-priv.pem", true); RSA::PrivateKey k2; PEM_Load(fs2, k2, "test", 4); // Save an EC public key DL_PublicKey_EC<ECP> k16 = ...; FileSink fs16("ec-pub-xxx.pem", true); PEM_Save(fs16, k16); // Save an encrypted EC private key DL_PrivateKey_EC<ECP> k18 = ...; FileSink fs18("ec-enc-priv-xxx.pem", true); PEM_Save(fs18, k18, "AES-128-CBC", "test", 4); 

The keys look like this on the disk:

 $ cat rsa-pub.pem -----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCg7ovcljEjZCFOdLWENBKE6FSk Nke6OP79SMJABJw+JoEBpNddK6/v99IvA1qU76V0V4k8qLvhkVUtk9FArhhRsxeF 1fd8UVqgsT8j0YCVFcJ/ZA372ogpXyvc5aK9mZEiKE5TIF8qnDFFZiMWPrad1buk hg+eFdo78QRLA5plEQIDAQAB -----END PUBLIC KEY----- $ $ cat rsa-enc-priv.pem -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: AES-128-CBC,E1A759E11CA515CE34B6E8CE5278C919 slMx02TMblahTedEKsfS+qYYo4nZFaqI3PhCRYmE5zUa9clHm7yo36wIk3oo52OB f4AhOaJwiPQAbLe/kDHeP77iHd/4+hFNq/Haj6ahWRpXilLVOETLtefbzSGO8va3 ORnwQpPThs2V0EetPU3LB3QcA/XRjWDzyNa7+LydOjKwbQdZnF/jND5NCkEkncNM iQJ1VWubN+Xs3Rx0CfLu5Chl1n7WnmCNMtLL/LtYeaR1SlRJa6BaF7hNHJJJ3+Jc 8curCKlpobs+XnlDfjyqgTXolkiepn95TnT7KSqi3BqVEpq/5LKMnkDJg6nwUR7A w0jLNr1f8adWyBEj2Dp0D/jy8eDh65eHdJw4s8G5FZfBud1zWbvRQ3Ah70ISUKa3 4q/6z2vervPgoc+rMVYDvRf/mqa4LMXYhuygsyx50OgPldCC2d0cVVFCg/ljdEzO UV5rSkK1Qczv8Nc1ZdY3fJA+qYIV8JqPPY+dJ2312R+myPi5Av0/69k8lZN5eIJk SkiiFQmabhc+o6z4RFA52a3lOud3eGM9L5nbFQGc5COzQVZ6y8t06tLIp9Y5zjA4 KTgNncV5eq3Bau+cWXjP6pJRixFVfwIoy95mAur7B2P1iE4FXyZbvCovPL6vilT5 kSqAo7Znu0RpTjE36tWY6tFt+GU7k8EBrjA3Qi+8xxqyYtr57Ns+H/j+hhJTN8L7 IXoevwS81OPiB0Dmg6wLLXATG1+gCNXb8sd5U2eJhy4LOJA3y54CTgRnPXtM38CH K+JvnDstyUl9IGTsgUz51ZzyJNZGU9Ro3pt/a3Cs5IJumaygZ0LQ44WBw9m/vja9 -----END RSA PRIVATE KEY----- $ $ cat ec-pub.pem -----BEGIN PUBLIC KEY----- MFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEVwXjdIb2yy25QbIO0XiIHpySXwSpIAcz v0Wdyq+fZ6BdJjs2jKvbs9pcRJn8yxlASWoz2R4NoHTZ2YokKsDfEg== -----END PUBLIC KEY----- $ $ cat ec-enc-priv.pem -----BEGIN EC PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: AES-128-CBC,F1DBC73E26DCD310888932C2762B3512 nikex48SFvtNOIrOEDipwmxaghjn4jtrvwI3d1H/VNq9yp26WqFZxBJCUPFBFLjH auA+AHeUo3BVkNQPs0VO4FD5xR50mtc2tCJizzhyTTTypLc3lRkxmD1MpeZnWRy2 70foVtNSvLL/QLJqNJGm/G9kl0xPN4zAfOq7Txoscnk= -----END EC PRIVATE KEY----- 

---

Related: for other useful Crypto ++ patches, see the Category: Patch page on the Crypto ++ wiki.

Answer 3

Try this link: http://www.cryptopp.com/fom-serve/cache/62.html

It looks like you will need to use PKCS # 8 and convert from DER to PEM format in order to be able to use keys in OpenSSL. I'm not sure if you can use one file for both.

I used OpenSSL, so I'm not sure what options you have with Crypto ++. I found the link above by doing a Google search of these terms: Crypto ++ RSA OpenSSL.

DER is the OpenSSL binary format for keys and certificates.

PEM is an OpenSSL text format.