7

I'm trying to convert a PrivateKey object to pem format string without using bouncycastle. previously I was doing it like this:

    StringWriter str = new StringWriter();
    PEMWriter pemWriter = new PEMWriter(str);
    pemWriter.writeObject(privKey);
    pemWriter.close();
    str.close();        
    return str.toString().getBytes();

Now I don't want to use bouncycastle. If I use

    String code = "-----BEGIN RSA PRIVATE KEY-----\n";          
    String codenew =Base64.encodeBase64String(privKey.getEncoded());
    String myOutput = ""; 
    for (String substring : Splitter.fixedLength(64).split(codenew)) { 
      myOutput += substring + "\n"; 
    }
    code += myOutput.substring(0, myOutput.length() - 1);
    code += "\n-----END RSA PRIVATE KEY-----";                          
    return code.getBytes();

The code above works and I'm able to decrypt using openssl by passing this byte[]. Now, my problem is, if I'm printing the pem string value for the above two piece of code, they are different. If I'm using the below openssl command

$ openssl pkcs12 -in receiver.p12 -out receiver.pem -nodes

the pem string thats generated is same as PEMWriter's pem string but not the other one. I wanted to know can I modify my code a bit so that the string when printed, matches the one thats generated by openssl command or PEMWriter.

pem generated by openssl/PEMWriter:

-----BEGIN RSA PRIVATE KEY-----
MIIEpgIBAAKCAQEA9rbxqq+Zi70nRFAZe7SCTB6VgzP1PhkiUm0PmbwFmROSlSSy
yMPSyIzaQqwELyOSQTZtsT3jhd6MCFPBZntym63/GwDuethGSjE9y8rt/9yr+T3I
zz+6ABnZXHJ38tdGYataF1Ndi3CsY5NXGszVFv1Is17P5mbYWQgJ7QzI/a5mPKa+
9pVXsDQthEV3BVUawIEJJnS0THD5XZQJ/MX6F4RPn+2MC9i/RbcA0RVnLPmt2eiy
NV3+55sKdd7GpdMmEbRv9HZyW2xJNyu1xYbwU9YIP88dHCgvqoOgkAX2HLxCJOy6
2gvsS8J7HEbohD98dxPJX7P8w9juORi6Hpsq0wIDAQABAoIBAQDXStIdJtuRC+GG
RXfXca/6iP3j3qV2KSzATRe+CkvAR0o1CC9T7z6zb+bPI5kLIblxWvPiJaW0nn4I
jj5JFhTvMalagTeaz7yW5d2NR2rlSkZwW7Au2uePSv9ZIzL1IVLzzDnz/PW2xv5I
br0mT/Tr+N9GV8iIwNqu5sryp6OFasKB/55LhCcKVYrkdy2WhJc8Y8TXUjF4n8Jn
Xuyd44N6uu5RUiEgN7bPszO1F1T8ujCICwDNnYUw9lwSVvEC2EbTg84lu2UcnE4k
grB7rCKLooDpYlKjXx/1o9Dj9Uv3hwLpSTw2dYRoZS0kOFIKYACP1QcininrTGeL
cOPXyK6BAoGBAPvnBd7/U94Krp9Bp3jjxUEnlFrgf+B7QgRKpG7tN3RDRJmIVL8Z
mnxvbW6o4hsq4TzF/ratnRjqp+79Tw5wUz36G98ftWlTUs62OBznIkwImDGo+ysv
3QK8XUZ4Wg3EcnE5bG8AmOKoDRazc0g7UxopbHC+SNLRMZA/2dBvVh4zAoGBAPq6
UWIfcSnLyFYy7EPh3P7qmotBNPORgcX6aKdwR7pzk6MqTADHxKvIP+eeDEWpF58T
RYBW7KxN4h6cNMglRZBbhED3hONJkpYMGSq0hyczN40SIHHrf3iBO7p35v7Eee82
2H/rT6BNrQF1fPIbz5spgT+eV5BuTAB7bsbWiuDhAoGBALVAgeT26y21mfhVkV9W
5LQA+qp5JworJlFYNADtBx3M2StwASqQDazDsIYTVr4dmHvWK3Teb09iaPt5oMzO
3daWhD+D3VCv98FtM+r4FKGI/Zmd8Twd8HTrfGIcbw/A7mex3efxEhDkwqY28Rhk
N2N3suNcx6GJjJQynVNxCRIpAoGBAOJyIEqUxynOiPOBLm3osiXxUP7wN5i8FA7w
qFCBUecNt4uoCdiyk+fqBf10evT3UQQ07ZKJ71t3RAANaIZTU06buQjMBFMbAa9O
4fP19BLtaQCaHH+HCCuX3I/+9rumS9JHIKX3qoTHYrdsmxo3D/u9MqR4p/EkDLRq
xpQC9I9BAoGBAPZtxtEKc0xhYeuor4qIQbt1edrO+cfEzaXyUvjleLdg8rU3Yeh3
JLbYgcSNr4rMvEwhuvwbwgWJjed7TvqjKKEYYSWW2ESwcmAjNIhDBVzX9oh1cY34
Ae/P63OHt89sWbb5oG2+fcb7xCwH3kYmVgT4/xPv0FQRspwpErKYlCWg
-----END RSA PRIVATE KEY-----

pem generated when not using BC:

-----BEGIN RSA PRIVATE KEY-----
MIIEwAIBADANBgkqhkiG9w0BAQEFAASCBKowggSmAgEAAoIBAQD2tvGqr5mLvSdE
UBl7tIJMHpWDM/U+GSJSbQ+ZvAWZE5KVJLLIw9LIjNpCrAQvI5JBNm2xPeOF3owI
U8Fme3Kbrf8bAO562EZKMT3Lyu3/3Kv5PcjPP7oAGdlccnfy10Zhq1oXU12LcKxj
k1cazNUW/UizXs/mZthZCAntDMj9rmY8pr72lVewNC2ERXcFVRrAgQkmdLRMcPld
lAn8xfoXhE+f7YwL2L9FtwDRFWcs+a3Z6LI1Xf7nmwp13sal0yYRtG/0dnJbbEk3
K7XFhvBT1gg/zx0cKC+qg6CQBfYcvEIk7LraC+xLwnscRuiEP3x3E8lfs/zD2O45
GLoemyrTAgMBAAECggEBANdK0h0m25EL4YZFd9dxr/qI/ePepXYpLMBNF74KS8BH
SjUIL1PvPrNv5s8jmQshuXFa8+IlpbSefgiOPkkWFO8xqVqBN5rPvJbl3Y1HauVK
RnBbsC7a549K/1kjMvUhUvPMOfP89bbG/khuvSZP9Ov430ZXyIjA2q7myvKno4Vq
woH/nkuEJwpViuR3LZaElzxjxNdSMXifwmde7J3jg3q67lFSISA3ts+zM7UXVPy6
MIgLAM2dhTD2XBJW8QLYRtODziW7ZRycTiSCsHusIouigOliUqNfH/Wj0OP1S/eH
AulJPDZ1hGhlLSQ4UgpgAI/VByKeKetMZ4tw49fIroECgYEA++cF3v9T3gqun0Gn
eOPFQSeUWuB/4HtCBEqkbu03dENEmYhUvxmafG9tbqjiGyrhPMX+tq2dGOqn7v1P
DnBTPfob3x+1aVNSzrY4HOciTAiYMaj7Ky/dArxdRnhaDcRycTlsbwCY4qgNFrNz
SDtTGilscL5I0tExkD/Z0G9WHjMCgYEA+rpRYh9xKcvIVjLsQ+Hc/uqai0E085GB
xfpop3BHunOToypMAMfEq8g/554MRakXnxNFgFbsrE3iHpw0yCVFkFuEQPeE40mS
lgwZKrSHJzM3jRIgcet/eIE7unfm/sR57zbYf+tPoE2tAXV88hvPmymBP55XkG5M
AHtuxtaK4OECgYEAtUCB5PbrLbWZ+FWRX1bktAD6qnknCismUVg0AO0HHczZK3AB
KpANrMOwhhNWvh2Ye9YrdN5vT2Jo+3mgzM7d1paEP4PdUK/3wW0z6vgUoYj9mZ3x
PB3wdOt8YhxvD8DuZ7Hd5/ESEOTCpjbxGGQ3Y3ey41zHoYmMlDKdU3EJEikCgYEA
4nIgSpTHKc6I84EubeiyJfFQ/vA3mLwUDvCoUIFR5w23i6gJ2LKT5+oF/XR69PdR
BDTtkonvW3dEAA1ohlNTTpu5CMwEUxsBr07h8/X0Eu1pAJocf4cIK5fcj/72u6ZL
0kcgpfeqhMdit2ybGjcP+70ypHin8SQMtGrGlAL0j0ECgYEA9m3G0QpzTGFh66iv
iohBu3V52s75x8TNpfJS+OV4t2DytTdh6HckttiBxI2visy8TCG6/BvCBYmN53tO
+qMooRhhJZbYRLByYCM0iEMFXNf2iHVxjfgB78/rc4e3z2xZtvmgbb59xvvELAfe
RiZWBPj/E+/QVBGynCkSspiUJaA=
-----END RSA PRIVATE KEY-----
2
  • Can you please provide complete outputs for some dummy key?
    – jariq
    May 25, 2014 at 20:07
  • I've updated the question with the complete key data when printed.
    – kdas
    May 26, 2014 at 6:47

1 Answer 1

11

PEMWriter class from BouncyCastle stores private key in PKCS#1 format (for more details please see RsaPrivateKey stucture defined in RFC 3447):

pkcs1

Your code stores private key in PKCS#8 format (for more details please see PrivateKeyInfo structure defined in RFC 5208):

pkcs8

PKCS#1 defines how to store RSA keys while PKCS#8 defines an envelope that can store any asymmetric key pair. As you can see on the attached pictures PKCS#8 just envelopes PKCS#1 and specifies that key is usable with RSA algorithm.

6
  • So this explains how openssl is still able to use the key data to decrypt. Can I alter my Base64 encoding code (w/o BC) a bit so that when I print it out, it prints the PKCS#1 format. I want this so that its not a confusion for other developers when they see the output of my code vs openssl command.
    – kdas
    May 26, 2014 at 17:16
  • @user3645686 Instance of which class is privKey variable in your code?
    – jariq
    May 26, 2014 at 18:30
  • java.security.PrivateKey
    – kdas
    May 26, 2014 at 19:27
  • @kdas I don't have any java IDE available right now so I am just guessing: PrivateKeyInfo privKeyInfo = new PrivateKeyInfo(ASN1Sequence.getInstance(privKey.getEncoded())); byte[] pkcs1 = privKeyInfo.parsePrivateKey().toASN1Primitive().getEncoded();
    – jariq
    May 26, 2014 at 21:21
  • 1
    @kdas It is not an easy task to do what you want without a SpongyCastle. For a bulletproof solution you would need to use/write at least ASN.1 parser, read PrivateKeyInfo structure with it and extract RsaPrivateKey structure out of it. However there is also a lightweight but very hackish way: you can remove all bytes before the third occurrence of 0x30 byte - that's where the third ASN.1 sequence (RsaPrivateKey) starts. It would mean to delete the first 26 bytes in most cases.
    – jariq
    May 27, 2014 at 6:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.