is this RSA private key valid?

Question

is this RSA private key valid?

First, here's the RSA private key in question:

-----BEGIN RSA PRIVATE KEY-----
MIICXwKBAQACgYDDlegCjkr+Fwf48IVDJimiQdYrpDbrlyMazVeP88ELQLQrTUp/
BrCeC82CUFOyjjbuJagixYsuHhgueS3g/NXrR7XulWBjE2BruSeek8hmK+Ch+jzu
SMT+WbFIiUDHfJoERUHF02nJ12vFSuJ435/4+7vr/7zAo2M2E76et7a92wKBAwEA
AQKBgKuL7kVfnPMkLD/yZlAxRs8kQ79fdzRICehWNvjx6V3/UIeycSbdLUhSPdyQ
q/iuuAtFSCXHcn3us3L/onf2C4GZgMwh3n7022SXm3iQztSWPE4ei6CFjzG6NB2+
hXjcRoq/En/FD+65PXvnNxOJAhHSrS+kGLmNTeHMZIj4jJGBAoFA98V8RkdOgb6I
XRX/PQCI3215ODIHeqV7SZiw9TXM4dHRFYc19cXXPGffwNAi2hkOkClBRcrZT96u
AOO9Lam9uwKBQMoUvqYplONRc0JGA2+m8kUrMmaO+xKRGVQ1qkxaU5H5vKShHpPv
aO598i8yWE0rOxkEX72IawAUAv2sHxLm7mECgUBwwO5NDSYs5QgpVFlS6WtgQfFo
IVxF9Aim9VWSQWl7WoBLy7xCnEXWt26b0BwMJFr8P8n0eNtr/Wox/XGZ1iUBAoFA
O+fSbKe+/3RR2r+unRa8k0yu8EBKpcJl49TU2zWbuJZ0Gcm5qtk6HhkwBlXCX34F
UvE9AI7ESY2lJVY1EAFtgQKBQBNf1NuWHXts0msdOnCHzcb1g+CqhdUnknW5dHf4
nFKr9b9fq3f2kpqFwPUC5Ea+tocL7bwN4kgfFLJMMaLwr6A= 
-----END RSA PRIVATE KEY-----

Here's the ASN.1 parsing of that key:

    0:d=0  hl=4 l= 607 cons: SEQUENCE
    4:d=1  hl=3 l=   1 prim:  INTEGER           :00
    8:d=1  hl=3 l= 128 prim:  INTEGER           :-3C6A17FD71B501E8F8070F7ABCD9D65DBE29D45BC91468DCE532A8700C3EF4BF4BD4B2B580F94F61F4327DAFAC4D71C911DA57DD3A74D1E1E7D186D21F032A14B84A116A9F9CEC9F9446D8616C3799D41F5E05C311B73B01A64EB776BF388365FBBABE3A2C963628943AB51D8720600704441400433F5C9CC9EC416148494225
  139:d=1  hl=3 l=   3 prim:  INTEGER           :010001
  145:d=1  hl=3 l= 128 prim:  INTEGER           :-547411BAA0630CDBD3C00D99AFCEB930DBBC40A088CBB7F617A9C9070E16A200AF784D8ED922D2B7ADC2236F54075147F4BAB7DA388D82114C8D005D8809F47E667F33DE21810B249B6864876F312B69C3B1E1745F7A70CE45CBE2417A8723B97540ED803AF01146C28418C8EC76FDEE2D52D05BE74672B21E339B7707736E7F
  276:d=1  hl=3 l=  64 prim:  INTEGER           :-083A83B9B8B17E4177A2EA00C2FF77209286C7CDF8855A84B6674F0ACA331E2E2EEA78CA0A3A28C398203F2FDD25E6F16FD6BEBA3526B02151FF1C42D2564245
  343:d=1  hl=3 l=  64 prim:  INTEGER           :-35EB4159D66B1CAE8CBDB9FC90590DBAD4CD997104ED6EE6ABCA55B3A5AC6E06435B5EE16C109711820DD0CDA7B2D4C4E6FBA0427794FFEBFD0253E0ED19119F
  410:d=1  hl=3 l=  64 prim:  INTEGER           :70C0EE4D0D262CE50829545952E96B6041F168215C45F408A6F5559241697B5A804BCBBC429C45D6B76E9BD01C0C245AFC3FC9F478DB6BFD6A31FD7199D62501
  477:d=1  hl=3 l=  64 prim:  INTEGER           :3BE7D26CA7BEFF7451DABFAE9D16BC934CAEF0404AA5C265E3D4D4DB359BB8967419C9B9AAD93A1E19300655C25F7E0552F13D008EC4498DA525563510016D81
  544:d=1  hl=3 l=  64 prim:  INTEGER           :135FD4DB961D7B6CD26B1D3A7087CDC6F583E0AA85D5279275B97477F89C52ABF5BF5FAB77F6929A85C0F502E446BEB6870BEDBC0DE2481F14B24C31A2F0AFA0

Here's what RFC3447 says the format of a private key is:

  RSAPrivateKey ::= SEQUENCE {
      version           Version,
      modulus           INTEGER,  -- n
      publicExponent    INTEGER,  -- e
      privateExponent   INTEGER,  -- d
      prime1            INTEGER,  -- p
      prime2            INTEGER,  -- q
      exponent1         INTEGER,  -- d mod (p-1)
      exponent2         INTEGER,  -- d mod (q-1)
      coefficient       INTEGER,  -- (inverse of q) mod p
      otherPrimeInfos   OtherPrimeInfos OPTIONAL

So pretty much the key has a negative modulus. Seems to me that as such it's a bad key. That it needs to have a zero before it.

From X.690-0207.pdf...

The contents octets shall be a two's complement binary number equal to the integer value, and consisting of bits 8 to 1 of the first octet, followed by bits 8 to 1 of the second octet, followed by bits 8 to 1 of each octet in turn up to and including the last octet of the contents octets

So given all this, why does the following work?:

openssl rsautl -inkey privatekey.txt -encrypt -in plaintext.txt -out ciphertext.txt

Quoting more from RFC3447:

   RSAEP ((n, e), m)

   Input:
   (n, e)   RSA public key
   m        message representative, an integer between 0 and n - 1

So basically, the function that does the exponentation isn't supposed to allow numbers less than zero and yet that's what we have here.

Any ideas?

Answer 1

This is, as you guessed, an incorrectly encoded key. I suspect that OpenSSL ASN.1 decoder is written to assume that the modulus (and other parameters) is always positive, and so interprets them as if they were (that is, interprets them as if the leading 00 byte was there); hence it just happens to work.

Now, what do you do about it? Well, if it's basically working for you, I suppose there's no urgent need to "fix" it. On the other hand, what you're using isn't standard ASN.1; if you need to give the private key to someone else (or even update the version of OpenSSL you're using), it might stop working. I'd personally suggest that you track down who generated the key, and tell them to fix their ASN.1 encoder.