is this RSA private key valid?

First, here's the RSA private key in question:


Here's the ASN.1 parsing of that key:

    0:d=0  hl=4 l= 607 cons: SEQUENCE
    4:d=1  hl=3 l=   1 prim:  INTEGER           :00
    8:d=1  hl=3 l= 128 prim:  INTEGER           :-3C6A17FD71B501E8F8070F7ABCD9D65DBE29D45BC91468DCE532A8700C3EF4BF4BD4B2B580F94F61F4327DAFAC4D71C911DA57DD3A74D1E1E7D186D21F032A14B84A116A9F9CEC9F9446D8616C3799D41F5E05C311B73B01A64EB776BF388365FBBABE3A2C963628943AB51D8720600704441400433F5C9CC9EC416148494225
  139:d=1  hl=3 l=   3 prim:  INTEGER           :010001
  145:d=1  hl=3 l= 128 prim:  INTEGER           :-547411BAA0630CDBD3C00D99AFCEB930DBBC40A088CBB7F617A9C9070E16A200AF784D8ED922D2B7ADC2236F54075147F4BAB7DA388D82114C8D005D8809F47E667F33DE21810B249B6864876F312B69C3B1E1745F7A70CE45CBE2417A8723B97540ED803AF01146C28418C8EC76FDEE2D52D05BE74672B21E339B7707736E7F
  276:d=1  hl=3 l=  64 prim:  INTEGER           :-083A83B9B8B17E4177A2EA00C2FF77209286C7CDF8855A84B6674F0ACA331E2E2EEA78CA0A3A28C398203F2FDD25E6F16FD6BEBA3526B02151FF1C42D2564245
  343:d=1  hl=3 l=  64 prim:  INTEGER           :-35EB4159D66B1CAE8CBDB9FC90590DBAD4CD997104ED6EE6ABCA55B3A5AC6E06435B5EE16C109711820DD0CDA7B2D4C4E6FBA0427794FFEBFD0253E0ED19119F
  410:d=1  hl=3 l=  64 prim:  INTEGER           :70C0EE4D0D262CE50829545952E96B6041F168215C45F408A6F5559241697B5A804BCBBC429C45D6B76E9BD01C0C245AFC3FC9F478DB6BFD6A31FD7199D62501
  477:d=1  hl=3 l=  64 prim:  INTEGER           :3BE7D26CA7BEFF7451DABFAE9D16BC934CAEF0404AA5C265E3D4D4DB359BB8967419C9B9AAD93A1E19300655C25F7E0552F13D008EC4498DA525563510016D81
  544:d=1  hl=3 l=  64 prim:  INTEGER           :135FD4DB961D7B6CD26B1D3A7087CDC6F583E0AA85D5279275B97477F89C52ABF5BF5FAB77F6929A85C0F502E446BEB6870BEDBC0DE2481F14B24C31A2F0AFA0

Here's what RFC3447 says the format of a private key is:

  RSAPrivateKey ::= SEQUENCE {
      version           Version,
      modulus           INTEGER,  -- n
      publicExponent    INTEGER,  -- e
      privateExponent   INTEGER,  -- d
      prime1            INTEGER,  -- p
      prime2            INTEGER,  -- q
      exponent1         INTEGER,  -- d mod (p-1)
      exponent2         INTEGER,  -- d mod (q-1)
      coefficient       INTEGER,  -- (inverse of q) mod p
      otherPrimeInfos   OtherPrimeInfos OPTIONAL

So pretty much the key has a negative modulus. Seems to me that as such it's a bad key. That it needs to have a zero before it.

From X.690-0207.pdf...

The contents octets shall be a two's complement binary number equal to the integer value, and consisting of bits 8 to 1 of the first octet, followed by bits 8 to 1 of the second octet, followed by bits 8 to 1 of each octet in turn up to and including the last octet of the contents octets

So given all this, why does the following work?:

openssl rsautl -inkey privatekey.txt -encrypt -in plaintext.txt -out ciphertext.txt

Quoting more from RFC3447:

   RSAEP ((n, e), m)

   (n, e)   RSA public key
   m        message representative, an integer between 0 and n - 1

So basically, the function that does the exponentation isn't supposed to allow numbers less than zero and yet that's what we have here.

Any ideas?

  • $\begingroup$ Do you meant to write "... has a negative modulus."? $\endgroup$ – Paŭlo Ebermann Sep 29 '12 at 17:08
  • $\begingroup$ Good catch lol. I'll update my question! $\endgroup$ – ansur Sep 29 '12 at 19:06

This is, as you guessed, an incorrectly encoded key. I suspect that OpenSSL ASN.1 decoder is written to assume that the modulus (and other parameters) is always positive, and so interprets them as if they were (that is, interprets them as if the leading 00 byte was there); hence it just happens to work.

Now, what do you do about it? Well, if it's basically working for you, I suppose there's no urgent need to "fix" it. On the other hand, what you're using isn't standard ASN.1; if you need to give the private key to someone else (or even update the version of OpenSSL you're using), it might stop working. I'd personally suggest that you track down who generated the key, and tell them to fix their ASN.1 encoder.


Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.