0
$\begingroup$

So, I am sitting here trying to figure out what is happening and why two keys are different in such a vast manner. I've created two key pairs, one key pair with the OpenSSL CLI commands on an Ubuntu 16.04 machine and the other keypair with a C program using the RSA_generate_key functions resident within the library. However, even though both keys are made with identical parameters, the differnce is farily large within the public and Private key. The difference in Public Keys are 25 bytes and it seems it's not formatted the same either.

OpenSSL CLI: 

 openssl genrsa -des3 -out private.pem 4096
 openssl rsa -in private.pem -outform PEM -pubout -out public.pem

OpenSSL CLI Key: enter image description here

OpenSSL CLI ASN1Parse: enter image description here

OpenSSL CLI Key Dump (Base64 -d): enter image description here

------------------------------------------------------------------------------------------------------

C Program:

C Program Key: enter image description here C Program ASN1Parse: enter image description here C Program Key Dump (Base64 -d): enter image description here

Attempting to dig into what the RSA_generate_key function does I found this: but, that does not tell me if it is in an ASN1 (Which it looks to be from the header). Or if there a a different formatting applied that I need to duplicate in order to create a key similar to that created from teh C Program. Essentially, I have to duplicatie the extact functionality of the C key generation with the CLI tools.

| improve this question | |
$\endgroup$
  • $\begingroup$ RSA_generate_key creates (actually modifies) an in-memory structure, not any file. Your C program probably used PEM_write[_bio]_RSAPublicKey to create the file. Look at the man page for that function, and for PEM_write[_bio]_[RSA_]PUBKEY, and see how the descriptions differ. Since OpenSSL 1.0.0 openssl rsa -RSAPublicKey_out can convert SPKI to 'raw', although it was not documented until version 1.1.0. $\endgroup$ – dave_thompson_085 Dec 21 '17 at 3:39
  • $\begingroup$ Alternatively, openssl asn1parse -strparse offset -out filename can extract a component of any ASN.1 structure as DER; in your example you want the component at offset 19, but for different-size keys it may be different, and then you have to convert the DER to PEM yourself with some literal strings and base64, on the same principle as stackoverflow.com/questions/47599544/… although that's for privatekey. $\endgroup$ – dave_thompson_085 Dec 21 '17 at 3:44
3
$\begingroup$

They're both in ASN.1 (DER) format, however they have different contents.

The OpenSSL version has an outer formatting that effectively states "this is an RSA public key", following by the actual raw public key key (which is listed as a 'bitstring' in the ASN.1 parse). If you were to parse the bitstring as ASN.1, you'd see the public key, expressed as a sequence of two integers.

In contrast, the C program just has the ASN.1 raw public keyl that is, it's just a sequence of two integers, the values for $n$ and $d$.

The additional outer formatting included in the OpenSSL version accounts for the additional 25 bytes.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Nitpick: both formats are supported by OpenSSL library (see my comment on Q). It is the commandline program openssl that prefers X.509-SPKI format. $\endgroup$ – dave_thompson_085 Dec 21 '17 at 3:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.