# Decrypt AES-128-CBC encypted partial RSA Key

I am given a private RSA key, which header indicates that it is AES-128-CBC encypted. Note that the last ten lines of the key are missing. (This is part of an educational task.)

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,8B7CE35DB731727CEABA217FAE404DB8

... 37 and a half lines with 64 characters each


The task is to find out the passphrase of the key (is known to be a four digit number). I already achieved the general cracking mechanism by using John The Ripper and added the obligatory -----END RSA PRIVATE KEY----- to the end of the partial key, but so far, the key could not be decrypted, which might be related to the fact that the last few lines of the key are missing (because CBC involves all blocks of a file). I already tried to cut the key content length to a multiple of 128bit and decrypt that, but that did not change anything. To find a proper way to still be able to decrypt the key, I need to furtherly understand the decryption process.

How does the process of decryption work, and how is the passphrase of the key involved in this? I already looked up some webpages containing wikipedia on CBC encryption in general, but I was unable to understand on how the actual decryption process does take place involving the key's passphrase.

Thanks in advance for all explanations or hints on how to approach this task.

• You should lookup the actual way that the file is encrypted (e.g. with regards to how the key is derived and the IV is used). Then you should base 64 decode the lines you are given, and try to decrypt that using AES-CBC directly (using "no padding" as unpadding will fail). Note that the DER header of a private key is easy to distinguish from randomized text. Dec 6, 2021 at 12:19
• Interestingly, I cannot find the KDF used to derive the key. It's probably the OpenSSL specific EVP_BytesToKey one, but I'll be danged if I can find the precise method required to go from PIN to key. Do you have more information about the PIN/key? Dec 6, 2021 at 12:34
• @MaartenBodewes Thanks for your help. No, unfortunately there is no further information about the PIN or key given. The only additional thing is a encrypted file to be decrypted by the restored key later, but I think this does not help at this point. Dec 13, 2021 at 9:26

Proc-Type: 4,ENCRYPTED indicates that the key is derived from the password specified by RFC 1421 §4.6.1.1 ff.. For the meaning of DEK-Info, RFC 1423 is older than AES, and I don't know of a reference other than the OpenSSL source code.
The encryption key is derived from the password using PBKDF1-MD5 as specified by PKCS#5. The salt is the second part of the DEK-Info header and the iteration count is 1. (Yes, this is ridiculously weak. Only ever use high-entropy passwords for PEM encryption, not actual memorable passwords!) Again, the only reference I know of is the OpenSSL source code: pem_bytes_read_bio_flags calls PEM_do_header which calls EVP_BytesToKey.