java rsa public-key-encryption private-key

Load an Encrypted PCKS8 PEM Private Key In Java

I wish to load/use an Encrypted Private Key provided to me in a Java application. Please find the keys (Encrypted Private, Decrypted Private and Public keys shown below).

The Encrypted Private key password: "aWCTJPET9fL7UBTp97hX99gdofeWKUf5tuxSuJeST2sEkyvkyinrfrj6EiSUTErF"

The keys were generated by using Crypto in NodeJS using:

generateKeyPairSync( "rsa", {
        modulusLength: 4096,
        publicKeyEncoding: {
          type: "spki",
          format: "pem"
        },
        privateKeyEncoding: {
          type: "pkcs8",
          format: "pem",
          cipher: "aes-256-cbc",
          passphrase: "aWCTJPET9fL7UBTp97hX99gdofeWKUf5tuxSuJeST2sEkyvkyinrfrj6EiSUTErF"
        }
      } )

Note: enforcing padding in encrypt and decrypt padding: RSA_PKCS1_PADDING

I am running using: Runtime version: 11.0.7+10-b765.64 amd64, OpenJDK 64-Bit

The best/closest reference I have found is: How to read a password encrypted key with java?

I am running using: IDE: IntelliJ IDEA 2020.1.3 (Community Edition) Build #IC-201.8538.31, built on July 7, 2020 Runtime version: 11.0.7+10-b765.64 amd64 VM: OpenJDK 64-Bit Server VM by JetBrains s.r.o. Linux 5.4.0-65-generic GC: ParNew, ConcurrentMarkSweep Memory: 943M Cores: 8 Current Desktop: KDE

java --version: openjdk 14.0.2 2020-07-14 OpenJDK Runtime Environment (build 14.0.2+12-Ubuntu-120.04) OpenJDK 64-Bit Server VM (build 14.0.2+12-Ubuntu-120.04, mixed mode, sharing)

The code example provided below will fail with :

java.security.NoSuchAlgorithmException: Cannot find any provider supporting 1.2.840.113549.1.5.13

I found the number to be OID http://oid-info.com/get/1.2.840.113549.1.5.13

Which effectively seems to mean: Password-Based Encryption Scheme 2 (PBES2)

I found a bug report which says it has been resolved: https://bugs.openjdk.java.net/browse/JDK-8076999 on the 2020-10-30 09:27

So the question How do you load a given Encrypted Private Key (PEM) into a Java application so it can be used ? Is there a work around ?

There is a lot of stuff online about using the Bouncy Castle libs but I could not find a working example either. I have no restrictions code wise. Please provide an example if possible.

For example can the key be decrypted using AES by extracting the IV from the key itself ?

String privKeyStrBase64Encoded = "THE ENCRYPTED PRIVATE KEY SHOWN FURTHER DOWN"
        privKeyStrBase64Encoded = privKeyStrBase64Encoded.replace("-----BEGIN ENCRYPTED PRIVATE KEY-----", "");
        privKeyStrBase64Encoded = privKeyStrBase64Encoded.replaceAll(System.lineSeparator(), "");
        privKeyStrBase64Encoded = privKeyStrBase64Encoded.replace("-----END ENCRYPTED PRIVATE KEY-----", "");

        byte[] encryptedPKInfo =  Base64.getDecoder().decode(privKeyStrBase64Encoded);
        EncryptedPrivateKeyInfo ePKInfo = new EncryptedPrivateKeyInfo(encryptedPKInfo);
        char[] password = "aWCTJPET9fL7UBTp97hX99gdofeWKUf5tuxSuJeST2sEkyvkyinrfrj6EiSUTErF".toCharArray();
        
        Cipher cipher = Cipher.getInstance(ePKInfo.getAlgName()); //Cannot find any provider supporting 1.2.840.113549.1.5.13
        PBEKeySpec pbeKeySpec = new PBEKeySpec(password);
        // Now create the Key from the PBEKeySpec
        SecretKeyFactory skFac = SecretKeyFactory.getInstance(ePKInfo.getAlgName());
        Key pbeKey = skFac.generateSecret(pbeKeySpec);
        // Extract the iteration count and the salt
        AlgorithmParameters algParams = ePKInfo.getAlgParameters();
        cipher.init(Cipher.DECRYPT_MODE, pbeKey, algParams);
        // Decrypt the encryped private key into a PKCS8EncodedKeySpec
        KeySpec pkcs8KeySpec = ePKInfo.getKeySpec(cipher);
        // Now retrieve the RSA Public and private keys by using an
        // RSA keyfactory.
        KeyFactory rsaKeyFac = KeyFactory.getInstance("RSA");
        // First get the private key
        RSAPrivateCrtKey rsaPriv = (RSAPrivateCrtKey) rsaKeyFac.generatePrivate(pkcs8KeySpec);
        // Now derive the RSA public key from the private key
        RSAPublicKeySpec rsaPubKeySpec = new RSAPublicKeySpec(rsaPriv.getModulus(), rsaPriv.getPublicExponent());
        RSAPublicKey rsaPubKey = (RSAPublicKey) rsaKeyFac.generatePublic(rsaPubKeySpec);
    }

For reference the key when decrypted looks like:

The associated public key is so you can test with:

Solution

https://bugs.openjdk.java.net/browse/JDK-8076999 is not applicable to your problem; it is about parsing PBES2 parameters not about implementing the PBES2 algorithm(s). And per the link at the bottom to https://bugs.openjdk.java.net/browse/JDK-8202837 that problem was actually fixed (at least for PBES2 using AES, which is what you need) in 2018 in 11.0.1 up, which includes your 14.0.2 as evidenced by the fact that your new EncryptedPrivateKeyInfo did NOT fail.

But Oracle/OpenJDK (as of 14) does not implement generic PBES2 (keyfactory and/or Cipher) either by name or OID, and neither does BouncyCastle (as of 1.66). The former does implement some specific PBES2 AES schemes by name, including the one you need, but you must dig inside the parameters object to find that name, like this:

public static void main (String[] args) throws Exception {
    //String file = args[0], pw = args[1];
    String file = "n:66286457.pem", pw = "aWCTJPET9fL7UBTp97hX99gdofeWKUf5tuxSuJeST2sEkyvkyinrfrj6EiSUTErF";
    String pem = new String(Files.readAllBytes(Paths.get(file)));
    String b64 = pem.replaceAll("-----(BEGIN|END) ENCRYPTED PRIVATE KEY-----|\r?\n","");
    byte[] der = Base64.getDecoder().decode(b64);
    
    // Oracle/OpenJDK param parsing for PBES2 only works in 11.0.1 up 
    // and currently only for AES-128,256 see JDK-8076999,JDK-8202837
    EncryptedPrivateKeyInfo eki = new EncryptedPrivateKeyInfo(der);
    if( !eki.getAlgName().equals("1.2.840.113549.1.5.13") ) 
        throw new Exception ("not PBES2"); // or other handling 
    AlgorithmParameters top = eki.getAlgParameters();
    // hack to get nonpublic field and class, may break if Java keeps getting stricter
    Class<?> clazz = top.getClass();
    Object spi = access(clazz,"paramSpi").get(top);
    clazz = Class.forName("com.sun.crypto.provider.PBES2Parameters");
    String spiname = (String) access(clazz,"pbes2AlgorithmName").get(spi);

    SecretKeyFactory fact = SecretKeyFactory.getInstance(spiname);
    SecretKey skey = fact.generateSecret(new PBEKeySpec(pw.toCharArray()));
    Cipher ciph = Cipher.getInstance(spiname); 
    ciph.init(Cipher.DECRYPT_MODE, skey, eki.getAlgParameters());

    KeyFactory fac2 = KeyFactory.getInstance("RSA");
    PrivateKey pkey = fac2.generatePrivate(eki.getKeySpec(ciph));

    System.out.println ( ((RSAPrivateKey)pkey).getModulus() ); // for test
}
static Field access (Class<?> clazz, String name) throws Exception {
    Field f = clazz.getDeclaredField(name); 
    f.setAccessible(true);
    return f;
}

Update: as of Java 19 this is no longer needed. .getAlgName() now returns the specific name. See https://bugs.openjdk.org/browse/JDK-8286428 and the actual change .

BTW: IV is not a problem; the AlgorithmParameters for this case wraps com.sun.crypto.provider.PBES2Parameters which includes both the PBKDF2 parameters (salt and itercount) and the encryption parameter (IV).

BouncyCastle (bcpkix plus bcprov) is indeed an easy and fully supported way; you can parse the PEM directly (without adjusting and base64-decoding it) or else parse the (dePEMified or otherwise) DER, and either way then use PKCS8EncryptedPrivateKeyInfo.decryptPrivateKeyInfo with JceOpenSSLPKCS8DecryptorProviderBuilder, and JcaPEMKeyConverter (which just runs it through a suitable KeyFactory, which you can do manually if you prefer). For PEM see Reading PKCS8 in PEM format: Cannot find provider or for DER How read a PKCS8 encrypted Private key which is also encoded in DER with bouncycastle? (disclosure: both mine).