[SOLVED] Validate RSA key against password without PHPSeclib

Validate RSA key against password without PHPSeclib

I try to validate if a passphrase works with a private key in PHP.

Right now the solution is simply to use phpseclib and do this:

$rsa = new \phpseclib\Crypt\RSA();
$rsa->setPassword($passphrase);
$res = $rsa->loadKey($privateKeyString);

and check if $res is false. This works fine but I want to get rid of phpseclib and use native PHP functionality. How can I achieve that? I tried openssl_pkey_get_private() which did not work.

I only expect RSA keys (like "-----BEGIN RSA PRIVATE KEY-----")...

Solution

A key file starting with "-----BEGIN RSA PRIVATE KEY-----" is encoded using PKCS#1 format, which cannot be recognized by PHP's openssl extension. (It requires the key file in PKCS#8 format. In theory, openssl can read PKCS#1 format files, but PHP does not export the corresponding function.)

Therefore, you have to convert it in order to use the file.

openssl pkcs8 -in path/to/your/key -topk8 -out path/to/output/file