Bug #47447 for Crypt-OpenSSL-RSA: Can't load encrypted private keys

Mon Jun 29 18:37:22 2009 hachi [...] cpan.org - Ticket created

Subject:

Can't load encrypted private keys

I'd like to be able to load encrypted private keys using this module. I've implmented at least one way to do this, and the patch is attached. Is it possible for this to get into the released module? Thanks --hachi

Subject:

Crypt-OpenSSL-RSA-0.25-encrypted-private-keys.diff

diff --exclude=.git -u Crypt-OpenSSL-RSA-0.25/RSA.xs Crypt-OpenSSL-RSA-0.25-hachi/RSA.xs --- Crypt-OpenSSL-RSA-0.25/RSA.xs 2006-11-13 04:24:28.000000000 -0800 +++ Crypt-OpenSSL-RSA-0.25-hachi/RSA.xs 2009-06-29 15:29:11.000000000 -0700 @@ -157,20 +157,30 @@ return sv; } -RSA* _load_rsa_key(SV* p_keyStringSv, +RSA* _load_rsa_key(SV* p_keyStringSv, SV* p_passwordStringSv, RSA*(*p_loader)(BIO*, RSA**, pem_password_cb*, void*)) { STRLEN keyStringLength; char* keyString; + char* passwordString; RSA* rsa; BIO* stringBIO; keyString = SvPV(p_keyStringSv, keyStringLength); + if (p_passwordStringSv == &PL_sv_undef) + passwordString = NULL; + else { + OpenSSL_add_all_algorithms(); + PKCS5_PBE_add(); + + passwordString = SvPV_nolen(p_passwordStringSv); + } + CHECK_OPEN_SSL(stringBIO = BIO_new_mem_buf(keyString, keyStringLength)); - rsa = p_loader(stringBIO, NULL, NULL, NULL); + rsa = p_loader(stringBIO, NULL, NULL, passwordString); CHECK_OPEN_SSL(BIO_set_close(stringBIO, BIO_CLOSE) == 1); BIO_free(stringBIO); @@ -219,7 +229,18 @@ SV* key_string_SV; CODE: RETVAL = make_rsa_obj( - proto, _load_rsa_key(key_string_SV, PEM_read_bio_RSAPrivateKey)); + proto, _load_rsa_key(key_string_SV, &PL_sv_undef, PEM_read_bio_RSAPrivateKey)); + OUTPUT: + RETVAL + +SV* +new_private_key_with_password(proto, key_string_SV, password_string_SV) + SV* proto; + SV* key_string_SV; + SV* password_string_SV; + CODE: + RETVAL = make_rsa_obj( + proto, _load_rsa_key(key_string_SV, password_string_SV, PEM_read_bio_RSAPrivateKey)); OUTPUT: RETVAL @@ -229,7 +250,7 @@ SV* key_string_SV; CODE: RETVAL = make_rsa_obj( - proto, _load_rsa_key(key_string_SV, PEM_read_bio_RSAPublicKey)); + proto, _load_rsa_key(key_string_SV, &PL_sv_undef, PEM_read_bio_RSAPublicKey)); OUTPUT: RETVAL @@ -239,7 +260,7 @@ SV* key_string_SV; CODE: RETVAL = make_rsa_obj( - proto, _load_rsa_key(key_string_SV, PEM_read_bio_RSA_PUBKEY)); + proto, _load_rsa_key(key_string_SV, &PL_sv_undef, PEM_read_bio_RSA_PUBKEY)); OUTPUT: RETVAL

Sun Nov 01 13:23:24 2009 iroberts+perl [...] red-bean.com - Correspondence added

On Mon Jun 29 18:37:22 2009, HACHI wrote: Show quoted text

> I'd like to be able to load encrypted private keys using this module. > I've implmented at least one way to do this, and the patch is attached. > Is it possible for this to get into the released module? > > Thanks > > --hachi

This looks like a go start, but it seems incomplete. If the module can read encrypted passwords, it should also be able to write them; this would also allow for adding unit test coverage of your new methods to t/rsa.t. Finally, it would be good to add perldoc to RSA.pm. - Ian

Sun Nov 01 13:23:25 2009 The RT System itself - Status changed from 'new' to 'open'

Wed Apr 13 18:21:25 2011 sog [...] msg.com.mx - Correspondence added

I just uploaded to CPAN a new Crypt::OpenSSL::Common module. Among other things, it properly initializes the openssl libraries, that results in that Crypt::OpenSSL::RSA can now load encrypted private keys without any code modifications using openssl's default prompting. Please give it a try, and report to me any success/failures. Thanks. Sortiz.

Mon Jan 19 01:13:15 2015 daveh [...] hodgkinson.org - Correspondence added

Not relevant to this module.

Mon Jan 19 12:19:02 2015 TODDR [...] cpan.org - Correspondence added

Most recent comment in the ticket implies we uploaded a fix in 2011 with no reply.

Mon Jan 19 12:19:03 2015 TODDR [...] cpan.org - Status changed from 'open' to 'resolved'

Sat Jan 02 13:50:30 2016 tlhackque [...] yahoo.com - Status changed from 'resolved' to 'open'

Sat Jan 02 14:23:02 2016 tlhackque [...] yahoo.com - Correspondence added

From:

tlhackque [...] yahoo.com

On Mon Jan 19 12:19:02 2015, TODDR wrote: Show quoted text

> Most recent comment in the ticket implies we uploaded a fix in 2011 > with no reply.

I'm not the original reporter, but I thought I'd reopen this bug rather than file a new one. I agree that it would be useful to be able to read and write encrypted keys. I disagree with the "implied fix" because the description of Crypt::OpenSSL::Common says: "For example, the Crypt::OpenSSL::RSA's new_private_key class method now can handle encrypted private keys in the same way the C API does, ie. ** prompting the user** for the pass phrase used to protect the private key" Crypt::OpenSSL::RSA is useful in CGI scripts and other places where prompting is not possible. Well, I suppose one could redirect stdin & ignore the prompts -- but at that point, one might as well run an "openssl rsa" command in a subprocess. A solution to the problem would be of the form: new_private_key( $pem, [$password] ) and get_private_key_string( $encryption_method, $password ) (e.g. DES-EDE3-CBC, or perhaps a friendly alias...) Obviously, undef or omitted arguments should produce unencrypted keys as currently. (Supplying an un-needed password when reading can be ignored.) An encrypted private key file looks like: Show quoted text

-----END RSA PRIVATE KEY----- I'm not an XS coder, but here are some pointers that ought to be useful: https://www.openssl.org/docs/manmaster/crypto/pem.html describe the password callback routines. Crypt::OpenSSL::CA contains Crypt::OpenSSL::CA::PrivateKey, which knows how to read an encrypted PEM key. Unfortunately, it doesn't provide a means to export the key (encrypted or decrypted). Thanks for your (re-)consideration.

Mon Sep 24 15:37:24 2018 TODDR [...] cpan.org - Correspondence added

Ticket migrated to github as https://github.com/toddr/Crypt-OpenSSL-RSA/issues/19

Mon Sep 24 15:37:25 2018 TODDR [...] cpan.org - Status changed from 'open' to 'resolved'