How to read a PEM RSA private key from NET

Question

I ve got an RSA private key in PEM format  is there a straight forward way to read that from  NET and instantiate an RSACryptoServiceProvider to decrypt data encrypted with the corresponding public key

User · Answer

I ve created the PemUtils library that does exactly that  The code is available on GitHub and can be installed from NuGet   PM gt  Install-Package PemUtils   or if you only want a DER converter   PM gt  Install-Package DerConverter   Usage for reading a RSA key from PEM data   using  var stream   File OpenRead path   using  var reader   new PemReader stream         var rsaParameters   reader ReadRsaKey

User · Answer

You might take a look at JavaScience s source for OpenSSLKey  There s code in there that does exactly what you want to do   In fact  they have a lot of crypto source code available here     Source code snippet     ------- Parses binary ans 1 RSA private key  returns RSACryptoServiceProvider  --- public static RSACryptoServiceProvider DecodeRSAPrivateKey byte   privkey            byte   MODULUS  E  D  P  Q  DP  DQ  IQ               ---------  Set up stream to decode the asn 1 encoded RSA private key  ------         MemoryStream  mem   new MemoryStream privkey            BinaryReader binr   new BinaryReader mem         wrap Memory Stream with BinaryReader for easy reading         byte bt   0          ushort twobytes   0          int elems   0          try                   twobytes   binr ReadUInt16                    if  twobytes    0x8130    data read as little endian order  actual data order for Sequence is 30 81                          binr ReadByte             advance 1 byte                 else if  twobytes    0x8230                          binr ReadInt16            advance 2 bytes                 else                         return null                   twobytes   binr ReadUInt16                    if  twobytes    0x0102    version number                         return null                  bt   binr ReadByte                    if  bt   0x00                          return null                      ------  all private key components are Integer sequences ----                 elems   GetIntegerSize binr                   MODULUS   binr ReadBytes elems                    elems   GetIntegerSize binr                   E   binr ReadBytes elems                     elems   GetIntegerSize binr                   D   binr ReadBytes elems                     elems   GetIntegerSize binr                   P   binr ReadBytes elems                     elems   GetIntegerSize binr                   Q   binr ReadBytes elems                     elems   GetIntegerSize binr                   DP   binr ReadBytes elems                     elems   GetIntegerSize binr                   DQ   binr ReadBytes elems                     elems   GetIntegerSize binr                   IQ   binr ReadBytes elems                     Console WriteLine  showing components                       if  verbose                            showBytes   nModulus   MODULUS                            showBytes   nExponent   E                           showBytes   nD   D                           showBytes   nP   P                           showBytes   nQ   Q                           showBytes   nDP   DP                           showBytes   nDQ   DQ                           showBytes   nIQ   IQ                                         ------- create RSACryptoServiceProvider instance and initialize with public key -----                 RSACryptoServiceProvider RSA   new RSACryptoServiceProvider                    RSAParameters RSAparams   new RSAParameters                    RSAparams Modulus  MODULUS                  RSAparams Exponent   E                  RSAparams D   D                  RSAparams P   P                  RSAparams Q   Q                  RSAparams DP   DP                  RSAparams DQ   DQ                  RSAparams InverseQ   IQ                  RSA ImportParameters RSAparams                   return RSA                    catch  Exception                    return null                    finally                   binr Close

User · Answer

I ve created the PemUtils library that does exactly that  The code is available on GitHub and can be installed from NuGet   PM gt  Install-Package PemUtils   or if you only want a DER converter   PM gt  Install-Package DerConverter   Usage for reading a RSA key from PEM data   using  var stream   File OpenRead path   using  var reader   new PemReader stream         var rsaParameters   reader ReadRsaKey

User · Answer

Check http   msdn microsoft com en-us library dd203099 aspx  under Cryptography Application Block   Don t know if you will get your answer  but it s worth a try   Edit after Comment   Ok then check this code   using System Security Cryptography    public static string DecryptEncryptedData stringBase64EncryptedData  stringPathToPrivateKeyFile         X509Certificate2 myCertificate       try           myCertificate   new X509Certificate2 PathToPrivateKeyFile          catch           throw new CryptographicException  Unable to open key file                  RSACryptoServiceProvider rsaObj       if myCertificate HasPrivateKey              rsaObj    RSACryptoServiceProvider myCertificate PrivateKey         else          throw new CryptographicException  Private key not contained within certificate           if rsaObj    null           return String Empty        byte   decryptedBytes       try           decryptedBytes   rsaObj Decrypt Convert FromBase64String Base64EncryptedData   false          catch            throw new CryptographicException  Unable to decrypt data                        Check to make sure we decrpyted the string     if decryptedBytes Length    0           return String Empty       else          return System Text Encoding UTF8 GetString decryptedBytes

User · Answer

With respect to easily importing the RSA private key  without using 3rd party code such as BouncyCastle  I think the answer is  No  not with a PEM of the private key alone    However  as alluded to above by Simone  you can simply combine the PEM of the private key    key  and the certificate file using that key    crt  into a   pfx file which can then be easily imported   To generate the PFX file from the command line   openssl pkcs12 -in a crt -inkey a key -export -out a pfx   Then use normally with the  NET certificate class such as   using System Security Cryptography X509Certificates   X509Certificate2 combinedCertificate   new X509Certificate2   C  path to file pfx      Now you can follow the example from MSDN for encrypting and decrypting via RSACryptoServiceProvider   I left out that for decrypting you would need to import using the PFX password and the Exportable flag    see  BouncyCastle RSAPrivateKey to  NET RSAPrivateKey   X509KeyStorageFlags flags   X509KeyStorageFlags Exportable  X509Certificate2 cert   new X509Certificate2  my pfx    somepass   flags    RSACryptoServiceProvider rsa    RSACryptoServiceProvider cert PrivateKey  RSAParameters rsaParam   rsa ExportParameters true

User · Answer

I solved  thanks  In case anyone s interested  bouncycastle did the trick  just took me some time due to lack of knowledge from on my side and documentation  This is the code   var bytesToDecrypt   Convert FromBase64String  la0Cz     D43g         string to decrypt  base64 encoded  AsymmetricCipherKeyPair keyPair    using  var reader   File OpenText   c  myprivatekey pem       file containing RSA PKCS1 private key     keyPair    AsymmetricCipherKeyPair  new PemReader reader  ReadObject      var decryptEngine   new Pkcs1Encoding new RsaEngine     decryptEngine Init false  keyPair Private     var decrypted   Encoding UTF8 GetString decryptEngine ProcessBlock bytesToDecrypt  0  bytesToDecrypt Length

User · Answer

You might take a look at JavaScience s source for OpenSSLKey  There s code in there that does exactly what you want to do   In fact  they have a lot of crypto source code available here     Source code snippet     ------- Parses binary ans 1 RSA private key  returns RSACryptoServiceProvider  --- public static RSACryptoServiceProvider DecodeRSAPrivateKey byte   privkey            byte   MODULUS  E  D  P  Q  DP  DQ  IQ               ---------  Set up stream to decode the asn 1 encoded RSA private key  ------         MemoryStream  mem   new MemoryStream privkey            BinaryReader binr   new BinaryReader mem         wrap Memory Stream with BinaryReader for easy reading         byte bt   0          ushort twobytes   0          int elems   0          try                   twobytes   binr ReadUInt16                    if  twobytes    0x8130    data read as little endian order  actual data order for Sequence is 30 81                          binr ReadByte             advance 1 byte                 else if  twobytes    0x8230                          binr ReadInt16            advance 2 bytes                 else                         return null                   twobytes   binr ReadUInt16                    if  twobytes    0x0102    version number                         return null                  bt   binr ReadByte                    if  bt   0x00                          return null                      ------  all private key components are Integer sequences ----                 elems   GetIntegerSize binr                   MODULUS   binr ReadBytes elems                    elems   GetIntegerSize binr                   E   binr ReadBytes elems                     elems   GetIntegerSize binr                   D   binr ReadBytes elems                     elems   GetIntegerSize binr                   P   binr ReadBytes elems                     elems   GetIntegerSize binr                   Q   binr ReadBytes elems                     elems   GetIntegerSize binr                   DP   binr ReadBytes elems                     elems   GetIntegerSize binr                   DQ   binr ReadBytes elems                     elems   GetIntegerSize binr                   IQ   binr ReadBytes elems                     Console WriteLine  showing components                       if  verbose                            showBytes   nModulus   MODULUS                            showBytes   nExponent   E                           showBytes   nD   D                           showBytes   nP   P                           showBytes   nQ   Q                           showBytes   nDP   DP                           showBytes   nDQ   DQ                           showBytes   nIQ   IQ                                         ------- create RSACryptoServiceProvider instance and initialize with public key -----                 RSACryptoServiceProvider RSA   new RSACryptoServiceProvider                    RSAParameters RSAparams   new RSAParameters                    RSAparams Modulus  MODULUS                  RSAparams Exponent   E                  RSAparams D   D                  RSAparams P   P                  RSAparams Q   Q                  RSAparams DP   DP                  RSAparams DQ   DQ                  RSAparams InverseQ   IQ                  RSA ImportParameters RSAparams                   return RSA                    catch  Exception                    return null                    finally                   binr Close

User · Answer

I ve tried the accepted answer for PEM-encoded PKCS 8 RSA private key and it resulted in PemException with malformed sequence in RSA private key message  The reason is that Org BouncyCastle OpenSsl PemReader seems to only support PKCS 1 private keys   I was able to get the private key by switching to Org BouncyCastle Utilities IO Pem PemReader  note that type names match   like this  private static RSAParameters GetRsaParameters string rsaPrivateKey        var byteArray   Encoding ASCII GetBytes rsaPrivateKey       using  var ms   new MemoryStream byteArray                 using  var sr   new StreamReader ms                         var pemReader   new Org BouncyCastle Utilities IO Pem PemReader sr               var pem   pemReader ReadPemObject                var privateKey   PrivateKeyFactory CreateKey pem Content                return DotNetUtilities ToRSAParameters privateKey as RsaPrivateCrtKeyParameters

User · Answer

I solved  thanks  In case anyone s interested  bouncycastle did the trick  just took me some time due to lack of knowledge from on my side and documentation  This is the code   var bytesToDecrypt   Convert FromBase64String  la0Cz     D43g         string to decrypt  base64 encoded  AsymmetricCipherKeyPair keyPair    using  var reader   File OpenText   c  myprivatekey pem       file containing RSA PKCS1 private key     keyPair    AsymmetricCipherKeyPair  new PemReader reader  ReadObject      var decryptEngine   new Pkcs1Encoding new RsaEngine     decryptEngine Init false  keyPair Private     var decrypted   Encoding UTF8 GetString decryptEngine ProcessBlock bytesToDecrypt  0  bytesToDecrypt Length

User · Answer

The stuff between the   -----BEGIN RSA PRIVATE KEY----    and   -----END RSA PRIVATE KEY-----    is the base64 encoding of a PKCS 8 PrivateKeyInfo  unless it says RSA ENCRYPTED PRIVATE KEY in which case it is a EncryptedPrivateKeyInfo    It is not that hard to decode manually  but otherwise your best bet is to P Invoke to CryptImportPKCS8     Update  The CryptImportPKCS8 function is no longer available for use as of Windows Server 2008 and Windows Vista  Instead  use the PFXImportCertStore function

User · Answer

I ve tried the accepted answer for PEM-encoded PKCS 8 RSA private key and it resulted in PemException with malformed sequence in RSA private key message  The reason is that Org BouncyCastle OpenSsl PemReader seems to only support PKCS 1 private keys   I was able to get the private key by switching to Org BouncyCastle Utilities IO Pem PemReader  note that type names match   like this  private static RSAParameters GetRsaParameters string rsaPrivateKey        var byteArray   Encoding ASCII GetBytes rsaPrivateKey       using  var ms   new MemoryStream byteArray                 using  var sr   new StreamReader ms                         var pemReader   new Org BouncyCastle Utilities IO Pem PemReader sr               var pem   pemReader ReadPemObject                var privateKey   PrivateKeyFactory CreateKey pem Content                return DotNetUtilities ToRSAParameters privateKey as RsaPrivateCrtKeyParameters

User · Answer

You might take a look at JavaScience s source for OpenSSLKey  There s code in there that does exactly what you want to do   In fact  they have a lot of crypto source code available here     Source code snippet     ------- Parses binary ans 1 RSA private key  returns RSACryptoServiceProvider  --- public static RSACryptoServiceProvider DecodeRSAPrivateKey byte   privkey            byte   MODULUS  E  D  P  Q  DP  DQ  IQ               ---------  Set up stream to decode the asn 1 encoded RSA private key  ------         MemoryStream  mem   new MemoryStream privkey            BinaryReader binr   new BinaryReader mem         wrap Memory Stream with BinaryReader for easy reading         byte bt   0          ushort twobytes   0          int elems   0          try                   twobytes   binr ReadUInt16                    if  twobytes    0x8130    data read as little endian order  actual data order for Sequence is 30 81                          binr ReadByte             advance 1 byte                 else if  twobytes    0x8230                          binr ReadInt16            advance 2 bytes                 else                         return null                   twobytes   binr ReadUInt16                    if  twobytes    0x0102    version number                         return null                  bt   binr ReadByte                    if  bt   0x00                          return null                      ------  all private key components are Integer sequences ----                 elems   GetIntegerSize binr                   MODULUS   binr ReadBytes elems                    elems   GetIntegerSize binr                   E   binr ReadBytes elems                     elems   GetIntegerSize binr                   D   binr ReadBytes elems                     elems   GetIntegerSize binr                   P   binr ReadBytes elems                     elems   GetIntegerSize binr                   Q   binr ReadBytes elems                     elems   GetIntegerSize binr                   DP   binr ReadBytes elems                     elems   GetIntegerSize binr                   DQ   binr ReadBytes elems                     elems   GetIntegerSize binr                   IQ   binr ReadBytes elems                     Console WriteLine  showing components                       if  verbose                            showBytes   nModulus   MODULUS                            showBytes   nExponent   E                           showBytes   nD   D                           showBytes   nP   P                           showBytes   nQ   Q                           showBytes   nDP   DP                           showBytes   nDQ   DQ                           showBytes   nIQ   IQ                                         ------- create RSACryptoServiceProvider instance and initialize with public key -----                 RSACryptoServiceProvider RSA   new RSACryptoServiceProvider                    RSAParameters RSAparams   new RSAParameters                    RSAparams Modulus  MODULUS                  RSAparams Exponent   E                  RSAparams D   D                  RSAparams P   P                  RSAparams Q   Q                  RSAparams DP   DP                  RSAparams DQ   DQ                  RSAparams InverseQ   IQ                  RSA ImportParameters RSAparams                   return RSA                    catch  Exception                    return null                    finally                   binr Close

User · Answer

For people who don t want to use Bouncy  and are trying some of the code included in other answers  I ve found that the code works MOST of the time  but trips up on some RSA private strings  such as the one I ve included below  By looking at the bouncy code  I tweaked the code provided by wprl to       RSAparams D   ConvertRSAParametersField D  MODULUS Length       RSAparams DP   ConvertRSAParametersField DP  P Length       RSAparams DQ   ConvertRSAParametersField DQ  Q Length       RSAparams InverseQ   ConvertRSAParametersField IQ  Q Length        private static byte   ConvertRSAParametersField byte   bs  int size                if  bs Length    size              return bs           if  bs Length  gt  size              throw new ArgumentException  Specified size too small    size             byte   padded   new byte size           Array Copy bs  0  padded  size - bs Length  bs Length           return padded         -----BEGIN RSA PRIVATE KEY----- MIIEoQIBAAKCAQEAxCgWAYJtfKBVa6Px1Blrj 3Wq7LVXDzx MiQFrLCHnou2Fvb fxuDeRmd6ERhDWnsY6dxxm981vTlXukvYKpIZQYpiSzL5pyUutoi3yh0  dVlsHZ UHheVGZjSMgUagUCLX1p augXltAjgblUsj8GFBoKJBr3TMKuR5TwF7lBNYZlaiR k9MDZTROk6MBGiHEgD5RaPKA ot02j3CnSGbGNNubN2tyXXAgk8 wBmZ4avT0U4y 5oiO9iwCF Hj9gK S 8Q2lRsSppgUSsCioSg1CpdleYzIlCB0li1T0flB51zRIpg JhWRfmK1uTLklU33xfzR8zO2kkfaXoPTHSdOGQIDAQABAoIBAAkhfzoSwttKRgT8 sgUYKdRJU0oqyO5s59aXf3LkX0 L4HexzvCGbK2hGPihi42poJdYSV4zUlxZ31N2 XKjjRFDE41S Vmklthv8i3hX1G Q09XGBZekAsAVrrQfRtP957FhD83 GeKf3MwV Bhe GKezwSV3k43NvRy2N1p9EFa i7eq1e5i7MyDxgKmja5YgADHb8izGLx8Smdd  v8EhWkFOcaPnQRj LhSi30v CjYh9MkxHMdi0pHMMCXleiUK0Du6tnsB8ewoHR3 oBzL4F5WKyNHPvesYplgTlpMiT0uUuN8 9Pq6qsdUiXs0wdFYbs693mUMekLQ4a  1FOWvQECgYEA7R uI1r4oP82sTCOCPqPi fXMTIOGkN0x 1vyMXUVvTH5zbwPp9E 0lG6XmJ95alMRhjvFGMiCONQiSNOQ9Pec5TZfVn3M w7QTMZ6QcWd6mjghc dGGE URmCx8xaJb847vACir7M08AhPEt s2C7ZokafPCoGe0qw OD1fLt3NMCgYEA08WK S G7dbCvFMrBP8SlmrnK4f5CRE3pV4VGneWp EqJgNnWwaBCvUTIegDlqS955yVp q7nVpolAJCmlUVmwDt4gHJsWXSQLMXy3pwQ25vdnoPe97y3xXsi0KQqEuRjD1vmw K7SXoQqQeSf4z74pFal4CP38U3pivvoE4MQmJeMCfyJFceWqQEUEneL IYkqrZSK 7Y8urNse5MIC3yUlcose1cWVKyPh4RCEv2rk0U1gKqX29Jb9vO2L7RflAmrLNFuA J 72EcRxsB68RAJqA9VHr1oeAejQL0 JYF2AK4dJG FsvvFOokv4eNU FBHY6Tzo k t63NDidkvb5jIF6lsCgYEAlnQ08f5Y8Z9qdCosq8JpKYkwM kxaVe1HUIJzqpZ X24RTOL3aa8TW2afy9YRVGbvg6IX9jJcMSo30Llpw2cl5xo21Dv24ot2DF2gGN s peFF1Z3Naj1Iy99p5 KaIusOUBAq8pImW qmc 1LD0T56XLyXekcuK4ts6Lrjkit FaMCgYAusOLTsRgKdgdDNI8nMQB9iSliwHAG1TqzB56S11pl fdv9Mkbo8vrx6g0 NM4DluCGNEqLZb3IkasXXdok9e8kmX1en1lb5GjyPbc zFda6eZrwIqMX9Y68eNR IWDUM3ckwpw3rcuFXjFfa w44JZVIsgdoGHiXAdrhtlG i98Rw   -----END RSA PRIVATE KEY-----

User · Answer

Check http   msdn microsoft com en-us library dd203099 aspx  under Cryptography Application Block   Don t know if you will get your answer  but it s worth a try   Edit after Comment   Ok then check this code   using System Security Cryptography    public static string DecryptEncryptedData stringBase64EncryptedData  stringPathToPrivateKeyFile         X509Certificate2 myCertificate       try           myCertificate   new X509Certificate2 PathToPrivateKeyFile          catch           throw new CryptographicException  Unable to open key file                  RSACryptoServiceProvider rsaObj       if myCertificate HasPrivateKey              rsaObj    RSACryptoServiceProvider myCertificate PrivateKey         else          throw new CryptographicException  Private key not contained within certificate           if rsaObj    null           return String Empty        byte   decryptedBytes       try           decryptedBytes   rsaObj Decrypt Convert FromBase64String Base64EncryptedData   false          catch            throw new CryptographicException  Unable to decrypt data                        Check to make sure we decrpyted the string     if decryptedBytes Length    0           return String Empty       else          return System Text Encoding UTF8 GetString decryptedBytes

User · Answer

Check http   msdn microsoft com en-us library dd203099 aspx  under Cryptography Application Block   Don t know if you will get your answer  but it s worth a try   Edit after Comment   Ok then check this code   using System Security Cryptography    public static string DecryptEncryptedData stringBase64EncryptedData  stringPathToPrivateKeyFile         X509Certificate2 myCertificate       try           myCertificate   new X509Certificate2 PathToPrivateKeyFile          catch           throw new CryptographicException  Unable to open key file                  RSACryptoServiceProvider rsaObj       if myCertificate HasPrivateKey              rsaObj    RSACryptoServiceProvider myCertificate PrivateKey         else          throw new CryptographicException  Private key not contained within certificate           if rsaObj    null           return String Empty        byte   decryptedBytes       try           decryptedBytes   rsaObj Decrypt Convert FromBase64String Base64EncryptedData   false          catch            throw new CryptographicException  Unable to decrypt data                        Check to make sure we decrpyted the string     if decryptedBytes Length    0           return String Empty       else          return System Text Encoding UTF8 GetString decryptedBytes

User · Answer

I solved  thanks  In case anyone s interested  bouncycastle did the trick  just took me some time due to lack of knowledge from on my side and documentation  This is the code   var bytesToDecrypt   Convert FromBase64String  la0Cz     D43g         string to decrypt  base64 encoded  AsymmetricCipherKeyPair keyPair    using  var reader   File OpenText   c  myprivatekey pem       file containing RSA PKCS1 private key     keyPair    AsymmetricCipherKeyPair  new PemReader reader  ReadObject      var decryptEngine   new Pkcs1Encoding new RsaEngine     decryptEngine Init false  keyPair Private     var decrypted   Encoding UTF8 GetString decryptEngine ProcessBlock bytesToDecrypt  0  bytesToDecrypt Length

User · Answer

The stuff between the   -----BEGIN RSA PRIVATE KEY----    and   -----END RSA PRIVATE KEY-----    is the base64 encoding of a PKCS 8 PrivateKeyInfo  unless it says RSA ENCRYPTED PRIVATE KEY in which case it is a EncryptedPrivateKeyInfo    It is not that hard to decode manually  but otherwise your best bet is to P Invoke to CryptImportPKCS8     Update  The CryptImportPKCS8 function is no longer available for use as of Windows Server 2008 and Windows Vista  Instead  use the PFXImportCertStore function

User · Answer

Check http   msdn microsoft com en-us library dd203099 aspx  under Cryptography Application Block   Don t know if you will get your answer  but it s worth a try   Edit after Comment   Ok then check this code   using System Security Cryptography    public static string DecryptEncryptedData stringBase64EncryptedData  stringPathToPrivateKeyFile         X509Certificate2 myCertificate       try           myCertificate   new X509Certificate2 PathToPrivateKeyFile          catch           throw new CryptographicException  Unable to open key file                  RSACryptoServiceProvider rsaObj       if myCertificate HasPrivateKey              rsaObj    RSACryptoServiceProvider myCertificate PrivateKey         else          throw new CryptographicException  Private key not contained within certificate           if rsaObj    null           return String Empty        byte   decryptedBytes       try           decryptedBytes   rsaObj Decrypt Convert FromBase64String Base64EncryptedData   false          catch            throw new CryptographicException  Unable to decrypt data                        Check to make sure we decrpyted the string     if decryptedBytes Length    0           return String Empty       else          return System Text Encoding UTF8 GetString decryptedBytes

User · Answer

ok  Im using mac to generate my self signed keys  Here is the working method I used   I created a shell script to speed up my key generation   genkey sh    bin sh  ssh-keygen -f host key openssl req -new -key host key -out request csr openssl x509 -req -days 99999 -in request csr -signkey host key -out server crt openssl pkcs12 -export -inkey host key -in server crt -out private public p12 -name  SslCert  openssl base64 -in private public p12 -out Base64 key   add the  x execute flag to the script  chmod  x genkey sh   then call genkey sh    genkey sh   I enter a password  important to include a password at least for the export at the end   Enter pass phrase for host key  Enter Export Password     Important to enter a password here  Verifying - Enter Export Password    Same password here     I then take everything in Base64 Key and put it into a string named sslKey  private string sslKey    MIIJiAIBA                                                                                       ETC                                                                       ETC                                                                       ETC                                                              ugICCAA      I then used a lazy load Property getter to get my X509 Cert with a private key   X509Certificate2  serverCertificate   null  X509Certificate2 serverCertificate      get               if   serverCertificate    null               string pass    Your Export Password Here                serverCertificate   new X509Certificate Convert FromBase64String sslKey   pass  X509KeyStorageFlags Exportable                     return  serverCertificate            I wanted to go this route because I am using  net 2 0 and Mono on mac and I wanted to use vanilla Framework code with no compiled libraries or dependencies    My final use for this was the SslStream to secure TCP communication to my app   SslStream sslStream   new SslStream serverCertificate  false  SslProtocols Tls  true     I hope this helps other people   NOTE  Without a password I was unable to correctly unlock the private key for export

User · Answer

ok  Im using mac to generate my self signed keys  Here is the working method I used   I created a shell script to speed up my key generation   genkey sh    bin sh  ssh-keygen -f host key openssl req -new -key host key -out request csr openssl x509 -req -days 99999 -in request csr -signkey host key -out server crt openssl pkcs12 -export -inkey host key -in server crt -out private public p12 -name  SslCert  openssl base64 -in private public p12 -out Base64 key   add the  x execute flag to the script  chmod  x genkey sh   then call genkey sh    genkey sh   I enter a password  important to include a password at least for the export at the end   Enter pass phrase for host key  Enter Export Password     Important to enter a password here  Verifying - Enter Export Password    Same password here     I then take everything in Base64 Key and put it into a string named sslKey  private string sslKey    MIIJiAIBA                                                                                       ETC                                                                       ETC                                                                       ETC                                                              ugICCAA      I then used a lazy load Property getter to get my X509 Cert with a private key   X509Certificate2  serverCertificate   null  X509Certificate2 serverCertificate      get               if   serverCertificate    null               string pass    Your Export Password Here                serverCertificate   new X509Certificate Convert FromBase64String sslKey   pass  X509KeyStorageFlags Exportable                     return  serverCertificate            I wanted to go this route because I am using  net 2 0 and Mono on mac and I wanted to use vanilla Framework code with no compiled libraries or dependencies    My final use for this was the SslStream to secure TCP communication to my app   SslStream sslStream   new SslStream serverCertificate  false  SslProtocols Tls  true     I hope this helps other people   NOTE  Without a password I was unable to correctly unlock the private key for export

User · Answer

The stuff between the   -----BEGIN RSA PRIVATE KEY----    and   -----END RSA PRIVATE KEY-----    is the base64 encoding of a PKCS 8 PrivateKeyInfo  unless it says RSA ENCRYPTED PRIVATE KEY in which case it is a EncryptedPrivateKeyInfo    It is not that hard to decode manually  but otherwise your best bet is to P Invoke to CryptImportPKCS8     Update  The CryptImportPKCS8 function is no longer available for use as of Windows Server 2008 and Windows Vista  Instead  use the PFXImportCertStore function

User · Answer

With respect to easily importing the RSA private key  without using 3rd party code such as BouncyCastle  I think the answer is  No  not with a PEM of the private key alone    However  as alluded to above by Simone  you can simply combine the PEM of the private key    key  and the certificate file using that key    crt  into a   pfx file which can then be easily imported   To generate the PFX file from the command line   openssl pkcs12 -in a crt -inkey a key -export -out a pfx   Then use normally with the  NET certificate class such as   using System Security Cryptography X509Certificates   X509Certificate2 combinedCertificate   new X509Certificate2   C  path to file pfx      Now you can follow the example from MSDN for encrypting and decrypting via RSACryptoServiceProvider   I left out that for decrypting you would need to import using the PFX password and the Exportable flag    see  BouncyCastle RSAPrivateKey to  NET RSAPrivateKey   X509KeyStorageFlags flags   X509KeyStorageFlags Exportable  X509Certificate2 cert   new X509Certificate2  my pfx    somepass   flags    RSACryptoServiceProvider rsa    RSACryptoServiceProvider cert PrivateKey  RSAParameters rsaParam   rsa ExportParameters true

User · Answer

The stuff between the   -----BEGIN RSA PRIVATE KEY----    and   -----END RSA PRIVATE KEY-----    is the base64 encoding of a PKCS 8 PrivateKeyInfo  unless it says RSA ENCRYPTED PRIVATE KEY in which case it is a EncryptedPrivateKeyInfo    It is not that hard to decode manually  but otherwise your best bet is to P Invoke to CryptImportPKCS8     Update  The CryptImportPKCS8 function is no longer available for use as of Windows Server 2008 and Windows Vista  Instead  use the PFXImportCertStore function

User · Answer

For people who don t want to use Bouncy  and are trying some of the code included in other answers  I ve found that the code works MOST of the time  but trips up on some RSA private strings  such as the one I ve included below  By looking at the bouncy code  I tweaked the code provided by wprl to       RSAparams D   ConvertRSAParametersField D  MODULUS Length       RSAparams DP   ConvertRSAParametersField DP  P Length       RSAparams DQ   ConvertRSAParametersField DQ  Q Length       RSAparams InverseQ   ConvertRSAParametersField IQ  Q Length        private static byte   ConvertRSAParametersField byte   bs  int size                if  bs Length    size              return bs           if  bs Length  gt  size              throw new ArgumentException  Specified size too small    size             byte   padded   new byte size           Array Copy bs  0  padded  size - bs Length  bs Length           return padded         -----BEGIN RSA PRIVATE KEY----- MIIEoQIBAAKCAQEAxCgWAYJtfKBVa6Px1Blrj 3Wq7LVXDzx MiQFrLCHnou2Fvb fxuDeRmd6ERhDWnsY6dxxm981vTlXukvYKpIZQYpiSzL5pyUutoi3yh0  dVlsHZ UHheVGZjSMgUagUCLX1p augXltAjgblUsj8GFBoKJBr3TMKuR5TwF7lBNYZlaiR k9MDZTROk6MBGiHEgD5RaPKA ot02j3CnSGbGNNubN2tyXXAgk8 wBmZ4avT0U4y 5oiO9iwCF Hj9gK S 8Q2lRsSppgUSsCioSg1CpdleYzIlCB0li1T0flB51zRIpg JhWRfmK1uTLklU33xfzR8zO2kkfaXoPTHSdOGQIDAQABAoIBAAkhfzoSwttKRgT8 sgUYKdRJU0oqyO5s59aXf3LkX0 L4HexzvCGbK2hGPihi42poJdYSV4zUlxZ31N2 XKjjRFDE41S Vmklthv8i3hX1G Q09XGBZekAsAVrrQfRtP957FhD83 GeKf3MwV Bhe GKezwSV3k43NvRy2N1p9EFa i7eq1e5i7MyDxgKmja5YgADHb8izGLx8Smdd  v8EhWkFOcaPnQRj LhSi30v CjYh9MkxHMdi0pHMMCXleiUK0Du6tnsB8ewoHR3 oBzL4F5WKyNHPvesYplgTlpMiT0uUuN8 9Pq6qsdUiXs0wdFYbs693mUMekLQ4a  1FOWvQECgYEA7R uI1r4oP82sTCOCPqPi fXMTIOGkN0x 1vyMXUVvTH5zbwPp9E 0lG6XmJ95alMRhjvFGMiCONQiSNOQ9Pec5TZfVn3M w7QTMZ6QcWd6mjghc dGGE URmCx8xaJb847vACir7M08AhPEt s2C7ZokafPCoGe0qw OD1fLt3NMCgYEA08WK S G7dbCvFMrBP8SlmrnK4f5CRE3pV4VGneWp EqJgNnWwaBCvUTIegDlqS955yVp q7nVpolAJCmlUVmwDt4gHJsWXSQLMXy3pwQ25vdnoPe97y3xXsi0KQqEuRjD1vmw K7SXoQqQeSf4z74pFal4CP38U3pivvoE4MQmJeMCfyJFceWqQEUEneL IYkqrZSK 7Y8urNse5MIC3yUlcose1cWVKyPh4RCEv2rk0U1gKqX29Jb9vO2L7RflAmrLNFuA J 72EcRxsB68RAJqA9VHr1oeAejQL0 JYF2AK4dJG FsvvFOokv4eNU FBHY6Tzo k t63NDidkvb5jIF6lsCgYEAlnQ08f5Y8Z9qdCosq8JpKYkwM kxaVe1HUIJzqpZ X24RTOL3aa8TW2afy9YRVGbvg6IX9jJcMSo30Llpw2cl5xo21Dv24ot2DF2gGN s peFF1Z3Naj1Iy99p5 KaIusOUBAq8pImW qmc 1LD0T56XLyXekcuK4ts6Lrjkit FaMCgYAusOLTsRgKdgdDNI8nMQB9iSliwHAG1TqzB56S11pl fdv9Mkbo8vrx6g0 NM4DluCGNEqLZb3IkasXXdok9e8kmX1en1lb5GjyPbc zFda6eZrwIqMX9Y68eNR IWDUM3ckwpw3rcuFXjFfa w44JZVIsgdoGHiXAdrhtlG i98Rw   -----END RSA PRIVATE KEY-----

User · Answer

You might take a look at JavaScience s source for OpenSSLKey  There s code in there that does exactly what you want to do   In fact  they have a lot of crypto source code available here     Source code snippet     ------- Parses binary ans 1 RSA private key  returns RSACryptoServiceProvider  --- public static RSACryptoServiceProvider DecodeRSAPrivateKey byte   privkey            byte   MODULUS  E  D  P  Q  DP  DQ  IQ               ---------  Set up stream to decode the asn 1 encoded RSA private key  ------         MemoryStream  mem   new MemoryStream privkey            BinaryReader binr   new BinaryReader mem         wrap Memory Stream with BinaryReader for easy reading         byte bt   0          ushort twobytes   0          int elems   0          try                   twobytes   binr ReadUInt16                    if  twobytes    0x8130    data read as little endian order  actual data order for Sequence is 30 81                          binr ReadByte             advance 1 byte                 else if  twobytes    0x8230                          binr ReadInt16            advance 2 bytes                 else                         return null                   twobytes   binr ReadUInt16                    if  twobytes    0x0102    version number                         return null                  bt   binr ReadByte                    if  bt   0x00                          return null                      ------  all private key components are Integer sequences ----                 elems   GetIntegerSize binr                   MODULUS   binr ReadBytes elems                    elems   GetIntegerSize binr                   E   binr ReadBytes elems                     elems   GetIntegerSize binr                   D   binr ReadBytes elems                     elems   GetIntegerSize binr                   P   binr ReadBytes elems                     elems   GetIntegerSize binr                   Q   binr ReadBytes elems                     elems   GetIntegerSize binr                   DP   binr ReadBytes elems                     elems   GetIntegerSize binr                   DQ   binr ReadBytes elems                     elems   GetIntegerSize binr                   IQ   binr ReadBytes elems                     Console WriteLine  showing components                       if  verbose                            showBytes   nModulus   MODULUS                            showBytes   nExponent   E                           showBytes   nD   D                           showBytes   nP   P                           showBytes   nQ   Q                           showBytes   nDP   DP                           showBytes   nDQ   DQ                           showBytes   nIQ   IQ                                         ------- create RSACryptoServiceProvider instance and initialize with public key -----                 RSACryptoServiceProvider RSA   new RSACryptoServiceProvider                    RSAParameters RSAparams   new RSAParameters                    RSAparams Modulus  MODULUS                  RSAparams Exponent   E                  RSAparams D   D                  RSAparams P   P                  RSAparams Q   Q                  RSAparams DP   DP                  RSAparams DQ   DQ                  RSAparams InverseQ   IQ                  RSA ImportParameters RSAparams                   return RSA                    catch  Exception                    return null                    finally                   binr Close

User · Answer

I solved  thanks  In case anyone s interested  bouncycastle did the trick  just took me some time due to lack of knowledge from on my side and documentation  This is the code   var bytesToDecrypt   Convert FromBase64String  la0Cz     D43g         string to decrypt  base64 encoded  AsymmetricCipherKeyPair keyPair    using  var reader   File OpenText   c  myprivatekey pem       file containing RSA PKCS1 private key     keyPair    AsymmetricCipherKeyPair  new PemReader reader  ReadObject      var decryptEngine   new Pkcs1Encoding new RsaEngine     decryptEngine Init false  keyPair Private     var decrypted   Encoding UTF8 GetString decryptEngine ProcessBlock bytesToDecrypt  0  bytesToDecrypt Length

[c#] How to read a PEM RSA private key from .NET

Examples related to c#

Examples related to .net

Examples related to cryptography

Examples related to rsa