Subject: Encrypting private keys - how do you achieve this in practice?

From: "Christopher Williams" <[email-masked]>
Date: Fri, 26 May 2000 11:35:06 +0100

When you encrypt a private key to put it in the EncryptedValue structure, it
appears from the standard that you take the private key octets as the plain
text and encrypt under the symmetric algorithm / symmetric key, etc.

There's a problem here.  Our implementation of RSA / DSA / DH, etc. does not
give out private keys in plain text and I guess that many other
implementations are the same.  We do support password wrapping of the
private key (e.g. PKCS#8) but the EncryptedValue structure does not seem to
be designed to take a password-wrapped key.

How do you reconcile PKCS#8 with the EncryptedValue structure?  For example,
I guess that you could supply the password as the symmetric key and encode
the EncryptedPrivateKeyInfo structure as a bit string, but what would then
be the symmetric algorithm?

How have other people implemented private key encryption?

Christopher Williams

Software engineer, NetLexis Ltd.
Solutions for secure electronic commerce
http://www.netlexis.com

---

From: "David P. Kemp" <[email-masked]>
Date: Fri, 26 May 2000 11:47:41 -0400 (EDT)

Christopher,

If your implementation always exports password-protected private
keys, and you don't want to (or can't, because it's in hardware)
touch the existing code, then you could just put some glue
around the module to unwrap the key with the password and
then wrap the plaintext key for the intended recipient in an
EnvelopedData structure, using
PKIArchiveOptions:encryptedPrivKey:envelopedData. Put the private key
in EnvelopedData:encryptedContentInfo:encryptedContent and set
EnvelopedData:encryptedContentInfo:contentType to id-data.

It isn't recommended (at least by me) to place a password-wrapped
private key directly in PKIArchiveOptions:encryptedPrivKey:encryptedValue.
But the straightforward approach to doing so would be to populate:

encryptedValue:symmAlg   - ???
encryptedValue:encValue  - BER of EncryptedPrivateKeyInfo

Fortunately, PKCS#8 does not define an OID for EncryptedPrivateKeyInfo,
as they obviously felt that this structure is never suitable for use
within another protocol :-).

Dave

> From: "Christopher Williams" <[email-masked]>
> To: "PKIX Mailing List" <[email-masked]>
> Subject: Encrypting private keys - how do you achieve this in practice?
> Date: Fri, 26 May 2000 11:35:06 +0100
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300
>