Subject: RE: Encrypting private keys - how do you achieve this in practice ?

From: [email-masked]
Date: Fri, 26 May 2000 10:14:39 -0400

Christopher,

This is why I ask a similar question to Carlisle yesterday.

I hope that the type "PrivateKeyInfo" from Section 6 of PKCS#8 is what is
being used in reality in the EncryptedValue structure since it is also what
Section 11.9 of PKCS#11 v2.01 mandates for wrapping a private key:

"Cryptoki Version 2.01 allows the use of secret keys for wrapping and
unwrapping RSA private keys, Diffie-Hellman private keys, and DSA private
keys. For wrapping, a private key is BER-encoded according to PKCS #8's
PrivateKeyInfo ASN.1 type."

This way, as mandated by Appendix B2 of RFC 2510bis, a PKCS#8 encoded
private key would be wrap using the PROT_SYM_ALG symmetric encryption
algorithm (e.g. 3-DES, 3-key-EDE, CBC mode) and not a password wrapping as
you suggested. The symmetric key is then encrypted using a previously agreed
PROT_ENC_ALG asymmetric algorithm (e.g. Diffie-Hellman, RSA).

Francois
___________________________________
Francois Rousseau
Director of Standards and Conformance
Chrysalis-ITS
1688 Woodward Drive
Ottawa, Ontario, CANADA, K2C 3R7
[email-masked]      Tel. (613) 723-5076 ext. 419
http://www.chrysalis-its.com     Fax. (613) 723-5078

-----Original Message-----
From: Christopher Williams [mailto:[email-masked]]
Sent: Friday, May 26, 2000 6:35 AM
To: PKIX Mailing List
Subject: Encrypting private keys - how do you achieve this in practice?

When you encrypt a private key to put it in the EncryptedValue structure, it
appears from the standard that you take the private key octets as the plain
text and encrypt under the symmetric algorithm / symmetric key, etc.

There's a problem here.  Our implementation of RSA / DSA / DH, etc. does not
give out private keys in plain text and I guess that many other
implementations are the same.  We do support password wrapping of the
private key (e.g. PKCS#8) but the EncryptedValue structure does not seem to
be designed to take a password-wrapped key.

How do you reconcile PKCS#8 with the EncryptedValue structure?  For example,
I guess that you could supply the password as the symmetric key and encode
the EncryptedPrivateKeyInfo structure as a bit string, but what would then
be the symmetric algorithm?

How have other people implemented private key encryption?

Christopher Williams

Software engineer, NetLexis Ltd.
Solutions for secure electronic commerce
http://www.netlexis.com

---

From: [email-masked]
Date: Tue, 30 May 2000 12:07:33 -0400

Hi Dave,

As you are probably aware, the PKCS#11 wrapping function should be supported
by hardware cryptographic modules that are used to generate certificate
subject private keys in order for these private keys to be extracted and
exported to end entities since these private keys should never appear in
plaintext form outside of such hardware cryptographic modules.

Our hardware cryptographic modules, which are used by many PKI vendors,
support the standard PKCS#11 v2.01 wrapping and unwrapping functions to
export and import private keys. This implies the following steps according
to Section 11.9 of PKCS#11 for an RSA private key:

1. The RSA private key must first be BER-encoded according to PKCS #1's
RSAPrivateKey ASN.1 type. This type requires values to be present for all
the attributes specific to Cryptoki's RSA private key objects. In other
words, if a Cryptoki library does not have values for an RSA private key's
CKA_MODULUS, CKA_PUBLIC_EXPONENT, CKA_PRIVATE_EXPONENT, CKA_PRIME_1,
CKA_PRIME_2, CKA_EXPONENT_1, CKA_EXPONENT2, and CKA_COEFFICIENT values, it
cannot create an RSAPrivateKey BER-encoding of the key, and so it cannot
prepare it for wrapping;

2. The RSA private key is then BER-encoded according to PKCS #8's
PrivateKeyInfo ASN.1 type; and

3. The resulting string of bytes is encrypted with the secret key. This
encryption must be done in CBC mode with PKCS padding.

Do you mean by your response to Christopher that the PKCS#8 PrivateKeyInfo
type is what gets encrypted in the encValue field of the EncryptedValue
structure? If not, do you know what gets encrypted in the encValue field or
is it something that will need to be profiled under the upcoming CMP
testing?

Regards,

Francois

-----Original Message-----
From: David P. Kemp [mailto:[email-masked]]
Sent: Friday, May 26, 2000 11:48 AM
To: [email-masked]
Subject: Re: Encrypting private keys - how do you achieve this in
practice?

Christopher,

If your implementation always exports password-protected private
keys, and you don't want to (or can't, because it's in hardware)
touch the existing code, then you could just put some glue
around the module to unwrap the key with the password and
then wrap the plaintext key for the intended recipient in an
EnvelopedData structure, using
PKIArchiveOptions:encryptedPrivKey:envelopedData. Put the private key
in EnvelopedData:encryptedContentInfo:encryptedContent and set
EnvelopedData:encryptedContentInfo:contentType to id-data.

It isn't recommended (at least by me) to place a password-wrapped
private key directly in PKIArchiveOptions:encryptedPrivKey:encryptedValue.
But the straightforward approach to doing so would be to populate:

encryptedValue:symmAlg   - ???
encryptedValue:encValue  - BER of EncryptedPrivateKeyInfo

Fortunately, PKCS#8 does not define an OID for EncryptedPrivateKeyInfo,
as they obviously felt that this structure is never suitable for use
within another protocol :-).

Dave

> From: "Christopher Williams" <[email-masked]>
> To: "PKIX Mailing List" <[email-masked]>
> Date: Fri, 26 May 2000 11:35:06 +0100
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300
>