5

When generating a key with openssl one can choose to encrypt the generated key using a password.

openssl genpkey -algorithm rsa -out rsa.key -aes-128-cbc

In this example AES 128 in CBC mode is used to encrypt the generated key in the file 'rsa.key'.

If one wants to use the key with openssl one has to provide the password.

openssl pkcs8 -in rsa.key
Enter Password:

Somehow openssl detects the key encryption algorithm. Is it possible with openssl to print out the encryption algorithm used for an encrypted key?

Improve this question
1
  • Not only generating; pkey (in 1.0.0 up, and pkcs12 (import)) and pkcs8 can create pkcs8-encrypted for an existing key. rsa dsa ec can convert to OpenSSL's 'legacy' PEM encryption, which is not nearly as good; see many existing Qs. Also answered by, though not quite a dupe of, security.stackexchange.com/questions/58425/…
    – dave_thompson_085
    Jul 28, 2020 at 3:16

1 Answer 1

Reset to default
4

You can parse the ASN.1 structure of the key file, this will include the algorithm used:

$ openssl genpkey -algorithm rsa -out rsa.key -aes-128-cbc
.........................................+++++
....................................................................+++++
Enter PEM pass phrase: foobar
Verifying - Enter PEM pass phrase: foobar
 
$ openssl asn1parse -in rsa.key |cut -b-90
    0:d=0  hl=4 l=1325 cons: SEQUENCE          
    4:d=1  hl=2 l=  87 cons: SEQUENCE          
    6:d=2  hl=2 l=   9 prim: OBJECT            :PBES2
   17:d=2  hl=2 l=  74 cons: SEQUENCE          
   19:d=3  hl=2 l=  41 cons: SEQUENCE          
   21:d=4  hl=2 l=   9 prim: OBJECT            :PBKDF2
   32:d=4  hl=2 l=  28 cons: SEQUENCE          
   34:d=5  hl=2 l=   8 prim: OCTET STRING      [HEX DUMP]:28E5C2C6CDFBE483
   44:d=5  hl=2 l=   2 prim: INTEGER           :0800
   48:d=5  hl=2 l=  12 cons: SEQUENCE          
   50:d=6  hl=2 l=   8 prim: OBJECT            :hmacWithSHA256
   60:d=6  hl=2 l=   0 prim: NULL              
   62:d=3  hl=2 l=  29 cons: SEQUENCE          
   64:d=4  hl=2 l=   9 prim: OBJECT            :aes-128-cbc      <=========
   75:d=4  hl=2 l=  16 prim: OCTET STRING      [HEX DUMP]:7FEB38B0D1568721F586F317E1EADF2F
   93:d=1  hl=4 l=1232 prim: OCTET STRING      [HEX DUMP]:D7D14657999BD0485DE9C4423A9FFEB2
Improve this answer
1
  • OpenSSL 1.1.x uses hmac-sha256 in PBKDF2 for keys, but 1.0.x uses hmac-sha1 which is the default and does not appear in the encoding. The symmetric cipher does appear in all cases.
    – dave_thompson_085
    Jul 28, 2020 at 3:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .