c - 使用 KeyBlob(以字节格式存储)进行加密操作的任何可能性

Question

使用 openssl 创建 key blob。现在需要使用该 keyblob 使用 openssl 进行加密操作(例如加密、解密、签名和验证)。因此该代码将是独立于平台的。

// Assume that "private_key" is having private key
// keyBlob is a byte array of size 2048
// e,n,p,q,dmp1,dmq1,iqmp,d are of type BIGNUM* and initialized with NULL    

RSA* rsa = new RSA( );

rsa = EVP_PKEY_get1_RSA ( private_key );
if ( NULL == rsa )
{
    hResult = errno;
    printf("\n\tError:EVP_PKEY_get1_RSA failed\n\n");
    break;
} // if
else
{
    //printf("\n\tRSA private key generated successfully\n\n");
} // else

e = rsa->e;
n = rsa->n;
p = rsa->p;
q = rsa->q;
dmp1 = rsa->dmp1;
dmq1 = rsa->dmq1;
iqmp = rsa->iqmp;
d = rsa->d;
version = rsa->version;

// Convert from bignum to binary.
// Modulus (n)
modulus = (unsigned char*)calloc(RSA_size(rsa), sizeof(unsigned char));
iResult = BN_bn2bin(n, modulus);
if( !iResult )
{
   hResult = errno;
   printf("\n\tError:BN_bn2bin failed\n\n");
   break;
} // if

// Exponent1 (dmp1)
exponent1 = (unsigned char*)calloc(RSA_size(rsa), sizeof(unsigned char));
iResult = BN_bn2bin(dmp1, exponent1);
if( !iResult )
{
   hResult = errno;
   printf("\n\tError:BN_bn2bin failed\n\n");
   break;
} // if

// Exponent2 (dmq1)
exponent2 = (unsigned char*)calloc(RSA_size(rsa), sizeof(unsigned char));
iResult = BN_bn2bin(dmq1, exponent2);
if( !iResult )
{
   hResult = errno;
   printf("\n\tError:BN_bn2bin failed\n\n");
   break;
} // if

// Prime1 (p)
prime1 = (unsigned char*)calloc(RSA_size(rsa), sizeof(unsigned char));
iResult = BN_bn2bin(p, prime1);
if( !iResult )
{
   hResult = errno;
   printf("\n\tError:BN_bn2bin failed\n\n");
   break;
} // if

// Prime2 (q)
prime2 = (unsigned char*)calloc(RSA_size(rsa), sizeof(unsigned char));
iResult = BN_bn2bin(q, prime2);
if( !iResult )
{
   hResult = errno;
   printf("\n\tError:BN_bn2bin failed\n\n");
   break;
} // if

// Public exponent (e)
public_exponent = (unsigned char*)calloc(RSA_size(rsa), sizeof(unsigned char));
iResult = BN_bn2bin(e, public_exponent);
if( !iResult )
{
   hResult = errno;
   printf("\n\tError:BN_bn2bin failed\n\n");
   break;
} // if

// Private exponent (d)
private_exponent = (unsigned char*)calloc(RSA_size(rsa), sizeof(unsigned char));
iResult = BN_bn2bin(d, private_exponent);
if( !iResult )
{
   hResult = errno;
   printf("\n\tError:BN_bn2bin failed\n\n");
   break;
} // if

// Coefficient (iqmp)
coefficient = (unsigned char*)calloc(RSA_size(rsa), sizeof(unsigned char));

iResult = BN_bn2bin(iqmp, coefficient);
if( !iResult )
{
   hResult = errno;
   printf("\n\tError:BN_bn2bin failed\n\n");
   break;
} // if

RSAPUBKEY* rsapubkey = (RSAPUBKEY*)(keyBlob + sizeof(BLOBHEADER));

rsapubkey->bitlen = MAX_CERT_LEN;
rsapubkey->magic = 0x32415352; // 0x0032a400
rsapubkey->pubexp = *public_exponent;

int m1 = rsapubkey->bitlen / 8 + 20; 

unsigned int i  = 0;

// Convert all the components from Big Endian to Little Endian 
for( i = 0; i < (rsapubkey->bitlen / 8); i++)
{
    keyBlob[m1 - 1 - i] = modulus[i];
} // for

int p1 = rsapubkey->bitlen / 16 + m1;

for ( i = 0; i < ( rsapubkey->bitlen / 16 ); i++ )
{
    keyBlob[p1 - 1 - i] = prime1[i];
} // for

int p2 = rsapubkey->bitlen / 16 + p1;

for( i = 0; i < (rsapubkey->bitlen / 16); i++)
{
    keyBlob[p2- 1 - i] = prime2[i];
} // for

int e1 = rsapubkey->bitlen / 16 + p2;

for( i = 0; i < (rsapubkey->bitlen / 16); i++)
{
    keyBlob[e1 - 1 - i] = exponent1[i];
} // for

int e2 = rsapubkey->bitlen / 16 + e1;

for ( i = 0; i < ( rsapubkey->bitlen / 16 ); i++)
{
    keyBlob[e2 - 1 - i] = exponent2[i];
} // for

int c1 = rsapubkey->bitlen / 16 + e2;

for ( i = 0; i < (rsapubkey->bitlen / 16); i++ )
{
    keyBlob[c1 - 1 - i] = coefficient[i];
} // for

int d1 = rsapubkey->bitlen / 8 + c1;

for ( i = 0; i < (rsapubkey->bitlen / 8); i++ )
{
    keyBlob[d1 - 1 - i] = private_exponent[i];
} // for

/*
    FYI
    struct _RSAPUBKEY {
            DWORD   magic;                  // Has to be RSA1
            DWORD   bitlen;                 // # of bits in modulus
            DWORD   pubexp;                 // public exponent
                                            // Modulus data follows
    } RSAPUBKEY

    and 

    struct _PUBLICKEYSTRUC {
            BYTE    bType;
            BYTE    bVersion;
            WORD    reserved;
            ALG_ID  aiKeyAlg;
    } BLOBHEADER, PUBLICKEYSTRUC;
*/    
these structures already in wincrypt.h(in windows), but for linux we need add manually..

这里的keyblob存储在“keyBlob”中。到目前为止，它工作正常。现在在另一个函数中如何使用此 keyBlob 进行加密操作(使用 rsa api)。假设我们使用 RSA_public_encrypt 进行加密

Answer 1

我相信隐藏这些的预期方法......

RSA* rsa = new RSA( );
...

e = rsa->e;
n = rsa->n;
p = rsa->p;
q = rsa->q;
dmp1 = rsa->dmp1;
dmq1 = rsa->dmq1;
iqmp = rsa->iqmp;

...对于字节数组来说是使用 BN_num_bytes and BN_bn2bin :

int len, res;

len = BN_num_bytes(n);
unsigned char* n_arr = OpenSSL_malloc(len);
ASSERT(n_arr != NULL);
res = BN_bn2bin(n, n_arr);
ASSERT(res == len);

len = BN_num_bytes(e);
unsigned char* e_arr = OpenSSL_malloc(len);
ASSERT(e_arr != NULL);
res = BN_bn2bin(e, e_arr);
ASSERT(res == len);

...

OpenSSL_free(n_arr);
OpenSSL_free(e_arr);

请注意，字节数组是大端字节序。

您还需要释放 EVP_PKEY* 和 RSA*。 EVP_PKEY_get1_RSA 中的 1 表示 RSA* 上的引用计数已增加，因此需要调用 RSA_free 。 0 表示计数未增加，因此不需要 *_free。

<小时/>

Lets say we are using RSA_public_encrypt for encryption...

直接使用RSA*。

RSAPUBKEY* rsapubkey = (RSAPUBKEY*)(keyBlob + sizeof(BLOBHEADER));

如果这是 MS-CAPI，那么您需要reverse the byte arrays 。但我不清楚它的 MS-CAPI。

我猜你的问题是BN的提取和转换方式。但这只是一个猜测，因为我不清楚除了“使用它”之外你还想做什么。