RSA Public Key Conversion, from XML to PEM (PHP)

Question

How to convert RSA public key, from XML to PEM (PHP)?

Answer 1

we know

.pem - (improved mail privacy) Base64 encoded DER certificate, attached between "----- BEGIN CERTIFICATE -----" and "----- END CERTIFICATE -----"

X.509

The SignatureValue element contains the result of the Base64 encoded signature - the signature generated by the parameters specified in the SignatureMethod element - from the SignedInfo element after applying the algorithm specified by CanonicalizationMethod.

XML_Signature

so we get

$xml = simplexml_load_file($xmlFile); // or simplexml_load_string $pem = "-----BEGIN CERTIFICATE-----\n"; $pem .= $xml->SignatureValue; $pem .= "\n-----END CERTIFICATE-----"; // save to file 

if your xml file is not xml_signature

 $xml = simplexml_load_file($xmlFile); // or simplexml_load_string $pem = "-----BEGIN CERTIFICATE-----\n"; $pem .= $xml->nodeWithWantedValue; // use base64_encode if needed $pem .= "\n-----END CERTIFICATE-----"; 

Answer 2

I assume that in XML format you mean XML DSig RSAKeyValue , and in PEM format you mean that OpenSSL exports between -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- .

First you need to extract the module and public exponent from XML.

  <RSAKeyValue> <Modulus>xA7SEU+e0yQH5rm9kbCDN9o3aPIo7HbP7tX6WOocLZAtNfyxSZDU16ksL6W jubafOqNEpcwR3RdFsT7bCqnXPBe5ELh5u4VEy19MzxkXRgrMvavzyBpVRgBUwUlV 5foK5hhmbktQhyNdy/6LpQRhDUDsTvK+g9Ucj47es9AQJ3U= </Modulus> <Exponent>AQAB</Exponent> </RSAKeyValue> 

You can easily convert them to a bit string using base64_decode .

Once this is done, you need to somehow build the ASN.1 structure.

What OpenSSL exports between the BEGIN / END PUBLIC KEY is the X.509 SubjectPublicKeyInfo structure .

 SubjectPublicKeyInfo ::= SEQUENCE { algorithm AlgorithmIdentifier, subjectPublicKey BIT STRING } 

subjectPublicKey consists of the sequnce described in PKCS # 1 spec :

 RSAPublicKey ::= SEQUENCE { modulus INTEGER, publicExponent INTEGER } 

algorithm (a AlgorithmIdentifier ) is also described in the PKCS # 1 specification (see section A.1):

 rsaEncryption OBJECT IDENTIFIER ::= { pkcs-1 1 } 

This structure must be serialized in the form of DER, then base64 encoded, and then placed between the BEGIN / END delimiters.

I do not know any PHP library to make ASN.1 / DER encoding, unfortunately (the rest is relatively simple, but working with ASN.1 tends to be tedious).

the PHP / PEAR module Crypt_RSA can create public RSA keys from the module and exponent, but its toString() method uses a custom format (only base64 encoded PHP result serialize in an array structure that has nothing to do with ASN.1 / DER encoding).

Answer 3

There is no standard for storing RSA public keys in XML. Thus, the conversion method will depend on the XML that you have.

Answer 4

Here's an example on how to read RSA XML keys in PHP:

Answer 5

Just for completeness, here is a working example of creating PEM from a module in python. You can call it in a subprocess from PHP if necessary.

Meat solution:

 def big_endian(n): s = '%x' % n if len(s) & 1: s = '0' + s return s.decode('hex') from M2Crypto import RSA e = E_PREFIX + big_endian(public_exponent) n = N_PREFIX + big_endian(modulus) new = RSA.new_pub_key((e,n)) new.save_key('foo.pub') 

Where E_PREFIX and N_PREFIX are constants that (as far as I can tell) depend on the exponent and key length. Here is a short table that I built:

 E_PREFIX = '\x00\x00\x00\x01' # 0x3 (3) E_PREFIX = '\x00\x00\x00\x03' # 0x10001 (65537) N_PREFIX = '\x00\x00\x00!\x00' # 256-bit N_PREFIX = '\x00\x00\x00A\x00' # 512-bit (default) N_PREFIX = '\x00\x00\x00\x81\x00' # 1024-bit N_PREFIX = '\x00\x00\x01\x01\x00' # 2048-bit N_PREFIX = '\x00\x00\x02\x01\x00' # 4096-bit 

If someone knows a more general way of calculating prefixes, tell me.

Answer 6

Maybe you should look here

Extract the two strings encoded in base64, convert and pass to PEAR :: Crypt_RSA, then export as a text file, then openssl convert?

Check it out too