Openssl Rsa Public And Private Key Generation Using Java

Jan 24, 2017 Java provides classes for the generation of RSA public and private key pairs with the package java.security. You can use RSA keys pairs in public key cryptography. Public key cryptography uses a pair of keys for encryption. Distribute the public key to whoever needs it but safely secure the private key. Public key cryptography can be used in. Oct 26, 2004 I am looking the similar kind of requirement, where i need to generate the keys in java (public and private) and data (some raw text) should be encrypted with public key in java. Now the respective private key should be loaded in.Net and decrypt the data.

Java

Public key cryptographyis a well-known concept, but for some reason theJCE (Java Cryptography Extensionsdocumentationdoesn’t at all make it clear how tointeroperate with common public key formats such as those produced byopenssl.If you try to do a search on the web forRSApublic key cryptography work in Java, you quickly find a lot of peopleasking questions and not a lot of people answering them. In this post,I’m going to try to lay out very clearly how I got this working.

Just to set expectations, this is not a tutorial about how touse the cryptography APIs themselves injavax.crypto(look at the JCE tutorials from Sun forthis); nor is this a primer about how public key cryptographyworks. This article is really about how to manage the keys withoff-the-shelf utilities available to your friendly, neighborhoodsysadmin and still make use of them from Java programs. Really, thisboils down to “how do I get these darn keys loaded into a Java programwhere they can be used?” This is the article I wish I had when Istarted trying to muck around with this stuff….

Managing the keys

Openssl. This is the de-facto tool sysadmins use for managingpublic/private keys, X.509 certificates,etc. This is what we want to create/manage our keyswith, so that they can be stored in formats that are common acrossmost Unix systems and utilities (like, say, C programs using theopenssl library…). Java has this notion of its ownkeystore, and Sun will give you thekeytool commandwith Java, but that doesn’t do you much good outside of Java world.

Creating the keypair. We are going to create a keypair, saving itin openssl’s preferred PEM format. PEM formats are ASCII and henceeasy to email around as needed. However, we will need to save the keysin the binary DER format so Java can read them. Without further ado,here is the magical incantation for creating the keys we’ll use:

You keep private_key.pem around for reference, but you handthe DER versions to your Java programs.

Loading the keys into Java

Really, this boils down to knowing what type of KeySpec to use whenreading in the keys. To read in the private key:

And now, to read in the public key:

That’s about it. The hard part was figuring out a compatible set of:

  1. openssl DER output options (particularly thePKCS#8 encoding)

  2. which type of KeySpec Java needed to use (strangely enough, thepublic key needs the “X509” keyspec, even though you would normallyhandle X.509 certificates with theopenssl x509command, not theopenssl rsacommand. Real intuitive.)

From here, signing and verifying work as described in the JCEdocumentation; the only other thing you need to know is that you canuse the “SHA1withRSA” algorithm when you get yourjava.security.Signatureinstance forsigning/verifying, and that you want the “RSA” algorithm when you getyourjavax.crypto.Cipherinstance for encrypting/decrypting.

Many happy security returns to you.

Contents

  • 3. Saving the Keys in Binary Format
  • Source Code

1. Introduction

Let us learn the basics of generating and using RSA keys in Java.

Java provides classes for the generation of RSA public and private key pairs with the package java.security. You can use RSA keys pairs in public key cryptography.

Public key cryptography uses a pair of keys for encryption. Distribute the public key to whoever needs it but safely secure the private key.

Public key cryptography can be used in two modes:

Encryption: Only the private key can decrypt the data encrypted with the public key.

Authentication: Data encrypted with the private key can only be decrypted with the public key thus proving who the data came from.

2. Generating a Key Pair

First step in creating an RSA Key Pair is to create a KeyPairGeneratorfrom a factory method by specifying the algorithm (“RSA” in this instance):

Initialize the KeyPairGenerator with the key size. Use a key size of 1024 or 2048. Currently recommended key size for SSL certificates used in e-commerce is 2048 so that is what we use here.

Openssl Rsa Public And Private Key Generation Using Java Code

From the KeyPair object, get the public key using getPublic() and the private key using getPrivate().

3. Saving the Keys in Binary Format

Save the keys to hard disk once they are obtained. This allows re-using the keys for encryption, decryption and authentication.

What is the format of the saved files? The key information is encoded in different formats for different types of keys. Here is how you can find what format the key was saved in. On my machine, the private key was saved in PKCS#8 format and the public key in X.509 format. We need this information below to load the keys.

Openssl Rsa Public And Private Key Generation Using Java Windows 10

3.1. Load Private Key from File

After saving the private key to a file (or a database), you might need to load it at a later time. You can do that using the following code. Note that you need to know what format the data was saved in: PKCS#8 in our case.

3.2 Load Public Key from File

Load the public key from a file as follows. The public key has been saved in X.509 format so we use the X509EncodedKeySpec class to convert it.

4. Use Base64 for Saving Keys as Text

Save the keys in text format by encoding the data in Base64. Java 8 provides a Base64 class which can be used for the purpose. Save the private key with a comment as follows:

And the public key too (with a comment):

5. Generating a Digital Signature

As mentioned above, one of the purposes of public key cryptography is digital signature i.e. you generate a digital signature from a file contents, sign it with your private key and send the signature along with the file. The recipient can then use your public key to verify that the signature matches the file contents.

Here is how you can do it. Use the signature algorithm “SHA256withRSA” which is guaranteed to be supported on all JVMs. Use the private key (either generated or load from file as shown above) to initialize the Signatureobject for signing. It is then updated with contents from the data file and the signature is generated and written to the output file. This output file contains the digital signature and must be sent to the recipient for verification.

Openssl Rsa Public And Private Key Generation Using Java Software

6. Verifying the Digital Signature

Openssl Rsa Public And Private Key Generation Using Java Server

The recipient uses the digital signature sent with a data file to verify that the data file has not been tampered with. It requires access to the sender’s public key and can be loaded from a file if necessary as presented above.

The code below updates the Signature object with data from the data file. It then loads the signature from file and uses Signature.verify() to check if the signature is valid.

And that in a nutshell is how you can use RSA public and private keys for digital signature and verification.

Source Code

Openssl Rsa Public And Private Key Generation Using Java Server

Go here for the source code.