Retrieve SecKey from RSA private key string encoded with passphrase in Swift or Objective C

问题

We have an enterprise mobile app that ships with an encrypted private key. We intend to provide users with the passphrase in order to use that private key, which will then allow them to communicate with a backend server. I've previously set this up using Python or C# but cannot figure out how to do this in Swift or Objective C. I've adapted some of this from this stack overflow question: Encrypt using RSA Certificate in Swift

     static func getCertificate(from certificate: String?, usingPhrase phrase: String?) -> SecKey? {
        guard let certificate = certificate else {
            print("Nil string passed in, nil being returned")
            return nil
        }
        let beginning = "-----BEGIN ENCRYPTED PRIVATE KEY-----"
        let tail = "-----END ENCRYPTED PRIVATE KEY-----"
        let certificateString = certificate.replacingOccurrences(of: beginning, with: "")
                                           .replacingOccurrences(of: tail, with: "")
                                           .replacingOccurrences(of: "\n", with: "")
                                           .replacingOccurrences(of: " ", with: "")
        guard let data = Data(base64Encoded: certificateString) else {
            print("Unable to cast string to data")
            return nil
        }

        // ** I'm assuming here is where I need to decrypt the key before I can create the certificate **

        guard let cert = SecCertificateCreateWithData(nil, data as NSData) else {
            print("Unable to cast certificate to SecCertificate")
            return nil
        }

        var secTrust: SecTrust?

        // Retrieve a SecTrust using the SecCertificate object. Provide X509 as policy
        let status = SecTrustCreateWithCertificates(cert, SecPolicyCreateBasicX509(), &secTrust)

        // Check if the trust generation is success
        guard status == errSecSuccess else { return nil }

        // Retrieve the SecKey using the trust hence generated
        guard let trust = secTrust else {
            print("Trust policy not created")
            return nil
        }

        // ** I acknowledge that this method creates a public key and I am passing in a private key
        // ** I am not sure what method needs to be used instead
        guard let secKey = SecTrustCopyPublicKey(trust) else { return nil }

        return secKey
    }

Ultimately, I need to decrypt the private key using a passphrase. I was planning on using it as a SecKey, but getting the Base64 String representation of it works for me as well. I am comfortable working through an Objective-C or Swift based answer.

EDIT Here is a sample key for test purposes:

The passcode for this key is

8720c10d735d7fb218b9e48db942a494

回答1:

I took the sample encrypted key you provided and pasted it into this excellent ASN.1 decoder. It produces the following result:

Which is actually a very useful summary of the steps required to decrypt the ciphertext using the key you have:

The first two OBJECT IDENTIFIER entries hint at the padding mode used during encryption and the key derivation function used to obtain an encryption key from your "passcode": PKCS #5 padding and PBKDF2 for key derivation. The OCTET STRING and INTEGER values under that are the salt and iteration count for PBKDF2.
The third OBJECT IDENTIFIER indicates the encryption algorithm - TripleDES in CBC mode. Not ideal, but secure enough I guess. The OCTET STRING under that is the 8-byte IV, since DES has an 64 bit block size.
The final OCTET STRING is the ciphertext.

So, in summary, you need to:

Find a way to get at the values you need e.g. salt, iteration count, IV and ciphertext - assuming the algorithms used for these keys stay the same. Sometimes you can get away with jumping around in the raw data and slicing these values out - depending on your needs, you might need to use an ASN.1 decoder.
When it comes time to decrypt - pull out the salt and iteration count (first OCTET STRING and INTEGER). Pull out the IV (second OCTET STRING) and the ciphertext (last OCTET STRING).
Apply PBKDF2 using the specified salt and iteration count to your passcode, the one you provide in the question. You'll need to extract 192 bits of key material from this, since we're using TripleDES.
Decrypt the ciphertext using the key material from the last step in CBC mode using the IV you extracted. Use PCKS#5 padding, which is usually the default.
Done!

来源：https://stackoverflow.com/questions/61428695/retrieve-seckey-from-rsa-private-key-string-encoded-with-passphrase-in-swift-or

标签

ios

objective-c

swift

encryption

rsa