2

I was trying to extract an un-exportable key from OS X Keychain. I used this tool to extract the key. The tool gives me a hexdump of the private key. An RSA 2048 bit key came out to be 2441 bits, after extracting through the tool.

The problem is, I can't figure out what format the key is in, to convert it to PEM/DER or any standard format. After extraction, it looks like this:

[+] Private Key Record
 [-] PrintName: <name>
 [-] Label
<hexdump>                                       
 [-] Key Class : CSSM_KEYCLASS_PRIVATE_KEY
 [-] Private : 0
 [-] Key Type : CSSM_ALGID_RSA
 [-] Key Size : 2048 bits
 [-] Effective Key Size : 2048 bits
 [-] Extracted : 0
 [-] CSSM Type : Core CSP (local space)
 [-] Key Name
<hexdump>
 [-] Decrypted Private Key
<hexdump>

Does anyone know what format this decrypted private key is in? And/or how to convert it to an OpenSSL-supported format?

Improve this question

2 Answers 2

Reset to default
1

I'm reading between the lines of the chainbreaker docs and your OP (having not tried the tool yet myself), and it seems like the private key should be fully present under "Decrypted Private Key" in raw hexadecimal format. The rest seems to just be a novel display format for the metadata.

Put simply, I believe you need to convert the raw hex key into base64 which is how we are used to seeing RSA keys in plaintext. This answer explains it fairly well: https://www.reddit.com/r/crypto/comments/2hcd4z/converting_a_hexadecimal_private_key_into_a_pem/ckrgs8k/

Improve this answer
1
  • 1
    Thanks, I did try base64, but I realized I was converting the post-hex string to base 64. And after that, in the resulting private key, added "BEGIN RSA PRIVATE KEY" instead of "BEGIN PRIVATE KEY". Once I fixed those two things, I could verify the private key.
    – Vegetto
    Jun 1, 2018 at 2:48
0

While the key is hexadecimal encoded, all keys use an encoding standard called ASN.1.

A typical certificate chain can be stored in a few different ways depending on the needs. Some of those are PKCS#1, 7, 8 & 12. There are others but those are the most common.

Based on the output above I would assume a PKCS#12 encrypted certificate chain (this method allows for private keys & x509 certificates).

While I am unfamiliar with the tools you mention the OpenSSL command line interface has quite a few to help...

# openssl rsa -help should get you started

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .