Encrypting private key in Python

Question

I have a private key in DER format. I am trying to convert it to PEM and simultaneously encrypt the private key with a passphrase.

Here is the openssl command that I am using to convert and encrypt:

> openssl rsa -aes256 -inform der -in temp_key.der -outform pem -passout pass:<password>

I am trying to implement a similar logic in Python where I have the data for the key in-memory in DER format. I want to change it to PEM, encrypt it and then store to a file.

I am not very well versed with Python's Crypto libraries and I am having a hard time to figure out the right way to convert and encrypt my key data.

antonku · Accepted Answer · 2019-07-31 08:12:04Z

6

You can load a DER key and dump it as a password protected PEM key with help of cryptography module as follows:

from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives import serialization

private_key = serialization.load_der_private_key(
    der_data, # assuming that "der_data" variable contains your DER key
    password=None,
    backend=default_backend()
)

pem_encrypted = private_key.private_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PrivateFormat.PKCS8,
    encryption_algorithm=serialization.BestAvailableEncryption(b'mypassword')
)

print(pem_encrypted.decode()) # -----BEGIN ENCRYPTED PRIVATE KEY-----...

answered Jul 31, 2019 at 8:12

antonku

7,7252 gold badges18 silver badges22 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Amriteya Over a year ago

Thanks for the response. I reached at the same code. Check out my implementation in the answer below.

Legorooj · Accepted Answer · 2020-09-17 08:25:19Z

2

Both other answers will work for you. Purely for variety, I shall add mine. For RSA, I personally prefer to use PyCryptodome, for the reason it has more features in when it comes to the RSA cipher, and it's RSA instance is programmed in pure python.

This code should work for you:

from Crypto.PublicKey import RSA

key = RSA.import(open('key.der', 'rb').read())

with open('key.pem', 'wb') as f:

    pem_key = key.export_key(passphrase='password')

    f.write(pem_key)
    f.close()

If you wanted, you could specify the output format of the exported key, but PyCryptodome currently defaults to PEM.

You can find thorough documentation for both libraries at https://cryptography.io and https://pycryptodome.readthedocs.io respectively.

edited Sep 17, 2020 at 8:25

answered Aug 1, 2019 at 12:08

Legorooj

2,7872 gold badges20 silver badges37 bronze badges

1 Comment

Robson Sampaio Over a year ago

I think in the second code line you wanted to write RSA.import_key

Amriteya · Accepted Answer · 2019-07-31 15:10:47Z

1

Used the cryptography module for python This is the implementation I reached at

from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives.serialization import load_der_private_key
from cryptography.hazmat.primitives import serialization


key = load_der_private_key(
            der_data, password=None, backend=default_backend())

password_protected_key = key.private_bytes(encoding=serialization.Encoding.PEM,
                                        format=serialization.PrivateFormat.TraditionalOpenSSL,
                                        encryption_algorithm=serialization.BestAvailableEncryption("password"))

answered Jul 31, 2019 at 15:10

Amriteya

1,1921 gold badge17 silver badges38 bronze badges

1 Comment

Legorooj Over a year ago

If this answer works, add it as the selected answer.

Collectives™ on Stack Overflow

Encrypting private key in Python

3 Answers 3

1 Comment

1 Comment

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

1 Comment

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related