Key Storage Format

• RSA keys are created in and expected to be found in binary BER-encoded files encoded with
  • RSAPublicKey as per PKCS#1 for public keys
  • EncryptedPrivateKeyInfo as per PKCS#8 for private keys.
• The base64 "PEM" and "OpenSSL" formats for public keys and the unencrypted PrivateKeyInfo format for private keys are also supported.
• The default action is to save private keys encrypted with a password. Save as the unencrypted PrivateKeyInfo form at your own risk.
• Public keys can be extracted from an X.509 certificate.
• Private keys can be extracted from a PFX (PKCS#12) file, but only if it has been created using algorithms we support (no guarantees with these beasts).
• Functions that might be expected to use the key frequently require the key to be read into an internal string first. We have opted to store them internally as a string of base64 characters. Using the Visual Basic String type or a zero-terminated char string in C makes for a simpler life than dealing with binary data.
• Treat the internal key strings as "blobs" of data. As of version 3.0, they are encrypted with an internal session key. See Internal key strings.
• Be careful with these internal private key strings - use WIPE_Data to erase them when no longer needed.
• Use the RSA_ToXMLString and RSA_FromXMLString functions to convert back and forth between XML and the toolkit's internal string format. Be very careful as the XML private key data is not encrypted.

[Contents] [Index]