PEM RSA keys vs DER DSA keys?

[Kaitlin Farr]

Steps to reproduce:

1. Generate a DSA key:
    openstack secret order create --bit-length 1024 --algorithm DSA --name "DSA key" asymmetric

2. Generate an RSA key:
    openstack secret order create --bit-length 1024 --algorithm RSA --name "RSA key" asymmetric

There's a bit of trouble accessing the DSA key by using the container href in the order because of: https://bugs.launchpad.net/python-barbicanclient/+bug/1749882

However, if you find the secret href another way, try to do:
     openstack secret get --payload <RSA key href>
and
     openstack secret get --payload <DSA key href>

The RSA key will print out ok in PEM format, but the DSA key will likely get some sort of error, like:
     'utf8' codec can't decode byte 0x82 in position 1: invalid start byte
which will give you a clue that it's not in PEM format.

It doesn't seem right that key generation should return two different formats for the keys that were generated essentially the same way?

[Rajat Sharma (tajar29)]

I have tested this with "Store_crypto" plugin and as per my understanding the reason behind this is that it is not converting der to pem like it do in "KMIP" plugin.

[Kaitlin Farr (kaitlin-farr)]

Yes, I later tracked down in the code where this was happening: https://github.com/openstack/barbican/blob/master/barbican/plugin/crypto/simple_crypto.py#L142-L165

No idea why one is PEM and the other is DER. The code used to look different when we were using PyCrypto before this commit: https://github.com/openstack/barbican/commit/64d3da630726882878dba2ad438e4a60b9d28185#diff-edd1621ed033d9571dc3e1190e1a8bbc

[Grzegorz Grasza (xek)]

Closing out bugs created before migration to StoryBoard. Please re-open if you are of the opinion it is still current.