Add support for exporting/importing RSA keys in DER and PEM format

[Legrandin]

I have created a patch for importing and exporting
RSA keys in the stadard, openssl-friendly DER and
PEM formats. Extensive test facilities are included.

Typical usage for importing an RSA key:

f = file("ssl.pem")
key = RSA.importKey(f.read())
f.close()
key.verify(hash, signature)

Typical usage for exporting an RSA public key:

key = RSA.generate(512, randfunc)
f = file("ssl.der","w")
f.write(key.publickey.exportKey('DER'))
f.close()

I confirm I am eligible for submitting code to pycrypto according
to http://www.dlitz.net/software/pycrypto/submission-requirements/
fetched on 27 December 2009.

[Darsey Litzenberger (dlitz)]

Thanks!

I want to review this change before committing it (particularly the changes to the API), since I am suspicious of anything to do with ASN.1 in general or with PKCS#12 in particular. See the links below to get some idea as to why:

http://www.cs.auckland.ac.nz/~pgut001/pubs/pfx.html
http://www.cs.auckland.ac.nz/~pgut001/pubs/x509guide.txt

But since you've supplied code, tests, and documentation, and since a few people have asked for some kind of OpenSSL interoperability, I'll at least have a look. :)

[Legrandin (gooksankoo)]

Sure, let me know if more comments or some restructuring may help the review.
BTW, I now realize that I have not tested it with pythons older than 2.5.
What is the older version you declare to support?

I am not familiar with PKCS#12 but I can say this patch is not actually related to it,
even though I assume that PKCS#12 support could be built on top of it.

Tha patch just lets you import/export keys in their simplest form. No certificates or complex
structures. More precisely (RFC3447, PKCS#1) you can have in ASN.1:

RSAPrivateKey ::= SEQUENCE {
          version Version,
          modulus INTEGER, -- n
          publicExponent INTEGER, -- e
          privateExponent INTEGER, -- d
          prime1 INTEGER, -- p
          prime2 INTEGER, -- q
          exponent1 INTEGER, -- d mod (p-1)
          exponent2 INTEGER, -- d mod (q-1)
          coefficient INTEGER, -- (inverse of q) mod p
          otherPrimeInfos OtherPrimeInfos OPTIONAL
      }

Or alternatively, for public halves:

SubjectPublicKeyInfo ::= SEQUENCE {
     algorithm AlgorithmIdentifier,
     subjectPublicKey BIT STRING
}

where subjectPublicKey is a BIT STRING embedding the
actual key:

RSAPublicKey ::= SEQUENCE {
          modulus INTEGER, -- n
          publicExponent INTEGER -- e
}

AlgorithmIdentifier is just a constant, that can be dissected
as follows:

AlgorithmIdentifier ::= SEQUENCE {
        algorithm OBJECT IDENTIFIER,
        parameters ANY DEFINED BY algorithm OPTIONAL }
}

and where algorithm is (according to RFC2459, PKIX)

rsaEncryption OBJECT IDENTIFIER ::= { pkcs-1 1}

pkcs-1 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 1 }

[Legrandin (gooksankoo)]

I verified that indeed the DER/PAM patch used too "recent" constructs and broke
the library when using Python 2.1/2.2.

Attached a small patch to adapt some lines to the older style.

[Darsey Litzenberger (dlitz)]

Fixed in multiple commits: c575de4f1815137a5800076ca669da911f4fd84d..6289ec502253524a44007e469341e26368c6b276

Released in PyCrypto 2.2. Thanks!