Can not import RSA keys generated with php openssl to windows CryptoAPI

Question 1

I found a solution.
PHP generates keys with extra fields in ASN.1 format compare to CryptoAPI keys.

1. I decoded base64 key into a binary file with help of this tool: base64 decoder

2. Then I just cut from this file first 26 bytes to the next header sequence starting from something like: "30 xx xx" and saved it.

3. And encoded this file back to base64 with: base64 encoder

Now I can import public and private keys into CryptoAPI without problems with next code:

// key types
const
  PKCS_RSA_PRIVATE_KEY = LPCSTR(43);
  PKCS_RSA_PUBLIC_KEY = LPCSTR(19);

function ImportKey(hProv: HCRYPTPROV; KeyType: pointer; key: string): hKey;
var
  BuffSize, BlobSize: longword;
  buff, blob: pointer;
begin
  result := 0;
  buff := nil;
  blob := nil;

  try
    if not(CryptStringToBinary(PWideChar(key), 0, 1, nil, @BuffSize, nil, nil)) then
      exit;

    GetMem(buff, BuffSize);
    if not(CryptStringToBinary(PWideChar(key), 0, 1, buff, @BuffSize, nil, nil)) then
      exit;

    if not(CryptDecodeObjectEx(X509_ASN_ENCODING or PKCS_7_ASN_ENCODING,
       KeyType, buff, BuffSize, 0, nil, nil, @BlobSize)) then
      exit;

    GetMem(blob, BlobSize);
    if not(CryptDecodeObjectEx(X509_ASN_ENCODING or PKCS_7_ASN_ENCODING,
       KeyType, buff, BuffSize, 0, nil, blob, @BlobSize)) then
      exit;

    if not(CryptImportKey(hProv, blob, BlobSize, 0, 0, @result)) then
      exit;

  finally
    if buff <> nil then
      FreeMem(buff);
    if blob <> nil then
      FreeMem(blob);
  end;
end;

Question 2

I encountered a similar situation where I was generating keys using PHP5's openssl API, and importing them using Windows CryptoAPI, except I'm using C++.

The 26 byte offset fixed importing private keys for me, but I found the offset for public keys to be 24 bytes. As Mike K. pointed out, you need to offset until the next header sequence, I found that the first two bytes of the sequence will be "30 82". So if you run into a situation where 24 bytes or 26 bytes doesn't work, check out the key in a hex editor and look for those bytes.

Here is the code I had success with:

DWORD PEMToPublicKeyBlob(char* keyData, DWORD keyDataLen, BYTE** publicKeyBlob, DWORD* length)
{
    DWORD ret = ERROR_SUCCESS;
    wchar_t message[256];

    BYTE* der = NULL;
    DWORD derLen = 0;

    unsigned int offset = 0;
    // if the header is this, and not -----BEGIN RSA PUBLIC KEY----- the key was created on the webserver
    if(strstr(keyData, "-----BEGIN PUBLIC KEY-----" ))
        offset = 24;        // php puts 24 extra bytes in the header that screws up the import

    // Convert from PEM format to DER format
    // get length
    if (!CryptStringToBinaryA(keyData, keyDataLen, CRYPT_STRING_ANY, NULL, &derLen, NULL, NULL))
    {
        ret = GetLastError();
        swprintf_s(message, 256, L"PEMToPublicKeyBlob: CryptStringToBinaryA(len) failed %u", ret);
        writeToLog(message);
        goto out;
    }

    der = new BYTE[derLen];
    if(!der)
    {
        ret = ERROR_NOT_ENOUGH_MEMORY;
        swprintf_s(message, 256, L"PEMToPublicKeyBlob: der blob allocation failed %u", ret);
        writeToLog(message);
        goto out;
    }
    if (!CryptStringToBinaryA(keyData, keyDataLen, CRYPT_STRING_ANY, der, &derLen, NULL, NULL))
    {
        ret = GetLastError();
        swprintf_s(message, 256, L"PEMToPublicKeyBlob: CryptStringToBinaryA failed %u", ret);
        writeToLog(message);
        goto out;
    }

    // Decode from DER format to PUBLICKEYBLOB
    // get length
    *length = 0;
    if (!CryptDecodeObjectEx(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, RSA_CSP_PUBLICKEYBLOB,
                                der + offset, derLen - offset, 0, NULL, NULL, length))
    {
        ret = GetLastError();
        swprintf_s(message, 256, L"PEMToPublicKeyBlob: CryptDecodeObjectEx(len) failed %u", ret);
        writeToLog(message);
        goto out;
    }

    *publicKeyBlob = new BYTE[*length];
    if(!*publicKeyBlob)
    {
        ret = ERROR_NOT_ENOUGH_MEMORY;
        swprintf_s(message, 256, L"PEMToPublicKeyBlob: publickey blob allocation failed %u", ret);
        writeToLog(message);
        goto out;
    }

    if (!CryptDecodeObjectEx(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, RSA_CSP_PUBLICKEYBLOB,
                                der + offset, derLen - offset, 0, NULL, *publicKeyBlob, length))
    {
        ret = GetLastError();
        swprintf_s(message, 256, L"PEMToPublicKeyBlob: CryptDecodeObjectEx failed %u", ret);
        writeToLog(message);
        goto out;
    }
out:
    if(der) delete[] der;
    return ret;
}

The code for importing private keys is pretty much the same except you specify PKCS_RSA_PRIVATE_KEY instead of RSA_CSP_PUBLICKEYBLOB.

Question 3

The proper code (e.g. without using "magical numbers") would be:

{
Remove optional ASN.1 header from source.

Header:
Offset| Len  |LenByte|
======+======+=======+======================================================================
     0|   630|      3| SEQUENCE :
     4|     1|      1|    INTEGER : 0
     7|    13|      1|    SEQUENCE :
     9|     9|      1|       OBJECT IDENTIFIER : rsaEncryption [1.2.840.113549.1.1.1]
    20|     0|      1|       NULL :
    22|   608|      3|    OCTET STRING / BIT STRING:
                             ... actual key data ...
}
function ASN1SkipOptionalHeader(const ADER: DATA_BLOB): DATA_BLOB;
const
  ASN1_INTEGER     = $02;
  ASN1_BITSTRING   = $03;
  ASN1_OCTETSTRING = $04;
  ASN1_SEQUENCE    = $30;
var
  P: PByte;
  Len: Cardinal;
begin
  Result := ADER;
  P := Result.pbData;

  // Check for header:
  // SEQUENCE:
  //   INTEGER
  //   SEQUENCE
  //   OCTET STRING/BIT STRING
  // or:
  // SEQUENCE:
  //   SEQUENCE
  //   OCTET STRING/BIT STRING

  // both header and any key start with ASN1_SEQUENCE, skip it
  if P^ <> ASN1_SEQUENCE then
    Exit;
  Inc(P);
  ASN1ReadLength(P);

  // both header and key have ASN1_INTEGER as first field, skip it
  if P^ = ASN1_INTEGER then
  begin
    Inc(P);
    Len := ASN1ReadLength(P);
    Inc(P, Len);
  end;

  // now, check if it is a header or a key
  // a header has ASN1_SEQUENCE as second field,
  // a key has ASN1_INTEGER as second field
  if P^ <> ASN1_SEQUENCE then
    Exit;
  Inc(P);
  Len := ASN1ReadLength(P);
  Inc(P, Len);

  // now, seek to real key data
  if P^ = ASN1_OCTETSTRING then
  begin
    Inc(P);
    Result.cbData := ASN1ReadLength(P);
    Result.pbData := P;
  end
  else
  if P^ = ASN1_BITSTRING then
  begin
    Inc(P);
    Result.cbData := ASN1ReadLength(P) - 1;
    if P^ = 0 then // unused bits must be 0
    begin
      Inc(P);
      Result.pbData := P;
    end
    else
      Result.cbData := ADER.cbData; // fail, not support non-zero unused bits
  end;

{
  Now Result should be:

Offset| Len  |LenByte|
======+======+=======+======================================================================
     0|   604|      3| SEQUENCE :
     4|     1|      1|    INTEGER : 0
     7|   129|      2|    INTEGER :
      |      |       |       00... cut ...65
   139|     3|      1|    INTEGER : 65537
   144|   128|      2|    INTEGER :
      |      |       |       29... cut ...51
   275|    65|      1|    INTEGER :
      |      |       |       00... cut ...8F
   342|    65|      1|    INTEGER :
      |      |       |       00... cut ...CB
   409|    64|      1|    INTEGER :
      |      |       |       61... cut ...05
   475|    64|      1|    INTEGER :
      |      |       |       3D... cut ...11
   541|    65|      1|    INTEGER :
      |      |       |       00... cut ...37
}
end;

function ASN1ReadLength(var P: PByte): Cardinal;
var
  B: Byte;
begin
  Result := 0;
  B := P^;
  Inc(P);
  if B and $80 <> 0 then
  begin
    B := B and $7F;
    if B > 4 then
    begin
      Result := 0;
      Exit;
    end;
    if B > 0 then
    begin
      while B > 0 do
      begin
        Result := (Result shl 8) or P^;
        Inc(P);
        Dec(B);
      end;
    end
    else
      Result := 0;
  end
  else
    Result := B;
end;