OpenSSL.NET can't export private key with null Cipher

Question

I've recently discovered OpenSSL.NET and it's a pretty sweet little wrapper.

I'm trying to execute the following code:

    public static void DoSomething(byte[] buf)
    {
        OpenSSL.Core.BIO input = new OpenSSL.Core.BIO(buf);
        OpenSSL.X509.X509Certificate b = OpenSSL.X509.X509Certificate.FromPKCS12(input, "passphrase");
        OpenSSL.Core.BIO outs = OpenSSL.Core.BIO.MemoryBuffer(false);
        b.PrivateKey.WritePrivateKey(outs, OpenSSL.Crypto.Cipher.Null, "passphrase");
        outs.SetClose(OpenSSL.Core.BIO.CloseOption.Close);
        Console.WriteLine(outs.ReadString());
    }

Problem comes at the "b.PrivateKey.WritePrivateKey(.." line. I want to write the private key out without any encryption. According to spec, if I use a Null cipher type this should do the trick, but it never works, regardless of the cert I use in buf.

Here's the exception:

error:0D0A706C:asn1 encoding routines:PKCS5_pbe2_set:cipher has no object identifier error:2307D00D:PKCS12 routines:PKCS8_encrypt:ASN1 lib

I know this part works fine because if I specify any other cipher type, it exports the private key without fail. Anyone have any suggestions?

Answer 1

Why can't you use:

    OpenSSL.Core.BIO outs = OpenSSL.Core.BIO.MemoryBuffer(false);
    outs.Write(b.PrivateKey.ToString());
    outs.SetClose(OpenSSL.Core.BIO.CloseOption.Close);
    Console.WriteLine(outs.ReadString());

this way you can write unencrypted keys.

I see, change that to:

    OpenSSL.Core.BIO outs = OpenSSL.Core.BIO.MemoryBuffer(false);
    outs.Write(b.PrivateKey.GetRSA().PrivateKeyAsPEM);
    outs.SetClose(OpenSSL.Core.BIO.CloseOption.Close);
    Console.WriteLine(outs.ReadString());

Answer 2

I don't really use that but perhaps this may help:

If OpenSSL is being compiled for a development system in which SSL will be debugged at the protocol level, omitting the command -DSSL_FORBID_ENULLis acceptable. -DSSL_FORBID_ENULL causes OpenSSL to omit null ciphers in the SSL cipher suite. Null ciphers permit cleartext (unencrypted information) to traverse the wire. Null ciphers provide no confidentiality and aren't encouraged for use on production systems.