How can I read a standard openssl rsa private key with PyCrypto and decrypt with it

Question

I generated a private key with:

openssl req -x509 -out anytime-pub.der -outform der -new -newkey rsa:2048 -keyout anytime.pem -days 3650

In my old code, I use M2Crypto load the key file to decrypt something, and it works.

from M2Crypto import RSA 

ServerRSA = RSA.load_key('keys/anytime.pem', passwd)
key = ServerRSA.private_decrypt(b64decode(cipher),1)

but when i use pycrypto to do the same thing, it occurs error below:

>>> from Crypto.PublicKey import RSA
>>> key = RSA.importKey(open('keys/anytime.pem', 'r'))
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/Users/xyzkizer/Projects/AnytimeBackend/env/lib/python2.7/site-packages/Crypto/PublicKey/RSA.py", line 641, in importKey
    raise ValueError("PEM encryption format not supported.")
ValueError: PEM encryption format not supported.

Can anybody tell me what's my mistake?

Thank you!

Answer 1

There is no mistake. The private key is encoded in a password-protected PKCS#8 structure (inside a PEM envelope) and that is not understood by the current version of PyCrypto (2.6).

Support for PKCS#8 is available on the current development branch of the library though.

EDIT: PKCS#8, not PKCS#7

Answer 2

It tries to tell you that ASCII armour (PEM) is not supported by the wrapper library.

To get around this, try to specify the argument -keyform DER in your openssl req line.

Or take the base64 out of the PEM format, openssl base64 -d it and feed that to your python code.