Is it possible to wrap a RSA private key using a EC key pair?

3ric-T

4/26/24, 10:48 AM

In PKCS#11 documentation § 2.1.23 is described how to wrap and unwrap a target asymmetric key of any length and type using an RSA key, called CKM_RSA_AES_KEY_WRAP. This mechanism could be easily implemented by hand in case it is not available in HSM.

The counterpart exists for EC, CKM_EC_AES_KEY_WRAP can wrap and unwrap an asymmetric target key of any length and type using an EC key. Unfortunately, the description of the wrapping mechanism only refers to EC wrapping key:

Generates a temporary random EC key (transport key) having the same parameters as the wrapping EC key (and domain parameters). Saves the transport key public key material.

Performs ECDH operation using CKM_ECDH1_DERIVE with parameters of kdf, ulSharedDataLen and pSharedData using the private key of the transport EC key and the public key of wrapping EC key and gets the first ulAESKeyBits bits of the derived key to be the temporary AES key.

Could someone explain to me and describe precisely how to wrap an RSA asymmetric target key using an EC key?

Obviously, if this is not recommended or not possible, I would also like to have an explanation of why.

154

1 + 2

elliptic-curves

key-wrap

user253751

4/26/24, 8:26 PM

... does CKM_EC_AES_KEY_WRAP not do this? The quoted text says it generates a temporary key, encrypts the temporary key, and encrypts the wrapped key with the temporary key.

3ric-T

4/27/24, 7:21 AM

Yes, indeed, it does. Unfortunately it is not implemented in HSM very often, so we have to do it by hands...

Score:3

Crypto

Maarten Bodewes

4/26/24, 11:06 AM

What you are asking is exactly what is being explained by the text you are quoting. The specification uses ECIES, a form of a hybrid cryptosystem using both asymmetric and symmetric cryptography.

That consists of ECDH with an ephemeral key pair specifically created for the wrapped key, which PKCS#11 seems to call the transport key. With the static wrapping public key and the ephemeral private key you can derive an AES key. That AES key can then be used to encrypt (wrap) the RSA key.

The ephemeral public key is stored with the ciphertext so you can use the static private unwrapping key to derive the same AES key to decrypt (unwrap).

Of course the devil is in the details, I haven't talked about the ciphertext format, the key derivation method used, the mode of operation used for AES (+ IV & possible authentication tag usage) nor the encoding of the RSA private key. I would have to look those up.

Unfortunately (EC)IES is in my opinion very underspecified. It should require parameterization, but I don't think the parameter format is specified anywhere. At least the above does show that the used KDF can be parameterized for CKM_ECDH1_DERIVE .

But above should give a good birds eye view for what is happening anyway.

+ 3

3ric-T

4/26/24, 2:28 PM

If I understand it well, there is no link between the target key and the ephemeral transport EC key? Is there some advices to generate it *having the same parameters as the wrapping EC key (and domain parameters)*?

Maarten Bodewes

4/26/24, 3:03 PM

What is the target key? The wrapping key or the key being wrapped? The ephemeral / transport key and the *wrapping* key need to use the same domain parameters. The wrapped key itself is unrelated. It is or gets encoded to bytes and then restored once it is unwrapped (possibly flipping some flags in the process, exporting a private key comes with some risk).

3ric-T

4/27/24, 6:59 AM

OK, got it :) I mistakenly believed that there was a link between the *wrapped* key and the *ephemeral transport* key. Your explanations were very useful.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Is it possible to wrap a RSA private key using a EC key pair?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.