transforming BER encoding into DER

[PL-Aurora]

Hi! Is there a way using Botan to transform X509 certificate in BER encoding into DER encoding?

[reneme]

In fact, Botan reads BER but emits DER (which is a restricted subset of BER), even though the method X509_Certificate::BER_encode() suggests otherwise. I.e. just reading and re-encoding the certificate should do the trick.

Though, I have a hunch you might actually mean to convert from DER to PEM, or vice versa.

Here's some code that reads a X.509 certificate in either PEM or BER and emits it in both formats:

#include <iostream>

#include <botan/hex.h>
#include <botan/x509cert.h>

int main() {
   auto cert = Botan::X509_Certificate("some_cert.pem");

   std::cout << cert.PEM_encode() << std::endl;
   std::cout << Botan::hex_encode(cert.BER_encode()) << std::endl;
}

The output will be something like:

-----BEGIN CERTIFICATE-----
MIIBhDCCASugAwIBAgIRAIeGEJUTmGf1G4pLggQu4p8wCgYIKoZIzj0EAwIwGjEL
[...]
-----END CERTIFICATE-----

308201843082012BA00302010202110087861095139867F51B8A4B82042EE29F300A06082A8648CE3D0403...

[mouse07410]

Would it make sense to rename BER_encode() to DER_encode()?

[PL-Aurora]

Well actually I don't need to convert from DER to PEM, the best option would be to generate certificate in DER format. Currently I'm doing something like this:

#include <iostream>

#include <botan/hex.h>
#include <botan/x509cert.h>

int main() {
   ...
   auto self_signed_cert = Botan::X509::create_self_signed_cert(options, ecKey, "SHA-384", rng);
   auto binCert = self_signed_cert.BER_encode();
   ...
}

and writing it into certificate file. And certificate is written fine. But when I read it in a specific program that reads certificates in DER format, it gives an error. Although, when I transform this certificate in openssl using openssl x509 -in certificatename.cer -outform DER -out certificatenameDER.cer then it is parsed properly.

But I would like to achieve this result with Botan, maybe I'm doing something wrong?

[PL-Aurora]

However, I have observed another thing, that transforming generated certificate with DER_encoder:

int main() {
   ...
   auto self_signed_cert = Botan::X509::create_self_signed_cert(options, ecKey, "SHA-384", rng);
   Botan::DER_Encoder derencoder;
   self_signed_cert.encode_into(derencr);
   ...
}

and writing it into file, the output is as expected, certificate is generated with parameters I want.

But, reading the same freshly generated certificate with:
auto cert = Botan::X509_Certificate(<path-to-cert>);

throws an error. Any suggestions?

[reneme]

Sorry for the delay, and thanks for your additional digging! That certainly sounds suspicious. Will look into it.

[reneme]

I have a hard time making sense of your findings in the implementation, frankly. You state that the result of cert.BER_encode() is not readable by your target program but can be converted using OpenSSL. Additionally, cert.encode_into(derenc) works as expected in your target program but is not parsable by Botan.

However, the implementation of BER_encode() is here:

botan/src/lib/asn1/asn1_obj.cpp

Lines 19 to 24 in 7f15ce7

	std::vector<uint8_t> ASN1_Object::BER_encode() const {
	std::vector<uint8_t> output;
	DER_Encoder der(output);
	this->encode_into(der);
	return output;
	}

... and literally does the same thing as the manual cert.encode_into(derenc) you suggested.

Could you post a full and runnable reproducer for your problem?

[reneme]

No, unfortunately we don't have explicit support for PKCS#5.

Sorry, I mixed up the standards. 😓 PKCS#5 refers to password-based encryption, and we do support this. The elliptic curve key format used by OpenSSL is specified in RFC 5915 and is an equivalent to the RSA format specified in PKCS#1.

Nevertheless, we don't support that out of the box.

[PL-Aurora]

Nevertheless, thank you very much for support and attention!

[reneme]

Okay, turns out that the bare private key structure inside a PKCS#8 container is actually in the format specified by RFC 5915. This isn't really surprising in retrospect, though, I've never bothered to look into the encodings that deeply either.

Here's how you could load the PEM-encoded structure that comes out of OpenSSL (openssl ecparam -name secp384r1 -genkey -outform PEM):

#include <botan/ec_group.h>
#include <botan/ecdsa.h>
#include <botan/pem.h>

int main() {
   const std::string ec_group_pem =
      "-----BEGIN EC PARAMETERS-----"
      "BgUrgQQAIg=="
      "-----END EC PARAMETERS-----";

   const std::string ec_private_pem =
      "-----BEGIN EC PRIVATE KEY-----"
      "MIGkAgEBBDAmKGw3jn/AIdaqJvH2lCGqMblXyp4p5pPZe/xsA+sv3ix1u4kJGMdg"
      "biZS1+xu5LCgBwYFK4EEACKhZANiAARWqd9OUMwcHJsJz8xWkTWqlAcmfWHODMyp"
      "Pf1pnxuJ7ZtXzp2mIydyWoaON3pFaj/m1T7buF2Wsjf46/5z4OVtecQXCfTr1nF4"
      "IJmhOB8bymZCMhZJilUJ2g9HfaHRVdo="
      "-----END EC PRIVATE KEY-----";

   const auto ec_group = Botan::EC_Group::EC_Group_from_PEM(ec_group_pem);
   const auto ec_private_ber = Botan::PEM_Code::decode_check_label(ec_private_pem, "EC PRIVATE KEY");

   const auto alg_id =
      Botan::AlgorithmIdentifier(ec_group.get_curve_oid(), ec_group.DER_encode(Botan::EC_Group_Encoding::NamedCurve));
   Botan::ECDSA_PrivateKey private_key(alg_id, ec_private_ber);

   return 0;
}

[reneme]

... and alternatively for the DER format that falls out of openssl ecparam -name secp384r1 -genkey -outform DER:

#include <botan/base64.h>
#include <botan/ec_group.h>
#include <botan/ecdsa.h>

int main() {
   const auto ec_private_key_ber = Botan::base64_decode(
      "MIGkAgEBBDDIcDyiHbmxjlEdIBoeE9E8qWqTVopl5buCSL1YkS+ZAn8vhPpxJYtjuH9sIejZ44Sg"
      "BwYFK4EEACKhZANiAASXDVAjzSOcHmkRSi1ZJEUe+rBxncDMYsAm43Xo/qqdXfJ2XKo+2kJfQwae"
      "zwP8t+IzK5aZUiqKoYdCon8VF7Xxy7zFdaZ9tI9soT/lMdFb9mmOgZJac6/2aV+ZG0T0ixQ=");

   const auto alg_oid = Botan::OID::from_name("secp384r1").value();
   const auto alg_id =
      Botan::AlgorithmIdentifier(alg_oid, Botan::EC_Group(alg_oid).DER_encode(Botan::EC_Group_Encoding::NamedCurve));
   Botan::ECDSA_PrivateKey private_key(alg_id, ec_private_key_ber);
}

[PL-Aurora]

I'll check if this succeed