RSA Private Key generation & SecASN1 APIs

Hi,

I'm working on trying to generate RSA keys using the SecCreateWithData API given the key's components.

I've had success with generating public keys given the modulus and exponent. However, while creating the RSA private key, I observed that the API requires all parameters including the optional parameters like exponent1, exponent2 and coefficient. I've tried passing in just 5 components - the modulus, public key exponent, private key exponent, P & Q, but the API returns a nil key and logs an error. It works only when the NSData passed to the API has all 8 parameters formatted in ASN.1. (I can provide a sample project if my question is not clear)

I have a few questions:

  1. Is there support for providing a partial set of parameters for private key generation to the SecCreateWithData API? If so, what are the required minimum?
  2. SecAsn1 objects and APIs show a warning that they are deprecated. What is the alternate API on MacOS?
  3. Is there any support on iOS for ASN1 encoding?

Note: Linking to OpenSSL is not a route that I'd like to pursue

Answered by DTS Engineer in 761722022

I wouldn’t use SecAsn1Coder for this. Or for anything really. It’s both officially deprecated and unavailable on any platform other than iOS.

If you need to do this sort of thing, I recommend that you either write or acquire your own ASN.1 library for it. I have my own, natch (-; but these days I tend to reach for Swift ASN.1.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Accepted Answer

I wouldn’t use SecAsn1Coder for this. Or for anything really. It’s both officially deprecated and unavailable on any platform other than iOS.

If you need to do this sort of thing, I recommend that you either write or acquire your own ASN.1 library for it. I have my own, natch (-; but these days I tend to reach for Swift ASN.1.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Thank you. Can you clarify the first question? If there is support for key generation from non-optional components - i.e, without the exponent1, exponent2 and the coefficient.

If there is support for key generation from non-optional components

No.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

RSA Private Key generation & SecASN1 APIs
 
 
Q