4

OpenSSL provides tools to generate random public/private key pairs. Is there any mechanism to deterministically generate a pair based on some initial value?

For example, given the string 'abcd', generate a public/private key pair, such that the same public/private key pair can be generated again using the same string.

jww
  • 97,681
  • 90
  • 411
  • 885
Charles Salvia
  • 52,325
  • 13
  • 128
  • 140
  • @owlstead Certainly. Ideally the password would be the same length as the key, then there would be no loss of entropy. But then you wouldn't need the password, would you? – user207421 Jan 09 '14 at 03:51

1 Answers1

4

For sure, just use your password in a PBKDF to generate a key like array of bytes (random salt and high iteration count required). Then use this array of bytes as seed for a PRNG. Make sure that you always use the same PRNG! Then use that PRNG as input for RSA_generate_key. Make sure that generate key implementation is not changed.

Please read the answers on Initialize a PRNG with a password on crypto.stackexchange.com. Note that usually the private key is encrypted instead, e.g. using the PKCS#12 container. Note that both PKCS#12 containers and the method above are vulnerable to brute force attacks. Most passwords do deliver a very limited amount of entropy, making these brute force attacks more feasible. The advantage of the PKCS#12 container is that you do not have to store it with the ciphertext, it is only required during signature generation or decryption. Using a 128 bit hex value as password would alleviate the issue of brute forcing, but you likely won't be able to remember it.

Note that RSA key pair generation takes a lot of time (and finding a large prime has a nondeterministic running time, so it may take very long for specific key pairs). EC F(p) keys would be much less cumbersome.

Feasible? Certainly. Useful? Possibly. Fraught with danger? Certainly.

Community
  • 1
  • 1
Maarten Bodewes
  • 90,524
  • 13
  • 150
  • 263
  • 2
    If you have to ask how to do this, then you should probably not be doing this :P – Maarten Bodewes Jan 09 '14 at 02:28
  • Somehow I feel that's true for just about anything that has to do with cryptography. – ntoskrnl Jan 09 '14 at 15:21
  • @ntoskrnl Yes, but this is moving from the well worn paths. And if you loose the path you will likely encounter spiders - and mean elves. – Maarten Bodewes Jan 11 '14 at 13:45
  • "Then use this array of bytes as seed for a PRNG" - you have to be careful here. OpenSSL will use the `RDRAND` engine if available, and that does not take seeds or produce deterministic outputs. And you have to jump through hoops to disable the behavior. See [Engines and RDRAND](http://wiki.openssl.org/index.php/Library_Initialization#ENGINEs_and_RDRAND). – jww Jan 12 '14 at 09:43