Finding passphrase from private RSA key

Question

I'm working with pycrpytodomex lib in python3. Here I'm using a passphrase while generating an RSA key:

from Cryptodome.PublicKey import RSA
def encrypt(pass1):
    key = RSA.generate(2048)
    encrypted_key = key.exportKey(passphrase=pass1, pkcs=8, protection="scryptAndAES128-CBC").decode('utf')
    return encrypted_key

I've put in a 24 char phassphrase, and this is the output:

I am able to validate the passphrase with the encrycpted key string by using this function:

def decrypt(encoded_key,pass1):
    try:
        key = RSA.import_key(encoded_key, passphrase=pass1)
        return True
    except ValueError:
        return False

Supposing one only has the private key and not the passphrase (ie, you). Would it still be possible to derive the passphrase using this private key? Alternative: Would it be possible to construct any passphrase that will return True on the decrypt() function above?

Can you find out what the (or a valid) passphrase is for the above key? What computing power and time did it take?

I'm fairly sure AES128-CBC (+scrypt) is secure enough that it's not reasonably possibly to crack the private key. Obviously, sharing your private key (even encrypted) is not a good/safe idea, but I don't think anyone can reasonably crack this. — gen_Eric, Oct 25 '21 at 17:16
What you are proposing is a known plaintext attack: given the plaintext (the unencrypted private key) and the ciphertext (the encrypted private key) can the AES key be recovered? There are no known AES attacks against this scenario. In addition, there is a second barrier to recovering the password: the scrypt password-based KDF used to map the password into the AES key. Any attacker will go the easy route, namely password guessing. — President James K. Polk, Oct 25 '21 at 23:10
Thanks for the inputs. So does this mean this method is good for managing passwords for website login systems? — Nikhil VJ, Oct 26 '21 at 11:52
@NikhilVJ Are you using certificates for your login or passwords? If you are just using passwords then no, this is not what you want, you want to hash the password with something like `bcrypt`. It all depends what you are doing. For just a login on a website, this seems over-complicated when `bcrypt` should be enough there. — gen_Eric, Oct 26 '21 at 15:47
@RocketHazmat thanks for bcrypt reference. This link gives a straightforward implementation: https://zetcode.com/python/bcrypt/ I'll consider it. — Nikhil VJ, Oct 26 '21 at 17:09

score 2 · Answer 1 · answered Oct 25 '21 at 18:16

2

scryptAndAES128-CBC

It is not possible to derive the password from the ciphertext (to our current knowledge)

Can you find out what the (or a valid) passphrase is for the above key

The problem with passwords are people. Reusing passwords, using simple passwords,..

Usually passwords are looked up using dictionaries and combination tools. So the question is how "guessable" or random password is used.

answered Oct 25 '21 at 18:16

gusto2

11,210
2
17
36

Gusto, isn't public key assumed to know, then knowing the private key is like password hashing here (exportKey)? The adversary will try all passwords available plus some range. – kelalaka Oct 25 '21 at 21:13

Finding passphrase from private RSA key

1 Answers1