Converting PrivateKey to pem string without using bouncycastle

Question

I'm trying to convert a PrivateKey object to pem format string without using bouncycastle. previously I was doing it like this:

    StringWriter str = new StringWriter();
    PEMWriter pemWriter = new PEMWriter(str);
    pemWriter.writeObject(privKey);
    pemWriter.close();
    str.close();        
    return str.toString().getBytes();

Now I don't want to use bouncycastle. If I use

    String code = "-----BEGIN RSA PRIVATE KEY-----\n";          
    String codenew =Base64.encodeBase64String(privKey.getEncoded());
    String myOutput = ""; 
    for (String substring : Splitter.fixedLength(64).split(codenew)) { 
      myOutput += substring + "\n"; 
    }
    code += myOutput.substring(0, myOutput.length() - 1);
    code += "\n-----END RSA PRIVATE KEY-----";                          
    return code.getBytes();

The code above works and I'm able to decrypt using openssl by passing this byte[]. Now, my problem is, if I'm printing the pem string value for the above two piece of code, they are different. If I'm using the below openssl command

$ openssl pkcs12 -in receiver.p12 -out receiver.pem -nodes

the pem string thats generated is same as PEMWriter's pem string but not the other one. I wanted to know can I modify my code a bit so that the string when printed, matches the one thats generated by openssl command or PEMWriter.

pem generated by openssl/PEMWriter:

-----BEGIN RSA PRIVATE KEY-----
MIIEpgIBAAKCAQEA9rbxqq+Zi70nRFAZe7SCTB6VgzP1PhkiUm0PmbwFmROSlSSy
yMPSyIzaQqwELyOSQTZtsT3jhd6MCFPBZntym63/GwDuethGSjE9y8rt/9yr+T3I
zz+6ABnZXHJ38tdGYataF1Ndi3CsY5NXGszVFv1Is17P5mbYWQgJ7QzI/a5mPKa+
9pVXsDQthEV3BVUawIEJJnS0THD5XZQJ/MX6F4RPn+2MC9i/RbcA0RVnLPmt2eiy
NV3+55sKdd7GpdMmEbRv9HZyW2xJNyu1xYbwU9YIP88dHCgvqoOgkAX2HLxCJOy6
2gvsS8J7HEbohD98dxPJX7P8w9juORi6Hpsq0wIDAQABAoIBAQDXStIdJtuRC+GG
RXfXca/6iP3j3qV2KSzATRe+CkvAR0o1CC9T7z6zb+bPI5kLIblxWvPiJaW0nn4I
jj5JFhTvMalagTeaz7yW5d2NR2rlSkZwW7Au2uePSv9ZIzL1IVLzzDnz/PW2xv5I
br0mT/Tr+N9GV8iIwNqu5sryp6OFasKB/55LhCcKVYrkdy2WhJc8Y8TXUjF4n8Jn
Xuyd44N6uu5RUiEgN7bPszO1F1T8ujCICwDNnYUw9lwSVvEC2EbTg84lu2UcnE4k
grB7rCKLooDpYlKjXx/1o9Dj9Uv3hwLpSTw2dYRoZS0kOFIKYACP1QcininrTGeL
cOPXyK6BAoGBAPvnBd7/U94Krp9Bp3jjxUEnlFrgf+B7QgRKpG7tN3RDRJmIVL8Z
mnxvbW6o4hsq4TzF/ratnRjqp+79Tw5wUz36G98ftWlTUs62OBznIkwImDGo+ysv
3QK8XUZ4Wg3EcnE5bG8AmOKoDRazc0g7UxopbHC+SNLRMZA/2dBvVh4zAoGBAPq6
UWIfcSnLyFYy7EPh3P7qmotBNPORgcX6aKdwR7pzk6MqTADHxKvIP+eeDEWpF58T
RYBW7KxN4h6cNMglRZBbhED3hONJkpYMGSq0hyczN40SIHHrf3iBO7p35v7Eee82
2H/rT6BNrQF1fPIbz5spgT+eV5BuTAB7bsbWiuDhAoGBALVAgeT26y21mfhVkV9W
5LQA+qp5JworJlFYNADtBx3M2StwASqQDazDsIYTVr4dmHvWK3Teb09iaPt5oMzO
3daWhD+D3VCv98FtM+r4FKGI/Zmd8Twd8HTrfGIcbw/A7mex3efxEhDkwqY28Rhk
N2N3suNcx6GJjJQynVNxCRIpAoGBAOJyIEqUxynOiPOBLm3osiXxUP7wN5i8FA7w
qFCBUecNt4uoCdiyk+fqBf10evT3UQQ07ZKJ71t3RAANaIZTU06buQjMBFMbAa9O
4fP19BLtaQCaHH+HCCuX3I/+9rumS9JHIKX3qoTHYrdsmxo3D/u9MqR4p/EkDLRq
xpQC9I9BAoGBAPZtxtEKc0xhYeuor4qIQbt1edrO+cfEzaXyUvjleLdg8rU3Yeh3
JLbYgcSNr4rMvEwhuvwbwgWJjed7TvqjKKEYYSWW2ESwcmAjNIhDBVzX9oh1cY34
Ae/P63OHt89sWbb5oG2+fcb7xCwH3kYmVgT4/xPv0FQRspwpErKYlCWg
-----END RSA PRIVATE KEY-----

pem generated when not using BC:

-----BEGIN RSA PRIVATE KEY-----
MIIEwAIBADANBgkqhkiG9w0BAQEFAASCBKowggSmAgEAAoIBAQD2tvGqr5mLvSdE
UBl7tIJMHpWDM/U+GSJSbQ+ZvAWZE5KVJLLIw9LIjNpCrAQvI5JBNm2xPeOF3owI
U8Fme3Kbrf8bAO562EZKMT3Lyu3/3Kv5PcjPP7oAGdlccnfy10Zhq1oXU12LcKxj
k1cazNUW/UizXs/mZthZCAntDMj9rmY8pr72lVewNC2ERXcFVRrAgQkmdLRMcPld
lAn8xfoXhE+f7YwL2L9FtwDRFWcs+a3Z6LI1Xf7nmwp13sal0yYRtG/0dnJbbEk3
K7XFhvBT1gg/zx0cKC+qg6CQBfYcvEIk7LraC+xLwnscRuiEP3x3E8lfs/zD2O45
GLoemyrTAgMBAAECggEBANdK0h0m25EL4YZFd9dxr/qI/ePepXYpLMBNF74KS8BH
SjUIL1PvPrNv5s8jmQshuXFa8+IlpbSefgiOPkkWFO8xqVqBN5rPvJbl3Y1HauVK
RnBbsC7a549K/1kjMvUhUvPMOfP89bbG/khuvSZP9Ov430ZXyIjA2q7myvKno4Vq
woH/nkuEJwpViuR3LZaElzxjxNdSMXifwmde7J3jg3q67lFSISA3ts+zM7UXVPy6
MIgLAM2dhTD2XBJW8QLYRtODziW7ZRycTiSCsHusIouigOliUqNfH/Wj0OP1S/eH
AulJPDZ1hGhlLSQ4UgpgAI/VByKeKetMZ4tw49fIroECgYEA++cF3v9T3gqun0Gn
eOPFQSeUWuB/4HtCBEqkbu03dENEmYhUvxmafG9tbqjiGyrhPMX+tq2dGOqn7v1P
DnBTPfob3x+1aVNSzrY4HOciTAiYMaj7Ky/dArxdRnhaDcRycTlsbwCY4qgNFrNz
SDtTGilscL5I0tExkD/Z0G9WHjMCgYEA+rpRYh9xKcvIVjLsQ+Hc/uqai0E085GB
xfpop3BHunOToypMAMfEq8g/554MRakXnxNFgFbsrE3iHpw0yCVFkFuEQPeE40mS
lgwZKrSHJzM3jRIgcet/eIE7unfm/sR57zbYf+tPoE2tAXV88hvPmymBP55XkG5M
AHtuxtaK4OECgYEAtUCB5PbrLbWZ+FWRX1bktAD6qnknCismUVg0AO0HHczZK3AB
KpANrMOwhhNWvh2Ye9YrdN5vT2Jo+3mgzM7d1paEP4PdUK/3wW0z6vgUoYj9mZ3x
PB3wdOt8YhxvD8DuZ7Hd5/ESEOTCpjbxGGQ3Y3ey41zHoYmMlDKdU3EJEikCgYEA
4nIgSpTHKc6I84EubeiyJfFQ/vA3mLwUDvCoUIFR5w23i6gJ2LKT5+oF/XR69PdR
BDTtkonvW3dEAA1ohlNTTpu5CMwEUxsBr07h8/X0Eu1pAJocf4cIK5fcj/72u6ZL
0kcgpfeqhMdit2ybGjcP+70ypHin8SQMtGrGlAL0j0ECgYEA9m3G0QpzTGFh66iv
iohBu3V52s75x8TNpfJS+OV4t2DytTdh6HckttiBxI2visy8TCG6/BvCBYmN53tO
+qMooRhhJZbYRLByYCM0iEMFXNf2iHVxjfgB78/rc4e3z2xZtvmgbb59xvvELAfe
RiZWBPj/E+/QVBGynCkSspiUJaA=
-----END RSA PRIVATE KEY-----

Scrub

Can you please provide complete outputs for some dummy key? – Sherrer

I've updated the question with the complete key data when printed. – Scrub

Answer 1

PEMWriter class from BouncyCastle stores private key in PKCS#1 format (for more details please see RsaPrivateKey stucture defined in RFC 3447):

Your code stores private key in PKCS#8 format (for more details please see PrivateKeyInfo structure defined in RFC 5208):

PKCS#1 defines how to store RSA keys while PKCS#8 defines an envelope that can store any asymmetric key pair. As you can see on the attached pictures PKCS#8 just envelopes PKCS#1 and specifies that key is usable with RSA algorithm.

Sherrer

So this explains how openssl is still able to use the key data to decrypt. Can I alter my Base64 encoding code (w/o BC) a bit so that when I print it out, it prints the PKCS#1 format. I want this so that its not a confusion for other developers when they see the output of my code vs openssl command. – Scrub

@user3645686 Instance of which class is privKey variable in your code? – Sherrer

java.security.PrivateKey – Scrub

@Scrub I don't have any java IDE available right now so I am just guessing: PrivateKeyInfo privKeyInfo = new PrivateKeyInfo(ASN1Sequence.getInstance(privKey.getEncoded())); byte[] pkcs1 = privKeyInfo.parsePrivateKey().toASN1Primitive().getEncoded(); – Sherrer

Ah...PrivateKeyInfo is from SpongyCastle. I don't want to use SC. I want to remove SC dependency from my project. – Scrub

@Scrub It is not an easy task to do what you want without a SpongyCastle. For a bulletproof solution you would need to use/write at least ASN.1 parser, read PrivateKeyInfo structure with it and extract RsaPrivateKey structure out of it. However there is also a lightweight but very hackish way: you can remove all bytes before the third occurrence of 0x30 byte - that's where the third ASN.1 sequence (RsaPrivateKey) starts. It would mean to delete the first 26 bytes in most cases. – Sherrer