I have a pfx file. When I use the file stream to read this pfx file.
When I create the X509Certificate2 with just giving the raw bytes, it works.
But when I try to create the X509Certificate2 with the password and the flags I get an exception saying "The specified network password is incorrect".
The second X509Certificate2 construction fails with the exception : "The specified network password is incorrect" though the password is correct.
using (FileStream stream = new FileStream(#"D:\MyKey.pfx", FileMode.Open))
{
int length = (int)stream.Length;
byte[] certBytes = new byte[length];
stream.Read(certBytes, 0, length);
X509Certificate2 finalCert0 = new X509Certificate2(certBytes);
X509Certificate2 finalCert1 = new X509Certificate2(certBytes, "venki", X509KeyStorageFlags.Exportable | X509KeyStorageFlags.PersistKeySet);
}
Just had the same experience, I deleted the certificate file and re-copied the file over and it worked. I restored the old file and it failed in the same way. Comparing the files revealed the files were drastically different, some how the file had been corrupted.
Related
I have upload attachment endpoint that do the following:
convert the file to bytes
convert the bytes to stringBase64
encrypting the string (using AES with Key)
saving the Encrypted string as txt in the System file
app.UseStaticFiles(new StaticFileOptions
{
FileProvider = new PhysicalFileProvider(Path.Combine(env.ContentRootPath,"Attachments")),
RequestPath = "/Attachments"
});
the above code is how I'm serving the files.
What I want is ?
Is there any way to run any code (code for decrypting the txt file with encrypted string) on the Attachment before serving it to be ready for immediate use.
I'm using netcoreapp3.1
I am consuming a web api which has client certificate authentication. I have both cert.pem, key.perm files. and I tested the api's in postman successfully by importing both files in certificate tab..
it works fine. but when i try to implement that api in my asp.net web application, it shows authentication failed error. i don't know how to use both cert.pem, key.perm files in authentication part of my coding.
I tried some codings.
string url = "https://uat-api.ssg-wsg.sg/courses/runs/50331/sessions?uen=S89PB0005D&courseReferenceNumber=PA-S89PB0005D-01-Fuchun 354&sessionMonth=012021";
ServicePointManager.Expect100Continue = true;
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls
| SecurityProtocolType.Tls11
| SecurityProtocolType.Tls12
| SecurityProtocolType.Ssl3;
X509Certificate clientCertificate = X509Certificate.CreateFromCertFile(System.Web.HttpContext.Current.Server.MapPath("~/Certificates/cert.pem"));
HttpWebRequest WebReq = (HttpWebRequest)WebRequest.Create(string.Format(url));
WebReq.Method = "GET";
WebReq.ClientCertificates.Add(clientCertificate);
HttpWebResponse WebResp = (HttpWebResponse)WebReq.GetResponse();
using (Stream stream = WebResp.GetResponseStream())
{
StreamReader reader = new StreamReader(stream, System.Text.Encoding.UTF8);
jsonString = reader.ReadToEnd();
}
Can anyone help me how to use both cert.pem, key.perm files in authentication part and make the api runs successfully..
Thank You.
I'm assuming that your cert.pem file is the certificate and the key.pem file contains the private key.
If you are using .net 5, you can do something like this:
var certificatePem = File.ReadAllText("cert.pem"); //you have to provide the correct path here
var key = File.RealAllText("key.pem"); //and here
var certificate = X509Certificate2.CreateFromPem(certificatePem, key);
Note the use of the new X509Certificate2 class.
if my initial asumption is not true, please post the text within the pem files (you can strip off a portion of the text, or you can gray out the relevant parts, of course)
I am using epubreader (vers-one) NuGet package for parsing .epub files.
My Code:
string fileName = "SampleEPUB.epub";
var assembly = typeof(MainPage).GetTypeInfo().Assembly;
Stream stream = assembly.GetManifestResourceStream($"{assembly.GetName().Name}.{fileName}");
EpubBook epubBook = EpubReader.ReadBook(stream);
foreach (EpubNavigationItem chapter in epubBook.Navigation)
{
chapterDetails.Add(new ChapterDetails() { title = chapter.Title, htmlData = chapter.HtmlContentFile?.Content, subChapters = chapter.NestedItems });
}
For testing purposes, I have added the epub files on the project and parse the chapters like above. I need to change this implementation.
I am able to get the epub file links stored in our database. Now I need to parse the chapters of epub from the link. But when I use the link as the fileName in the above code I am getting the below exception:
System.AggregateException: 'One or more errors occurred. (Value cannot be null.Parameter name: stream)'
How can I solve this issue? One sample link is here. I have added a sample project here having .epub file links for the reference (epub file links are commented in the sample).
System.AggregateException: 'One or more errors occurred. (Value cannot be null.Parameter name: stream)'
The GetManifestResourceStream method is used to access the embedded file which should be placed in shared project for the Xamarin.Forms project. The code doesn't works for the file comes from a database. You could debug to get that the stream is null because the fileName doesn't exist in the project.
Stream stream = assembly.GetManifestResourceStream($"{assembly.GetName().Name}.{fileName}");
In your condition, it just needs to get the stream from the url. Try to use the following code to get the stream.
Stream stream;
HttpWebRequest request = (HttpWebRequest)WebRequest.Create(url);
HttpWebResponse response = (HttpWebResponse)aRequest.GetResponse();
stream = response.GetResponseStream();
I want to update Google AMP cache, so I need to sign an URL as described here.
My main issue: I'm struggling massively with how I should get my certificates/keys and how to include them in my code below.
I just can't find any all covering instructions for Windows and IIS.
I have been reading these posts:
Using /update-cache requests to update AMP pages
How can I sign a file using RSA and SHA256 with .NET?
I don't want to use my computer's certificate store as described in the second post. I'd rather use files on disk for both public and private keys.
From my production server IIS, I exported my certificate to a .pfx file, from which I then extracted the private key and certificate using the instructions on the bottom of this site.
The server.key contains -----BEGIN RSA PRIVATE KEY-----, which If I use that to load into the privateCert variable in the code below throws error Cannot find the requested object.
What I have gotten from my SSL provider:
www_example_com.crt, www_example_com.p7b, the certificate code (see below).
Steps I've taken:
I created test-public-key.cer by opening www_example.com.crt and using the Copy to file wizard to copy it to a base64 encoded .cer file.
I saved certificate code I received from my SSL provider as file test-private-key.cer.
When I run the following code I get error
Object reference not set to an instance of an object.
on line key.FromXmlString(privateCert.PrivateKey.ToXmlString(True))
Dim publicCert As X509Certificate2 = New X509Certificate2("C:\temp\_certificates\test-public-key.cer")
Dim privateCert As X509Certificate2 = New X509Certificate2("C:\temp\_certificates\test-private-key.cer")
'Round-trip the key to XML and back, there might be a better way but this works
Dim key As RSACryptoServiceProvider = New RSACryptoServiceProvider
key.FromXmlString(privateCert.PrivateKey.ToXmlString(True))
'Create some data to sign
Dim data() As Byte = System.Text.Encoding.Unicode.GetBytes(signatureUrl)
'Sign the data
Dim sig() As Byte = key.SignData(data, CryptoConfig.MapNameToOID("SHA256"))
Dim AMPURLSignature As String = EncodeTo64(sig.ToString)
'Lastly, the verification can be done directly with the certificate's public key without need for the reconstruction as we did with the private key:
key = CType(publicCert.PublicKey.Key, RSACryptoServiceProvider)
If Not key.VerifyData(data, CryptoConfig.MapNameToOID("SHA256"), sig) Then
Throw New CryptographicException
End If
EncodeTo64 function
Public Shared Function EncodeTo64(ByVal toEncode As String) As String
Dim toEncodeAsBytes As Byte() = System.Text.ASCIIEncoding.ASCII.GetBytes(toEncode)
Dim returnValue As String = System.Convert.ToBase64String(toEncodeAsBytes)
Return returnValue
End Function
certificate code
-----BEGIN CERTIFICATE-----
MIIF (...) DXuJ
-----END CERTIFICATE-----
UPDATE 1
I was able to generate a mysite.pfx file by following the export steps on this page.
In the wizard I made sure to select "Yes, export the private key" and I added a password. The rest of the steps I followed verbatim.
I then also ran these commands:
openssl pkcs12 -in mysite.pfx -nocerts -out private-key-VPS.pem
penssl pkcs12 -in mysite.pfx -clcerts -nokeys -out certificate-VPS.pem
I ended up with private-key-VPS.pem and a certificate-VPS.pem files
I'm aware the steps to get the mysite.pfx are slightly different than what #CodeFuller described, but so far so good?
I then added code:
Dim certificate As X509Certificate2 = New X509Certificate2("C:\temp\_certificates\prodserverV2\mysite.pfx", "mypwd")
Dim rsa As RSA = certificate.GetRSAPrivateKey()
Dim data() As Byte = System.Text.Encoding.Unicode.GetBytes(signatureUrl)
Dim sig() As Byte = rsa.SignData(data, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1)
Dim AMPURLSignature As String = EncodeTo64(sig.ToString)
But there I get 4 errors:
GetRSAPrivateKey' is not a member of 'X509Certificate2'.
'SignData' is not a member of 'RSA'.
'HashAlgorithmName' is not declared. It may be inaccessible due to its protection level.
'RSASignaturePadding' is not declared. It may be inaccessible due to its protection level.
UPDATE 2
Thanks #CodeFuller! I targeted framework 4.6.1 and now seem to be 1 step further. I end up with an URL like this: https://www-mysite-com.cdn.ampproject.org/update-cache/c/s/www.mysite.com/articles/270/newarticle1/amp?amp_action=flush&_ts=1522939248&_url_signature=U30zdGVtLkJ5uGVbRQ==. How can I now check if it's a valid URL?
I'm checking section "Generate the RSA key" on this page, but I'm confused, since I actually already just coded these steps or not? How can I check whether the URL I now end up with is valid?
UPDATE 3
Ok, I tried your new code. Still get the URL signature verification error. I tried with both the /amp URL of my article and without the /amp part in my URL. Both result in the same URL signature verification error.
I noticed when I print the final URL to my website (see code below), the URL reads:
https://www-toptrouwen-nl.cdn.ampproject.org/update-cache/c/s/www.toptrouwen.nl/artikelen/132/het-uitwisselen-van-de-trouwringen-hoe-voorkom-je-bloopers/amp?amp_action=flush&_ts=1523094395&_url_signature=U3lzdGVrLkn5dGVbXQ==
Notice that where the parameters should be amp_ts and amp_url_signature, they now are _ts and _url_signature respectively.
I tried editing the URL before I do the call to Google by manually renaming parameters _ts and _url_signature to amp_ts and amp_url_signature. But I guess that would result in a difference between the signature and the actual URL. Could it be that somehow my code botches the & character and therefore when I rename these manually later it always result in a signature verification? Do you see what I could fix in my code?
BTW: I tried replacing & with %26 in code-behind before signing the URL but then I get a Google 404 error:
The requested URL /update-cache/c/s/www.toptrouwen.nl/artikelen/132/het-uitwisselen-van-de-trouwringen-hoe-voorkom-je-bloopers/amp?amp_action=flush%26amp_ts=1523094395%26amp_url_signature=U3lzdGVrLkJ1dGVbXQ== was not found on this server. That’s all we know.
My code:
Dim ampBaseUrl As String = "https://www-toptrouwen-nl.cdn.ampproject.org"
Dim signatureUrl As String = "/update-cache/c/s/www.toptrouwen.nl/artikelen/132/het-uitwisselen-van-de-trouwringen-hoe-voorkom-je-bloopers/amp?amp_action=flush&_ts=" + tStamp
Dim rsa As RSA = certificate.GetRSAPrivateKey()
Dim data() As Byte = System.Text.Encoding.ASCII.GetBytes(signatureUrl)
Dim sig() As Byte = rsa.SignData(data, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1)
Dim AMPURLSignature As String = EncodeTo64(sig.ToString)
Dim url As String = ampBaseUrl + signatureUrl + "&_url_signature=" + AMPURLSignature
ltStatus.Text = "AMP URL:<a target='_blank' href='" + url + "'>" + url + "</a>"
Also, I'm sure this page exists in Google AMP cache, since I can see and request it in Google's search results on my mobile device.
UPDATE 4
I'm getting close I think and also getting some extra help, see here: https://github.com/ampproject/amphtml/issues/14483#issuecomment-380549060
What I'm trying now to make it easier for others to test as well: Instead of depending on my SSL I now ran the following commands to get a public and private key
openssl genrsa 2048 > private-key.pem
openssl rsa -in private-key.pem -pubout >public-key.pem
I now have files private-key.pem and public-key.pem
I'll rename public-key.pem to apikey.pub and place that on https://example.com/.well-known/amphtml/apikey.pub
I want to take the easiest approach recommended by #CodeFuller and create a .pfx file that I can then load into a variable of type X509Certificate2.
When I run this command:
openssl pkcs12 -export -out keys.pfx -inkey private-key.pem -in public-key.pem
I get the error: unable to load certificates
But this time I don't have a .crt file, only a public-key.pem. How can I get a .pfx file? I already checked here.
I saved certificate code I received from my SSL provider as file
test-private-key.cer
...
certificate code
-----BEGIN CERTIFICATE-----
MIIF (...) DXuJ
-----END CERTIFICATE-----
The file stored in a format
-----BEGIN CERTIFICATE-----
MIIF (...) DXuJ
-----END CERTIFICATE-----
is a certificate which basically contains a public key. It does not contain private key. That's why when you create instance of X509Certificate2 from such file, it's HasPrivateKey property is set to False and PrivateKey returns Nothing, and following statement expectedly throws NullReferenceException:
privateCert.PrivateKey.ToXmlString(True)
In order to sign the data, you need a private key. Private keys have the following format
-----BEGIN RSA PRIVATE KEY-----
MIICXQ...B7Bou+
-----END RSA PRIVATE KEY-----
Such private keys are usually stored in *.key or *.pem (Privacy Enhanced Mail) files. There is no built-in way to load instance of X509Certificate2 from pem file. There are a lot of code samples available how to do it, you will find them in the question linked above. However the easiest solution will be to create pfx file (containing both private and public keys). Then you could easily load pfx with corresponding constructor of X509Certificate2.
Creation of pfx file is very easy with SSL tool. If private.key contains private key (-----BEGIN RSA PRIVATE KEY-----) and public.crt contains public key (-----BEGIN CERTIFICATE-----), they you could create pfx file with the following command:
openssl pkcs12 -export -out keys.pfx -inkey private.key -in
public.crt
You will be asked to enter the password. This password will also be used when you load the key to X509Certificate2:
Dim certificate As X509Certificate2 = New X509Certificate2("d:\CodeFuller\_days\2018.04.05\keys.pfx", "Password here")
Now HasPrivateKey property is set to True and PrivateKey returns the instance of RSACryptoServiceProvider.
UPDATE
Regarding this code:
'Round-trip the key to XML and back, there might be a better way but this works
Dim key As RSACryptoServiceProvider = New
RSACryptoServiceProvider
key.FromXmlString(privateCert.PrivateKey.ToXmlString(True))
The instance of RSACryptoServiceProvider is actually stored in certificate.PrivateKey so you could avoid above code and replace it with:
Dim provider As RSACryptoServiceProvider = certificate.PrivateKey
However your current SignData() call will not work:
Dim sig() As Byte = key.SignData(data, CryptoConfig.MapNameToOID("SHA256"))
This will throw following exception:
System.Security.Cryptography.CryptographicException: 'Invalid
algorithm specified.'
The root cause is that RSACryptoServiceProvider does not support SHA256. That's why I suggest replacing it with RSACng in the following way:
Dim rsa As RSA = certificate.GetRSAPrivateKey()
Dim data() As Byte = System.Text.Encoding.Unicode.GetBytes(signatureUrl)
Dim sig() As Byte = rsa.SignData(data, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1)
Method GetRSAPrivateKey was added to X509Certificate2 class only since .NET Framework 4.6, so consider upgrading if you get following error:
error BC30456: 'GetRSAPrivateKey' is not a member of
'X509Certificate2'
UPDATE 2 (regarding URL validation)
The page you referenced contains openssl command for verifying the signature:
openssl dgst -sha256 -signature signature.bin -verify public-key.pem url.txt
However in your case it will be just a sanity check, because you have just generated the signature with a valid procedure. So answering your question:
How can I check whether the URL I now end up with is valid?
The best check is just to send request to AMP Cache with signed URL and check the response. I haven't used AMP Cache before but I believe it will respond with some HTTP error if the signature is invalid.
UPDATE 3 (regarding failed signature verification)
Update AMP Content page contains following command line for signing the URL:
echo -n >url.txt
'/update-cache/c/s/example.com/article?amp_action=flush&_ts=1484941817'
cat url.txt | openssl dgst -sha256 -sign private-key.pem >signature.bin
I have compared result signature built by this command with the signature calculated by the code from my answer. It turned out that they differ. I have researched the possible root cause and found that the problem is caused by the way we get URL bytes. Currently it's:
Dim data() As Byte = System.Text.Encoding.Unicode.GetBytes(signatureUrl)
However we should sign the URL represented in ASCII. So replace above line with:
Dim data() As Byte = System.Text.Encoding.ASCII.GetBytes(signatureUrl)
Now both signatures, from openssl utility and the code above, matches. If after the fix you still get URL signature verification error from Google AMP, then the problem will be with the input URL passed for signing.
UPDATE 4 (Getting PFX from private and public keys)
Generate private key:
openssl genrsa 2048 > private-key.pem
Generate public key:
openssl rsa -in private-key.pem -pubout > public-key.pem
Create certificate signing request:
openssl req -new -key private-key.pem -out certificate.csr
Create certificate:
openssl x509 -req -days 365 -in certificate.csr -signkey private-key.pem -out public.crt
You will be asked here for some certificate fields, e.g. Country Name, Organization Name, etc. It does not really matter which values you use, since you need this certificate for test purposes.
Create pfx file:
openssl pkcs12 -export -out keys.pfx -inkey private-key.pem -in public.crt
This is the code I use for signing a string with a certificate from disk. I modified it for use in an url. Maybe it will be of help to you.
public string signString(string originalString)
{
//load the certificate from disk
X509Certificate2 cert = loadCertificateFromFile("myCert.pfx", "myPassword");
//get the associated CSP and private key
using (RSACryptoServiceProvider csp = (RSACryptoServiceProvider)cert.PrivateKey)
using (SHA1Managed sha1 = new SHA1Managed())
{
//hash the data
UnicodeEncoding encoding = new UnicodeEncoding();
byte[] data = encoding.GetBytes(originalString);
byte[] hash = sha1.ComputeHash(data);
//sign the hash
byte[] signed = csp.SignHash(hash, CryptoConfig.MapNameToOID("SHA1"));
//convert to base64 and encode for use in an URL
return Server.UrlEncode(Convert.ToBase64String(signed));
//or return a regular string
//return Encoding.Default.GetString(signed);
}
}
public bool verifyString(string originalString, string signedString)
{
//convert back from base64 and url encoded string
byte[] signature = Convert.FromBase64String(Server.UrlDecode(signedString));
//or a regular string
//byte[] signature = Encoding.Default.GetBytes(signedString);
//load the certificate from disk
X509Certificate2 cert = loadCertificateFromFile("myCert.pfx", "myPassword");
//get the associated CSP and private key
using (RSACryptoServiceProvider csp = (RSACryptoServiceProvider)cert.PrivateKey)
using (SHA1Managed sha1 = new SHA1Managed())
{
//hash the data
UnicodeEncoding encoding = new UnicodeEncoding();
byte[] data = encoding.GetBytes(originalString);
byte[] hash = sha1.ComputeHash(data);
//sign the hash
byte[] signed = csp.SignHash(hash, CryptoConfig.MapNameToOID("SHA1"));
//verify the signature
return csp.VerifyHash(hash, CryptoConfig.MapNameToOID("SHA1"), signature);
}
}
public X509Certificate2 loadCertificateFromFile(string path, string password)
{
//get the absolute path
string absolutePath = Server.MapPath(path);
//for non-website users, use this
//string absolutePath = Path.Combine(AppDomain.CurrentDomain.BaseDirectory, path);
if (!string.IsNullOrEmpty(password))
{
return new X509Certificate2(absolutePath, password, X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.Exportable);
}
else
{
return new X509Certificate2(absolutePath);
}
}
Usage:
string originalString = "This is a test string";
string signedString = signString(originalString);
bool stringIsCorrect = verifyString(originalString, signedString);
I now see you use VB. You can use this to convert the code http://www.carlosag.net/tools/codetranslator. However it may need some modification afterwards as I don't know the accuracy of the converter.
I encrypt file with openssl then put it on HDFS, I used AES/ECB, 128 bits and salt option, and with some research I find out openssl uses PKCS5 padding as default which are all defaults in CryptoFileLoader class. Here is my encryption process:
# echo -n "password" > .pw
# openssl enc -aes-128-ecb -salt -in .pw -out .pw.enc
# hdfs dfs -put .pw.enc /user/user1/
Sqoop version is 1.4.6
Command:
sqoop import \
-Dorg.apache.sqoop.credentials.loader.class=org.apache.sqoop.util.password.CryptoFileLoader \
-Dorg.apache.sqoop.credentials.loader.crypto.passphrase=sqoop \
--connect jdbc:oracle:thin:#host/database \
--username user1 \
--password-file /user/user1/.pw.enc \
--table db.table1 \
--hive-import \
--hive-overwrite \
--hive-table hivedb.table1 \
--hive-drop-import-delims
which gives:
17/03/08 15:10:37 WARN tool.BaseSqoopTool: Failed to load password file
java.io.IOException: Can't decrypt the password
at org.apache.sqoop.util.password.CryptoFileLoader.loadPassword(CryptoFileLoader.java:151)
at org.apache.sqoop.util.CredentialsUtil.fetchPasswordFromLoader(CredentialsUtil.java:81)
at org.apache.sqoop.util.CredentialsUtil.fetchPassword(CredentialsUtil.java:66)
at org.apache.sqoop.tool.BaseSqoopTool.applyCredentialsOptions(BaseSqoopTool.java:1042)
at org.apache.sqoop.tool.BaseSqoopTool.applyCommonOptions(BaseSqoopTool.java:997)
at org.apache.sqoop.tool.ImportTool.applyOptions(ImportTool.java:875)
at org.apache.sqoop.tool.SqoopTool.parseArguments(SqoopTool.java:435)
at org.apache.sqoop.Sqoop.run(Sqoop.java:131)
at org.apache.hadoop.util.ToolRunner.run(ToolRunner.java:70)
at org.apache.sqoop.Sqoop.runSqoop(Sqoop.java:179)
at org.apache.sqoop.Sqoop.runTool(Sqoop.java:218)
at org.apache.sqoop.Sqoop.runTool(Sqoop.java:227)
at org.apache.sqoop.Sqoop.main(Sqoop.java:236)
Caused by: javax.crypto.BadPaddingException: Given final block not properly padded
at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:966)
at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:824)
at com.sun.crypto.provider.AESCipher.engineDoFinal(AESCipher.java:436)
at javax.crypto.Cipher.doFinal(Cipher.java:2165)
at org.apache.sqoop.util.password.CryptoFileLoader.loadPassword(CryptoFileLoader.java:149)
... 12 more
Error while loading password file: Can't decrypt the password
I tried manually giving the other CryptoFileLoader parameters too and also passing local file to the --password-file .
I can decrypt the file back successfully with openssl. I can't decrypt with Java program(?)
I saw there is an issue with padding but I didn't know what it is and how to encrypt the file with a certain padding method or whatever else to do, I'm not experienced with encryption.
There is also org.apache.sqoop.credentials.loader.crypto.iterations parameter in the class which indicates number of PBKDF2 iterations but I don't know if it changes anything.
Thanks for any help.
I am not expert with Sqoop and Hadoop but starting from your exception
CryptoFileLoader.loadPassword(CryptoFileLoader.java:151)
I gave a look at the source code of CryptoFileLoader.java
It seems to me that things are a bit different from what you do: the password is stored in an encrypted file using the PBKDF2 algorithm, which is not equivalent to apply AES-128-ECB. From wikipedia:
PBKDF2 applies a pseudorandom function, such as hash-based message authentication code (HMAC), to the input password or passphrase along with a salt value and repeats the process many times to produce a derived key, which can then be used as a cryptographic key in subsequent operations. The added computational work makes password cracking much more difficult, and is known as key stretching.
There is no way to do PBKDF2 from Openssl command line. I made a small test using Java, it could be an alternative
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.security.NoSuchAlgorithmException;
import javax.crypto.Cipher;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.SecretKeySpec;
public class Test {
/*Default is AES in electronic code book with padding.*/
private static String DEFAULT_ALG = "AES/ECB/PKCS5Padding";
/*Default salt is not much secure, use your own!*/
private static String DEFAULT_SALT = "SALT";
/*Iterate 10000 times by default.*/
private static int DEFAULT_ITERATIONS = 10000;
/*One of valid key sizes for default algorithm (AES).*/
private static int DEFAULT_KEY_LEN = 128;
public static void main(String[] args) throws IOException {
String inputFileName = "C:\\temp\\in.txt"; /*Enter your input (plain) file path */
String outputFileName = "C:\\temp\\out.bin"; /*Enter your output (encrypted) file path */
String passPhrase = "mypassphrase"; /*Enter your passphrase */
String salt = DEFAULT_SALT;
String alg = DEFAULT_ALG;
int iterations = DEFAULT_ITERATIONS;
int keyLen = DEFAULT_KEY_LEN;
SecretKeyFactory factory = null;
try {
factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1");
} catch (NoSuchAlgorithmException e) {
throw new IOException("Can't load SecretKeyFactory", e);
}
SecretKeySpec key = null;
try {
String algOnly = alg.split("/")[0];
key = new SecretKeySpec(
factory.generateSecret(
new PBEKeySpec(passPhrase.toCharArray(), salt.getBytes(), iterations, keyLen)).getEncoded(),
algOnly);
} catch (Exception e) {
throw new IOException("Can't generate secret key", e);
}
Cipher crypto = null;
try {
crypto = Cipher.getInstance(alg);
} catch (Exception e) {
throw new IOException("Can't initialize the decryptor", e);
}
Path inputFileLocation = Paths.get(inputFileName);
byte[] decrypted = Files.readAllBytes(inputFileLocation);
byte[] encrypted;
try {
crypto.init(Cipher.ENCRYPT_MODE, key);
encrypted = crypto.doFinal(decrypted);
} catch (Exception e) {
throw new IOException("Can't decrypt the password", e);
}
Path outputFileLocation = Paths.get(outputFileName);
Files.write(outputFileLocation, encrypted);
}
}
As in Simone's answer - there is a difference in the encryption algorithm between openssl and java implementation. That is why you can decrypt using openssl with no problem (as it is invoking its own (different) algorithm again).
After much digging I found this answer from (Dave Thompson) which states:
Short answer: what openssl enc (without -K for raw) uses is not PBKDF2; it is almost PBKDF1, with iteration count 1.
It seems that there are two ways round this issue, either:
a) Find something in java that can decrypt what openssl is doing - there is a java library 'BouncyCastle' referenced in a post inside this answer (if you are happy using that instead of standard CryptoFile) where they have implemented the exact same algorithm that openssl is using.
or
b) Find some other command line utility to use instead of openssl that implements PBKDF2. A number of implementations in different languages are referenced in the nabble.com posting also mentioned.
(Due credit to Dave for the key observation quoted)