RSA Key Decoder

Category: Asymmetric & Elliptic Curve · Node Type ID: asymmetric-rsa-key-decode

Extracts the RSA components (N, e, d, ...) from an SPKI public key or PKCS#8 private key (DER)

Overview

Opens an RSA key and hands you the integers inside it. An RSA public key is just two numbers, the modulus N and the public exponent e. A private key adds the private exponent d and the values that make decryption and signing fast: the two prime factors p and q of N and three derived numbers called the CRT parameters.

The node reads exactly two encodings, both as DER bytes: a public key as SubjectPublicKeyInfo (SPKI) and a private key as PKCS#8. These are the formats produced by RSA Key Generator and used by the other RSA nodes. PEM text (the -----BEGIN ...----- form) and the older PKCS#1 encodings are not read: PEM is only a Base64 wrapper that NodeCrypto does not handle at all, and PKCS#1 keys are not accepted by the RSA nodes either, so converting them here would give you a key you cannot use. Convert such keys to SPKI or PKCS#8 DER with an outside tool first.

Because the node cannot tell from the connected wire whether the key is public or private, you choose with the Key Type property, and the node checks that the key really is of that kind. The ports that exist only for private keys appear only when Key Type is Private.

When to Use

Inspecting a generated or imported key: how large is N, which e was used, what are p and q.
Checking a textbook or test-vector key against known N, e, d values, for example by comparing the output with a Value Comparator.
Doing your own arithmetic with the key numbers, for instance feeding N and e into Bytes to Int and working with them in a script.

Parameter Configuration

Parameter (ID)	Type & Default	Visibility Condition	Description & Options
Key Type `keyType`	`select` Default: `Public`	Always visible	Which kind of key the `Key` input holds. The node fails if the connected key is of the other kind, so a public key cannot be read as `Private` and a private key cannot be read as `Public`. `Public`: Public (SPKI). Outputs `N` and `e`. `Private`: Private (PKCS#8). Also outputs `d`, `p`, `q`, `dP`, `dQ` and `qInv`.

Port I/O Specification

See Ports & Connections for general wiring rules, data type colors, and dynamic port creation.

Input Ports

Port Nature: Fixed Input Ports (1 total).

Port Name	Port ID	Data Type	Required	Visibility Condition	Description
`Key`	`key`	`Bytes` (SPKI/PKCS#8 DER)	Required	Always visible	The RSA key as DER bytes: SPKI for `Public`, PKCS#8 for `Private`. PEM text and PKCS#1 are not accepted.

Output Ports

Port Nature: Conditional Output Ports (2 always, 6 only for private keys).

Every number is returned as Bytes in big-endian order, as an unsigned integer with no leading zero bytes (the extra 00 that DER adds in front of a number whose top bit is set is removed). A 2048-bit modulus therefore comes out as exactly 256 bytes, and e = 65537 as the three bytes 01 00 01. Use Bytes to Int to turn a value into an integer.

Port Name	Port ID	Data Type	Visibility Condition	Description
`N`	`n`	`Bytes`	Always visible	The modulus `N` = `p` × `q`. Its bit length is the key size.
`e`	`e`	`Bytes`	Always visible	The public exponent `e`, usually `01 00 01` (65537).
`d`	`d`	`Bytes`	keyType = Private	The private exponent `d`, the inverse of `e` modulo λ(`N`) = lcm(`p` − 1, `q` − 1). Secret.
`p`	`p`	`Bytes`	keyType = Private	The first prime factor of `N`. Secret.
`q`	`q`	`Bytes`	keyType = Private	The second prime factor of `N`. Secret.
`dP`	`dp`	`Bytes`	keyType = Private	CRT exponent `d` mod (`p` − 1). Used to speed up private-key operations.
`dQ`	`dq`	`Bytes`	keyType = Private	CRT exponent `d` mod (`q` − 1).
`qInv`	`qInv`	`Bytes`	keyType = Private	CRT coefficient, the inverse of `q` modulo `p`.

Error Cases

When any of the following conditions occurs at runtime, this node transitions to an ERROR state and downstream nodes connected to its outputs do not execute.

Error Code	Default Engine Message	Trigger Condition
`INVALID_KEY_FORMAT`	Invalid RSA key format	Raised when the input is not an RSA key in the selected form. Typical causes: the DER is cut short or corrupted; PEM text was connected instead of DER bytes; the key is a PKCS#1 key; the key is public but Key Type is `Private` (or the reverse); the key belongs to another algorithm such as ECC; or it is an RSASSA-PSS key (a key bound to the PSS scheme), which is not supported. The message names the cause.

Examples

Reading the Numbers from a Generated Key

Generate a key and look at its components.

Connect Private Key from RSA Key Generator to Key, and set Key Type to Private.
Read N (256 bytes for a 2048-bit key), e (01 00 01) and d. Check that p and q are each 128 bytes.

Getting the Public Key Parts Only

Take N and e from a public key without touching the private key.

Connect Public Key from RSA Key Generator and leave Key Type at Public.
Only N and e are shown. Send them to RSA Key Encoder to rebuild an identical public key.