RSA Key Encoder

Category: Asymmetric & Elliptic Curve · Node Type ID: asymmetric-rsa-key-encode

Builds an RSA SPKI public key or PKCS#8 private key (DER) from its components N, e and d

Overview

Builds a usable RSA key from the integers that define it. A public key needs the modulus N and the public exponent e. A private key is defined by N, e and the private exponent d. This is the node to use when the numbers come from somewhere other than a key file: a textbook exercise, a published test vector, or your own calculation.

The result is a single Key output in DER bytes: SubjectPublicKeyInfo (SPKI) for a public key, PKCS#8 for a private key. These are exactly the formats RSA Encrypt, RSA Decrypt, RSA Sign and RSA Verify expect, so the output connects to them directly. There is no PEM output; if you need PEM in another tool, wrap the Base64 of the DER in BEGIN/END lines outside NodeCrypto.

A standard private key stores more than N, e and d: it also carries the prime factors p and q and three CRT values. You do not supply these. The node computes p and q from N, e and d with the standard factoring-from-d method (NIST SP 800-56B, Appendix C), checks that p × q = N and that d really inverts e, then derives dP, dQ and qInv. The result does not depend on chance: the same inputs always give the same key, with p as the larger factor. Keys made by RSA Key Generator pass through RSA Key Decoder and this node back to the identical bytes.

When to Use

Using published N, e and d values (a textbook exercise, a standard test vector) with the RSA nodes.
Building a public key from just N and e, for example to verify a signature when you only know those two numbers.
Round-tripping a key through RSA Key Decoder after editing a component to see what breaks.

Parameter Configuration

Parameter (ID)	Type & Default	Visibility Condition	Description & Options
Key Type `keyType`	`select` Default: `Public`	Always visible	The kind of key to build. It decides both the output format and whether the `d` input exists. `Public`: Public (SPKI). Needs `N` and `e`; outputs an SPKI public key. `Private`: Private (PKCS#8). Also needs `d`; outputs a PKCS#8 private key.

Port I/O Specification

See Ports & Connections for general wiring rules, data type colors, and dynamic port creation.

Input Ports

Port Nature: Conditional Input Ports (2 always, 1 only for private keys).

Every number is Bytes in big-endian order, read as an unsigned integer. Leading zero bytes are ignored, so values that carry a 00 prefix work too. A value of zero, or an empty value, is rejected. Numbers typed as hex in Static Value connect directly; to start from a decimal integer, convert it with Int to Bytes first.

Port Name	Port ID	Data Type	Required	Visibility Condition	Description
`N`	`n`	`Bytes`	Required	Always visible	The modulus `N`. It must be odd and greater than 1.
`e`	`e`	`Bytes`	Required	Always visible	The public exponent `e`. It must be odd, at least 3, and smaller than `N`. Typically `01 00 01` (65537).
`d`	`d`	`Bytes`	Required	keyType = Private	The private exponent `d`, with 1 < `d` < `N`. The two prime factors are computed from it; they are not inputs.

Output Ports

Port Nature: Fixed Output Ports (1 total).

Port Name	Port ID	Data Type	Visibility Condition	Description
`Key`	`key`	`Bytes` (SPKI/PKCS#8 DER)	Always visible	The RSA key as DER bytes: an SPKI public key when Key Type is `Public`, a PKCS#8 private key when it is `Private`.

Error Cases

When any of the following conditions occurs at runtime, this node transitions to an ERROR state and downstream nodes connected to its outputs do not execute.

Error Code	Default Engine Message	Trigger Condition
`RSA_COMPONENTS_INVALID`	Invalid RSA components (N, e or d)	Raised when the numbers cannot form an RSA key. The message states which check failed. N, e or d is empty or zero, `N` is even or 1, `e` is even, below 3 or not smaller than `N`, or `d` is not between 1 and `N`. Check the values and their byte order; a value read in little-endian order, or a hex string that was cut short, is the usual cause. The prime factors cannot be recovered, or `d` does not match `N` and `e`. The three numbers do not belong to the same key, for example `d` was copied from another key or one digit was changed. `N` must also be a product of exactly two primes.

Examples

Building a Private Key from N, e and d

Use published numbers to decrypt data with the RSA nodes.

Put the three values in three Static Value nodes (type bytes, written in hex) and connect them to N, e and d. Set Key Type to Private.
Connect Key to Private Key of RSA Decrypt, together with the ciphertext.
If the node reports RSA_COMPONENTS_INVALID, the numbers are not a consistent key; check each value against its source.

Building a Public Key from N and e

Create a public key when you only know the modulus and exponent.

Leave Key Type at Public and connect N and e. No d input is shown.
Connect Key to Public Key of RSA Verify, together with the message and the signature.