crypto: Add support for exporting private keys behind a feature (#4574)

For our security-sensitve code, it is nice to have a compile-time
guarantee that private key material can't be accessed or leaked, as
there simply is no API provided to do so. However, certain utilities and
code that runs outside of the TCB do require access to private key
secrets, such as the upcoming vtpm_util for preprovisioning TPMs.

Add a new feature to crypto to gate methods that allow such access to
private keys, add a new helper to RSA to expose components in a more
friendly format, and implement this method for all backends.

Author: smalis-msft

support/crypto/Cargo.toml

@@ -7,8 +7,11 @@ edition.workspace = true
 rust-version.workspace = true
 
 [features]
+# Allow exporting private keys.
+export_private = []
+
 # Enable test-only helper functions.
-test_helpers = ["x509-cert?/builder"]
+test_helpers = ["export_private", "x509-cert?/builder"]
 
 # If the chosen backend supports it, vendor it.
 # If the chosen backend is natively available, this feature is a no-op.
@@ -109,6 +112,8 @@ x509-cert.workspace = true
 [dev-dependencies]
 der = { workspace = true, features = ["derive", "alloc"] }
 hex.workspace = true
+pkcs1.workspace = true
+pkcs8 = { workspace = true, features = ["alloc"] }
 x509-cert = { workspace = true, features = ["builder"] }
 
 [lints]

support/crypto/src/lib.rs

@@ -9,6 +9,13 @@
 //!
 //! It is explicitly specialized for the needs of the OpenVMM project and is
 //! not suitable for general-purpose use.
+//!
+//! # Private key export
+//!
+//! The `export_private` feature allows access to private key material through
+//! export methods. Exported bytes and components contain unencrypted secrets.
+//! Callers are responsible for protecting them and clearing them when no longer
+//! needed. The returned byte vectors are not automatically zeroized.
 
 // UNSAFETY: calling BCrypt APIs on Windows, Security.framework APIs on macOS,
 // and defining/referencing an extern symbol for the backend-selection

support/crypto/src/rsa/mac.rs

@@ -206,22 +206,12 @@ impl RsaKeyPairInner {
         Ok(Self(handle))
     }
 
-    #[cfg(any(test, feature = "test_helpers"))]
+    #[cfg(any(test, feature = "export_private"))]
     pub fn to_pkcs8_der(&self) -> Result<Vec<u8>, RsaError> {
         use der::asn1::OctetString;
         use pkcs8::spki::AlgorithmIdentifierOwned;
 
-        let mut error: CFErrorRef = ptr::null();
-        // SAFETY: self.0.0 is a valid SecKeyRef.
-        let data = unsafe { SecKeyCopyExternalRepresentation(self.0.0, &mut error) };
-        if data.is_null() {
-            // SAFETY: error is null or valid.
-            return Err(unsafe { rsa_sec_err(error, "exporting the RSA private key") });
-        }
-        let data = CfHandle(data);
-        // SAFETY: data.0 is a valid CFDataRef.
-        let pkcs1_der = unsafe { cf_data_to_vec(data.0) };
-
+        let pkcs1_der = self.export_pkcs1_der()?;
         let pki = pkcs8::PrivateKeyInfoOwned {
             algorithm: AlgorithmIdentifierOwned {
                 oid: pkcs1::ALGORITHM_OID,
@@ -235,6 +225,39 @@ impl RsaKeyPairInner {
             .map_err(|e| der_err(e, "encoding the PKCS#8 PrivateKeyInfo"))
     }
 
+    #[cfg(any(test, feature = "export_private"))]
+    pub fn to_private_components(&self) -> Result<super::RsaPrivateKeyComponents, RsaError> {
+        let der = self.export_pkcs1_der()?;
+        let key = pkcs1::RsaPrivateKey::from_der(&der)
+            .map_err(|e| der_err(e, "parsing the exported PKCS#1 RSA private key"))?;
+        if key.other_prime_infos.is_some() {
+            return Err(RsaError(crate::BackendError::Invalid(
+                "multi-prime RSA private keys are not supported",
+            )));
+        }
+        Ok(super::RsaPrivateKeyComponents {
+            modulus: key.modulus.as_bytes().to_vec(),
+            public_exponent: key.public_exponent.as_bytes().to_vec(),
+            private_exponent: key.private_exponent.as_bytes().to_vec(),
+            prime1: key.prime1.as_bytes().to_vec(),
+            prime2: key.prime2.as_bytes().to_vec(),
+        })
+    }
+
+    #[cfg(any(test, feature = "export_private"))]
+    fn export_pkcs1_der(&self) -> Result<Vec<u8>, RsaError> {
+        let mut error: CFErrorRef = ptr::null();
+        // SAFETY: self.0.0 is a valid SecKeyRef.
+        let data = unsafe { SecKeyCopyExternalRepresentation(self.0.0, &mut error) };
+        if data.is_null() {
+            // SAFETY: error is null or valid.
+            return Err(unsafe { rsa_sec_err(error, "exporting the RSA private key") });
+        }
+        let data = CfHandle(data);
+        // SAFETY: data.0 is a valid CFDataRef.
+        Ok(unsafe { cf_data_to_vec(data.0) })
+    }
+
     pub fn oaep_decrypt(
         &self,
         input: &[u8],

support/crypto/src/rsa/mod.rs

@@ -75,12 +75,19 @@ impl RsaKeyPair {
         sys::RsaKeyPairInner::from_pkcs8_der(der).map(Self)
     }
 
-    #[cfg(any(test, feature = "test_helpers"))]
+    #[cfg(any(test, feature = "export_private"))]
     /// Convert the RSA private key to PKCS#8 DER-encoded bytes.
     pub fn to_pkcs8_der(&self) -> Result<Vec<u8>, RsaError> {
         self.0.to_pkcs8_der()
     }
 
+    #[cfg(any(test, feature = "export_private"))]
+    /// Returns the components of an RSA private key as big-endian
+    /// byte vectors, without leading zero padding.
+    pub fn to_private_components(&self) -> Result<RsaPrivateKeyComponents, RsaError> {
+        self.0.to_private_components()
+    }
+
     /// Decrypt `input` using RSA-OAEP with the specified hash algorithm.
     pub fn oaep_decrypt(
         &self,
@@ -117,14 +124,34 @@ impl RsaKeyPair {
 pub struct RsaPublicKey(pub(crate) sys::RsaPublicKeyInner);
 
 /// The public components of an RSA key.
+///
+/// All components are unsigned big-endian integers.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct RsaPublicKeyComponents {
-    /// The RSA modulus as a big-endian byte vector.
+    /// The RSA modulus, `n`.
     pub modulus: Vec<u8>,
-    /// The RSA public exponent as a big-endian byte vector.
+    /// The RSA public exponent, `e`.
     pub public_exponent: Vec<u8>,
 }
 
+/// The full components of a two-prime RSA private key.
+///
+/// All components are unsigned big-endian integers.
+#[cfg(any(test, feature = "export_private"))]
+#[derive(Clone, PartialEq, Eq)]
+pub struct RsaPrivateKeyComponents {
+    /// The RSA modulus, `n`.
+    pub modulus: Vec<u8>,
+    /// The RSA public exponent, `e`.
+    pub public_exponent: Vec<u8>,
+    /// The RSA private exponent, `d`.
+    pub private_exponent: Vec<u8>,
+    /// The first prime factor, `p`.
+    pub prime1: Vec<u8>,
+    /// The second prime factor, `q`.
+    pub prime2: Vec<u8>,
+}
+
 impl RsaPublicKey {
     /// Construct an RSA public key from a big-endian modulus `n` and
     /// big-endian public exponent `e`.
@@ -191,6 +218,7 @@ impl std::ops::Deref for RsaKeyPair {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use der::Decode;
 
     /// Sign and verify a message of arbitrary (i.e. not pre-hashed) length.
     /// Both backends must hash the message internally before applying the
@@ -338,4 +366,28 @@ mod tests {
         assert!(!pkcs1_as_pss);
         assert!(!pss_as_pkcs1);
     }
+
+    #[test]
+    fn private_components_match_pkcs8() {
+        let key = RsaKeyPair::generate(2048).unwrap();
+        let components = key.to_private_components().unwrap();
+        let public = key.to_components();
+        assert_eq!(components.modulus, public.modulus);
+        assert_eq!(components.public_exponent, public.public_exponent);
+
+        let der = key.to_pkcs8_der().unwrap();
+        let pki = pkcs8::PrivateKeyInfoRef::from_der(&der).unwrap();
+        let decoded = pkcs1::RsaPrivateKey::from_der(pki.private_key.as_bytes()).unwrap();
+        for (actual, expected) in [
+            (&components.modulus, decoded.modulus),
+            (&components.public_exponent, decoded.public_exponent),
+            (&components.private_exponent, decoded.private_exponent),
+            (&components.prime1, decoded.prime1),
+            (&components.prime2, decoded.prime2),
+        ] {
+            assert!(!actual.is_empty());
+            assert_ne!(actual[0], 0);
+            assert_eq!(actual.as_slice(), expected.as_bytes());
+        }
+    }
 }

support/crypto/src/rsa/ossl.rs

@@ -32,13 +32,29 @@ impl RsaKeyPairInner {
         Ok(Self(pkey))
     }
 
-    #[cfg(any(test, feature = "test_helpers"))]
+    #[cfg(any(test, feature = "export_private"))]
     pub fn to_pkcs8_der(&self) -> Result<Vec<u8>, RsaError> {
         self.0
             .private_key_to_pkcs8()
             .map_err(|e| err(e, "encoding the private key as PKCS#8 DER"))
     }
 
+    #[cfg(any(test, feature = "export_private"))]
+    pub fn to_private_components(&self) -> Result<super::RsaPrivateKeyComponents, RsaError> {
+        let rsa = self
+            .0
+            .rsa()
+            .map_err(|e| err(e, "accessing the RSA private key"))?;
+
+        Ok(super::RsaPrivateKeyComponents {
+            modulus: rsa.n().to_vec(),
+            public_exponent: rsa.e().to_vec(),
+            private_exponent: rsa.d().to_vec(),
+            prime1: rsa.p().unwrap().to_vec(),
+            prime2: rsa.q().unwrap().to_vec(),
+        })
+    }
+
     pub fn oaep_decrypt(
         &self,
         input: &[u8],

support/crypto/src/rsa/rust.rs

@@ -39,7 +39,7 @@ impl RsaKeyPairInner {
         Ok(Self(parsed))
     }
 
-    #[cfg(any(test, feature = "test_helpers"))]
+    #[cfg(any(test, feature = "export_private"))]
     pub fn to_pkcs8_der(&self) -> Result<Vec<u8>, RsaError> {
         use pkcs8::EncodePrivateKey;
         Ok(self
@@ -50,6 +50,25 @@ impl RsaKeyPairInner {
             .to_vec())
     }
 
+    #[cfg(any(test, feature = "export_private"))]
+    pub fn to_private_components(&self) -> Result<super::RsaPrivateKeyComponents, RsaError> {
+        use rsa::traits::PrivateKeyParts;
+
+        let [p, q] = self.0.primes() else {
+            return Err(RsaError(
+                rsa::Error::InvalidArguments,
+                "exporting a two-prime RSA private key",
+            ));
+        };
+        Ok(super::RsaPrivateKeyComponents {
+            modulus: self.0.n().to_be_bytes_trimmed_vartime().into_vec(),
+            public_exponent: self.0.e().to_be_bytes_trimmed_vartime().into_vec(),
+            private_exponent: self.0.d().to_be_bytes_trimmed_vartime().into_vec(),
+            prime1: p.to_be_bytes_trimmed_vartime().into_vec(),
+            prime2: q.to_be_bytes_trimmed_vartime().into_vec(),
+        })
+    }
+
     pub fn oaep_decrypt(
         &self,
         input: &[u8],

support/crypto/src/rsa/symcrypt.rs

@@ -53,7 +53,7 @@ impl RsaKeyPairInner {
         Ok(Self(rsa))
     }
 
-    #[cfg(any(test, feature = "test_helpers"))]
+    #[cfg(any(test, feature = "export_private"))]
     pub fn to_pkcs8_der(&self) -> Result<Vec<u8>, RsaError> {
         use der::Encode;
         use der::asn1::OctetString;
@@ -98,6 +98,21 @@ impl RsaKeyPairInner {
             .map_err(|e| der_err(e, "encoding the PKCS#8 PrivateKeyInfo"))
     }
 
+    #[cfg(any(test, feature = "export_private"))]
+    pub fn to_private_components(&self) -> Result<super::RsaPrivateKeyComponents, RsaError> {
+        let blob = self
+            .0
+            .export_key_pair_blob()
+            .map_err(|e| err(e, "exporting the RSA key blob"))?;
+        Ok(super::RsaPrivateKeyComponents {
+            modulus: blob.modulus,
+            public_exponent: blob.pub_exp,
+            private_exponent: blob.private_exp,
+            prime1: blob.p,
+            prime2: blob.q,
+        })
+    }
+
     pub fn oaep_decrypt(
         &self,
         input: &[u8],

support/crypto/src/rsa/win.rs

@@ -27,22 +27,22 @@ use windows::Win32::Security::Cryptography::BCRYPT_RSAPRIVATE_BLOB;
 use windows::Win32::Security::Cryptography::BCRYPT_RSAPUBLIC_BLOB;
 use windows::Win32::Security::Cryptography::BCRYPT_RSAPUBLIC_MAGIC;
 use windows::Win32::Security::Cryptography::CNG_RSA_PRIVATE_KEY_BLOB;
-#[cfg(any(test, feature = "test_helpers"))]
+#[cfg(any(test, feature = "export_private"))]
 use windows::Win32::Security::Cryptography::CRYPT_ALGORITHM_IDENTIFIER;
 use windows::Win32::Security::Cryptography::CRYPT_DECODE_ALLOC_FLAG;
-#[cfg(any(test, feature = "test_helpers"))]
+#[cfg(any(test, feature = "export_private"))]
 use windows::Win32::Security::Cryptography::CRYPT_ENCODE_ALLOC_FLAG;
-#[cfg(any(test, feature = "test_helpers"))]
+#[cfg(any(test, feature = "export_private"))]
 use windows::Win32::Security::Cryptography::CRYPT_INTEGER_BLOB;
 use windows::Win32::Security::Cryptography::CRYPT_PRIVATE_KEY_INFO;
 use windows::Win32::Security::Cryptography::CryptDecodeObjectEx;
-#[cfg(any(test, feature = "test_helpers"))]
+#[cfg(any(test, feature = "export_private"))]
 use windows::Win32::Security::Cryptography::CryptEncodeObjectEx;
 use windows::Win32::Security::Cryptography::PKCS_7_ASN_ENCODING;
 use windows::Win32::Security::Cryptography::PKCS_PRIVATE_KEY_INFO;
 use windows::Win32::Security::Cryptography::X509_ASN_ENCODING;
 use windows::Win32::Security::Cryptography::szOID_RSA_RSA;
-#[cfg(any(test, feature = "test_helpers"))]
+#[cfg(any(test, feature = "export_private"))]
 use windows::core::PSTR;
 
 fn err(err: windows_result::Error, op: &'static str) -> RsaError {
@@ -245,7 +245,7 @@ impl RsaKeyPairInner {
         Ok(Self(handle))
     }
 
-    #[cfg(any(test, feature = "test_helpers"))]
+    #[cfg(any(test, feature = "export_private"))]
     pub fn to_pkcs8_der(&self) -> Result<Vec<u8>, RsaError> {
         // Step 1: export the key as a BCrypt full-private blob, which
         // contains every field needed by the PKCS#1 RSAPrivateKey ASN.1
@@ -324,6 +324,56 @@ impl RsaKeyPairInner {
         Ok(pkcs8_buf.as_bytes().to_vec())
     }
 
+    #[cfg(any(test, feature = "export_private"))]
+    pub fn to_private_components(&self) -> Result<super::RsaPrivateKeyComponents, RsaError> {
+        use windows::Win32::Security::Cryptography::BCRYPT_RSAFULLPRIVATE_MAGIC;
+        use zerocopy::FromBytes;
+
+        let blob = export_key(&self.0, BCRYPT_RSAFULLPRIVATE_BLOB)?;
+
+        // BCRYPT_RSAKEY_BLOB consists of six native-endian u32 fields.
+        let ([magic, _bits, cb_e, cb_n, cb_p, cb_q], mut rest) =
+            <[u32; 6]>::read_from_prefix(&blob)
+                .map_err(|_| invalid_err("exported RSA private key blob is too small"))?;
+        if magic != BCRYPT_RSAFULLPRIVATE_MAGIC.0 {
+            return Err(invalid_err(
+                "exported RSA private key blob has an invalid magic value",
+            ));
+        }
+        let mut take_component = |size: u32| -> Result<Vec<u8>, RsaError> {
+            if size == 0 {
+                return Err(invalid_err(
+                    "exported RSA private key has an empty component",
+                ));
+            }
+            let (bytes, remaining) = rest
+                .split_at_checked(size as usize)
+                .ok_or_else(|| invalid_err("exported RSA private key blob is truncated"))?;
+            rest = remaining;
+            Ok(bytes.to_vec())
+        };
+        let public_exponent = take_component(cb_e)?;
+        let modulus = take_component(cb_n)?;
+        let prime1 = take_component(cb_p)?;
+        let prime2 = take_component(cb_q)?;
+        let _exponent1 = take_component(cb_p)?;
+        let _exponent2 = take_component(cb_q)?;
+        let _coefficient = take_component(cb_p)?;
+        let private_exponent = take_component(cb_n)?;
+        if !rest.is_empty() {
+            return Err(invalid_err(
+                "exported RSA private key blob has trailing bytes",
+            ));
+        }
+        Ok(super::RsaPrivateKeyComponents {
+            modulus,
+            public_exponent,
+            private_exponent,
+            prime1,
+            prime2,
+        })
+    }
+
     pub fn oaep_decrypt(
         &self,
         input: &[u8],