Add Private Keys in System Store MY

[sunit]

I have a certificate and assosicated private keys with that certificate.I want to add both the things in the certificate store MY.
i added my certicate in MY through mmc

start->Run->mmc->console->Add/Remave Snapp-in->Add->Certificates->Computer Account->Local computer

.In the tree i chose personal .Then right clicked and chose import to add my certificate.The certicate is present in a key whose path in registry is HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\MY\certficates. The name of the Key is the value of the field Thumbprint of the certificate.Inside the key certificate is present in BLOB.

But i dont know how to add my private keys with this certificate .Pls help me .Thanx in advance

[Rhett Gong [MSFT]]

To achieve this, we need to open the default CSP on the system, read in the pvk blob and import the key with CryptImportkey.
There is an article of MSDN, Example C Program: Decrypting a File, illustrating how to do this, I suggest you reference it. you
can find the article at:
http://msdn.microsoft.com/library/default.asp?url=/library/en-
us/seccrypto/security/example_c_program_decrypting_a_file.asp

Please let me know if my answer helps you resolve the problem. If there is anything more I can assist you, please feel free to
let me know.

Thanks,
Rhett Gong [MSFT]
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
http://support.microsoft.com/default.aspx?scid=/servicedesks/msdn/nospam.asp&SD=msdn

This posting is provided "AS IS" with no warranties and confers no rights.

[sunit]

[Rhett Gong]

To achieve this, we need to open the default CSP on the system, read in the pvk blob and import the key with >CryptImportkey

.In refrence to the link what i understood

if(!CryptAcquireContext(&hCryptProv,NULL, MS_ENHANCED_PROV,
PROV_RSA_FULL, 0))

i will get the handle to key container in a Default CSP

if(!CryptImportKey(hCryptProv,pbKeyBlob,dwKeyBlobLen,0,0,&hKey))

import the Private keys(from a file) in the key container.

But I am not understanding how will my private keys get stored in System Store MY (as MY contains certificate with associated Private Keys) .PLS help me. I m newbie in Crytography.

Thanx in Advance.

[lelteto]

You should NOT import the key into the DEFAULT container. You may already
have key there and the import would overwrite that - and you may lost a lot
of things.
Instead, you should create your OWN container (generate a name either with
GUID or come up with a name which is unique). CREATE that container (set the
pszContainer parameter to the unique name you generated and use
CRYPT_NEWKEYSET flag - but only the first time, ie. when you create the
container).

Next you would need to import the key blob (assuming it is in the proper
PRIVATEKEYBLOB format - if not, you would need to put it into this format;
note that you may need to change the endianness: CAPI require the key values
in little endian order; usually other formats store the key values in big
endian order). Use CryptImportKey.

Next you would need to tell the cert store where your private keys is: you
would need to use CertSetCertificateContextProperty with
CERT_KEY_PROV_INFO_PROP_ID.

The alternative (easier) way is what Mitch suggested - if your data is in
alreadypacked format.

Laszlo Elteto
SafeNet, Inc.

Post by sunit
[Rhett Gong]

To achieve this, we need to open the default CSP on the system, read in the pvk blob and import the key with >CryptImportkey

..In refrence to the link what i understood
if(!CryptAcquireContext(&hCryptProv,NULL, MS_ENHANCED_PROV,
PROV_RSA_FULL, 0))
i will get the handle to key container in a Default CSP
if(!CryptImportKey(hCryptProv,pbKeyBlob,dwKeyBlobLen,0,0,&hKey))
import the Private keys(from a file) in the key container.
But I am not understanding how will my private keys get stored in System Store MY (as MY contains certificate with associated Private Keys) .PLS help me. I m newbie in Crytography.
Thanx in Advance

[sunit]

Post by lelteto
CREATE that container (set the
pszContainer parameter to the unique name you generated and use
CRYPT_NEWKEYSET flag - but only the first time, ie. when you create the
container).

i will be ceesing the container from a service .My service has log as on as System Account
.Do i have to include CRYPT_MACHINE_KEYSET

[sunit]

"sunit"

i will be ceesing the container from a service .My >service has log as on as System Account
.Do i have to include CRYPT_MACHINE_KEYSET

i got the answer I have to use it .

[sunit]

[lelteto wrote]

Post by lelteto
Next you would need to import the key blob (assuming it is in the proper
PRIVATEKEYBLOB format - if not, you would need to put it into this format;
note that you may need to change the endianness: CAPI require the key values
in little endian order; usually other formats store the key values in big
endian order). Use CryptImportKey.

I got my certificate and private keys using openssl.I installed the openssl and used a command on the command prompt to generate certificate request and private keys

openssl.exe req -newkey rsa:1024 -keyout server.key -nodes -days 365 -out server.crt
server.key :RSA private keys
server.crt:certificate Request

I dont know whether it is my private keys r in correct format.My server.key(private keys) contents look like

-----BEGIN RSA PRIVATE KEY-----
MIICXAIBAAKBgQDUjf19133k8AcYmu9V54eQUKDTRKBUexhJ7ncRDB+l2eh73mu4
Z5Dj1k1U+Cjj2rubg4zY3fO6hnYC269hbyG8XIu41cyW6YL8ytetA+Zl+xRkX2WC
YmqUnWTQ9rz2CeDQRWed+ekFsnVgH2J57ww5zkVFzCpjFihl/d1m3ZovlwIDAQAB
AoGAMTanCKoKRiWlHvdQju1KoAlrEz+Cd80AdK2398R812O6xmNbQZkJHReTVCcZ
IJiWc41j4RqSwg8757GBy+d1QcGOfPjtewhPoT4lVocEbRRkGBHX0jruKBkZpfgp
az6MO+4at4YAy8/H/DZVTThtxmN/9x+WlaxYwf8dIRvMjpECQQDpw9yaH0AmDMdE
fnTvIGXyXOBfzJLTNCOi3YH4bNX5ZAWDqYSXkKeJNnzMEkzLVM9t1VLlHP6izYkN
r9tyJzUtAkEA6MWoe5xEJDjw9wlodgkLMFgEqE8SzptygnH/1oqkzkLIFeJPfnsG
HmJZ0lwYQf/7CmOwpBRbDfymWI5ymo76UwJAJ7e2gJ00qgJbzQBrX8GycJZlLQG2
JJpkP6TBE3Nye5gJ88/WjmXugTq3w3iMgbOcNr4bAoCFpyWi1qd9cozE1QJBAJBi
AlbiIBZDx5vEFyqYA3uyLPllSuoi281z/thJ2V4jaE7CuMJgdvQj10k3XMibilDw
cyHjinNLkrb9bLLYGwcCQHzzCW2obyRQEIXHo8HLnpeZvNnH+9eKtks0Z1uRfd4m
ECeTLHBzr67MY8s4W2rcINQlLbp4s9FOcaDAFWDBeoY=
-----END RSA PRIVATE KEY-----

Also in CryptImportKey , PRIVATEKEYBLOB, it wants the handle of the session keys which encryted the private key.I m not understanding how to get this handle.

Pls Help me .Thanx in advance

[Michel Gallant]

The --- BEGIN RSA PRIVATE KEY ---- delimited blob (in b64 form) is just a standard
PKCS#8 unencrypted private key format.
Here's a cheat-cheat for openssl/PEM for windows users:
http://www.jensign.com/JavaScience/PEM/pemformats.txt

You can convert that pkcs#8 private key blob into a CryptoAPI PRIVATEKEYBLOB
using one of these converters I wrote:
http://www.jensign.com/JavaScience/PvkConvert
If you don't like Java ;-) you can just read the Java source code and see how the
conversion works.

Cheers,
- Mitch Gallant
MVP Security

"sunit" <***@newsgroup.nospam> wrote in message news:***@TK2MSFTNGP14.phx.gbl...

[lelteto wrote]

Post by lelteto
Next you would need to import the key blob (assuming it is in the proper
PRIVATEKEYBLOB format - if not, you would need to put it into this format;
note that you may need to change the endianness: CAPI require the key values
in little endian order; usually other formats store the key values in big
endian order). Use CryptImportKey.

I got my certificate and private keys using openssl.I installed the openssl and used a command on the command prompt to generate
certificate request and private keys

openssl.exe req -newkey rsa:1024 -keyout server.key -nodes -days 365 -out server.crt
server.key :RSA private keys
server.crt:certificate Request

I dont know whether it is my private keys r in correct format.My server.key(private keys) contents look like

-----BEGIN RSA PRIVATE KEY-----
MIICXAIBAAKBgQDUjf19133k8AcYmu9V54eQUKDTRKBUexhJ7ncRDB+l2eh73mu4
Z5Dj1k1U+Cjj2rubg4zY3fO6hnYC269hbyG8XIu41cyW6YL8ytetA+Zl+xRkX2WC
YmqUnWTQ9rz2CeDQRWed+ekFsnVgH2J57ww5zkVFzCpjFihl/d1m3ZovlwIDAQAB
AoGAMTanCKoKRiWlHvdQju1KoAlrEz+Cd80AdK2398R812O6xmNbQZkJHReTVCcZ
IJiWc41j4RqSwg8757GBy+d1QcGOfPjtewhPoT4lVocEbRRkGBHX0jruKBkZpfgp
az6MO+4at4YAy8/H/DZVTThtxmN/9x+WlaxYwf8dIRvMjpECQQDpw9yaH0AmDMdE
fnTvIGXyXOBfzJLTNCOi3YH4bNX5ZAWDqYSXkKeJNnzMEkzLVM9t1VLlHP6izYkN
r9tyJzUtAkEA6MWoe5xEJDjw9wlodgkLMFgEqE8SzptygnH/1oqkzkLIFeJPfnsG
HmJZ0lwYQf/7CmOwpBRbDfymWI5ymo76UwJAJ7e2gJ00qgJbzQBrX8GycJZlLQG2
JJpkP6TBE3Nye5gJ88/WjmXugTq3w3iMgbOcNr4bAoCFpyWi1qd9cozE1QJBAJBi
AlbiIBZDx5vEFyqYA3uyLPllSuoi281z/thJ2V4jaE7CuMJgdvQj10k3XMibilDw
cyHjinNLkrb9bLLYGwcCQHzzCW2obyRQEIXHo8HLnpeZvNnH+9eKtks0Z1uRfd4m
ECeTLHBzr67MY8s4W2rcINQlLbp4s9FOcaDAFWDBeoY=
-----END RSA PRIVATE KEY-----

Also in CryptImportKey , PRIVATEKEYBLOB, it wants the handle of the session keys which encryted the private key.I m not
understanding how to get this handle.

Pls Help me .Thanx in advance

[sunit]

["Michel Gallant"] wrote
You can convert that pkcs#8 private key blob into a CryptoAPI PRIVATEKEYBLOB
using one of these converters I wrote:
http://www.jensign.com/JavaScience/PvkConvert
If you don't like Java ;-) you can just read the Java source code and see
how the
conversion works.



Thanx for the Help .But I dont have any knowledge in JAVA.Is there any other
way to get ie
using Crypto API.

Pls Help me.Thanx in advance

[sunit]

["Michel Gallant"]
Pardon me for my ignorance as I have never worked in Java
After going through ur code http://www.jensign.com/JavaScience/PvkConvert
private static byte[ ] privatekeyinfoToPrivatekeyblob(byte[ ] encodedPrivkey, int keyspec)
this class returned value will give me the PRIVATEKEYBLOB.

but u have mentioned in http://www.jensign.com/JavaScience/PEM/pemformats.txt that PvkConvert.java
is a simply utility Java class which reads a PKCS#8 encoded PrivateKeyInfo file whereas my private
keys is in PKCS#8 unencrypted private key format. Will it work in my case


secondly I stored the server.key (the File name in which my Private key is present) and PvkConvert.Java
in the location C:\jdk1.2.4\bin

Now i am executing the following command,

C:\jdk1.2.4\bin\javac PvkConvert.java
C:\jdk1.2.4\bin\java PvkConvert server.key

I output shown on my screen is :-

keyspec 1
java.security.spec.InvalidKeySpecException: Unknown key spec.

KeySize: 0 bits

java.lang.NullPointerException

Pls tell what is wrong in above process.

Thanking you.

[Michel Gallant]

Whoops, I should correct myself now (since you didn't ;-)
The format you originally refer to in your post:
--- BEGIN RSA PRIVATE KEY
is NOT pkcs#8 format (as you would see from that pemformats.txt link) but is
in OpenSSL's "Traditional SSLeay RSAPrivateKey format".

You can use Openssl to convert that format *to PKCS#8 format which is THEN suitable for
the PvkConvert utility I refer to below.
See this recent thread for a similar issue:
http://groups.google.com/group/microsoft.public.dotnet.security/browse_thread/thread/83c34588d92dcbc8/4179820bd894a69e
Sorry for "mal-information" :)

- Mitch
"sunit" <***@newsgroup.nospam> wrote in message news:Od2IdO%***@TK2MSFTNGP12.phx.gbl...
["Michel Gallant"]
Pardon me for my ignorance as I have never worked in Java
After going through ur code http://www.jensign.com/JavaScience/PvkConvert
private static byte[ ] privatekeyinfoToPrivatekeyblob(byte[ ] encodedPrivkey, int keyspec)
this class returned value will give me the PRIVATEKEYBLOB.

but u have mentioned in http://www.jensign.com/JavaScience/PEM/pemformats.txt that PvkConvert.java
is a simply utility Java class which reads a PKCS#8 encoded PrivateKeyInfo file whereas my private
keys is in PKCS#8 unencrypted private key format. Will it work in my case


secondly I stored the server.key (the File name in which my Private key is present) and PvkConvert.Java
in the location C:\jdk1.2.4\bin

Now i am executing the following command,

C:\jdk1.2.4\bin\javac PvkConvert.java
C:\jdk1.2.4\bin\java PvkConvert server.key

I output shown on my screen is :-

keyspec 1
java.security.spec.InvalidKeySpecException: Unknown key spec.

KeySize: 0 bits

java.lang.NullPointerException

Pls tell what is wrong in above process.

Thanking you.

[sunit]

["Michel Gallant"]
thanx a lot for taking pain to solve my problem
Sorry to annoy u once again.

I converted my private keys from Traditional SSLeay RSAPrivateKey format" to PKCS#8

openssl>pkcs8 -in server.key -topk8 -out private.key
i followed the same procedure to execute the program.But it gave the same error

C:\jdk1.2.4\bin\javac PvkConvert.java
C:\jdk1.2.4\bin\java PvkConvert private.key

output shown on my screen is :-
keyspec 1
java.security.spec.InvalidKeySpecException: Unknown key spec.
KeySize: 0 bits

java.lang.NullPointerException

and my private keys are store in private.key(pkcs#8).The content of this file is:
----BEGIN ENCRYPTED PRIVATE KEY-----
MIICoTAbBgkqhkiG9w0BBQMwDgQI2ep5W6w4Kt8CAggABIICgJgVeg+JFOGfRorc
LpNhYLZxrlDzkwHHRH2ABWIuPq44vcBYnz+NNt30zOuaE1+cMnnhFPO7MX4clLrI
cZLUGHbjJRd4JG0ijjOziXtvO5O9f7Owr0vOsIIALcAEH1dgbnjYwZEbIiBck3oZ
yCAgeS1gP92qmK8lSbW9UNLvlOpn06NNnmanuyB99JB0fQUZszjtOhDA94Zop1WR
FNHhWXZkiMJPKrq+1NtoJ2lDCkjR1IhsVKzGIjr9HbsqE95jly4XDVAaSM8He7lz
mj4vYVYNO1m9w18D6h+13GSYLgY6loDmHawIfPhwxdGu1ZACB0uvxd7s0nK/f8b/
O/F42qlcaxPk2AvxYfiYEs3iE8FdUwrex2L5s/flpBrDMjLWidZmuzSPWQozGsxX
H8Lp4KDm5QAVd7KY4xtz8XrKE0vnsZJoUxHPVZ1jYb2mztE4m/PgVoLBzXNjbhhI
ml5e0esIC7kaF/xOIU23LajADFkw+g/yCF+gJhB3N3K3ZLYd8zjZDGQmZjXD78t+
Ng6/bGFnU9kx0qk8DTkS16O/QjFpSKhRoi0K435233hOJU2ftw1f8cvOYwmWiFxu
5xumzB61IDqVe60agPlttmOOhOQBwFq0oBY2BR0LZ1kQILYDcsb0+apH/Qnt++B7
gZt/e6EJ4s2RE1mIj6BKUTv1ocbeSgFzF8MyVZg/mSEps2nQRSjGAD+sc21IW5eB
BW2O8vFnLyCsevUYTEodoo1nyFJZVtp5BvPFnrDvgnSvzn0lvU6qUsyTk83BB/Cl
Tycp6xmqLIjHGEvc0pUQ6eAZ4JsA72QRUpuxh1G81d305d4WkUv2F2A1wudQBnmX
IWGrgpg=
-----END ENCRYPTED PRIVATE KEY-----

Pls Help me

[Michel Gallant]

Always the details .... :-)
The utility PvkConvert handles PrivateKeyInfo format which is an UNENCRYPTED
private key. It also expects a binary format (not the B64 format).

So to get that unencrypted form from openssl you can use the nocrypt and outform switches; e.g.:

openssl pkcs8 -in server.key -topk8 -nocrypt -outform DER -out enc8key.pem

Also, you should update your JVM to 1.4.2 (not sure if 1.2.4 Sun JVM supports PKCS#8 )

- Mitch

"sunit" <***@newsgroup.nospam> wrote in message news:***@TK2MSFTNGP12.phx.gbl...

["Michel Gallant"]
thanx a lot for taking pain to solve my problem
Sorry to annoy u once again.

I converted my private keys from Traditional SSLeay RSAPrivateKey format" to PKCS#8

openssl>pkcs8 -in server.key -topk8 -out private.key
i followed the same procedure to execute the program.But it gave the same error

C:\jdk1.2.4\bin\javac PvkConvert.java
C:\jdk1.2.4\bin\java PvkConvert private.key

output shown on my screen is :-
keyspec 1
java.security.spec.InvalidKeySpecException: Unknown key spec.
KeySize: 0 bits

java.lang.NullPointerException

and my private keys are store in private.key(pkcs#8).The content of this file is:
----BEGIN ENCRYPTED PRIVATE KEY-----
MIICoTAbBgkqhkiG9w0BBQMwDgQI2ep5W6w4Kt8CAggABIICgJgVeg+JFOGfRorc
LpNhYLZxrlDzkwHHRH2ABWIuPq44vcBYnz+NNt30zOuaE1+cMnnhFPO7MX4clLrI
cZLUGHbjJRd4JG0ijjOziXtvO5O9f7Owr0vOsIIALcAEH1dgbnjYwZEbIiBck3oZ
yCAgeS1gP92qmK8lSbW9UNLvlOpn06NNnmanuyB99JB0fQUZszjtOhDA94Zop1WR
FNHhWXZkiMJPKrq+1NtoJ2lDCkjR1IhsVKzGIjr9HbsqE95jly4XDVAaSM8He7lz
mj4vYVYNO1m9w18D6h+13GSYLgY6loDmHawIfPhwxdGu1ZACB0uvxd7s0nK/f8b/
O/F42qlcaxPk2AvxYfiYEs3iE8FdUwrex2L5s/flpBrDMjLWidZmuzSPWQozGsxX
H8Lp4KDm5QAVd7KY4xtz8XrKE0vnsZJoUxHPVZ1jYb2mztE4m/PgVoLBzXNjbhhI
ml5e0esIC7kaF/xOIU23LajADFkw+g/yCF+gJhB3N3K3ZLYd8zjZDGQmZjXD78t+
Ng6/bGFnU9kx0qk8DTkS16O/QjFpSKhRoi0K435233hOJU2ftw1f8cvOYwmWiFxu
5xumzB61IDqVe60agPlttmOOhOQBwFq0oBY2BR0LZ1kQILYDcsb0+apH/Qnt++B7
gZt/e6EJ4s2RE1mIj6BKUTv1ocbeSgFzF8MyVZg/mSEps2nQRSjGAD+sc21IW5eB
BW2O8vFnLyCsevUYTEodoo1nyFJZVtp5BvPFnrDvgnSvzn0lvU6qUsyTk83BB/Cl
Tycp6xmqLIjHGEvc0pUQ6eAZ4JsA72QRUpuxh1G81d305d4WkUv2F2A1wudQBnmX
IWGrgpg=
-----END ENCRYPTED PRIVATE KEY-----

Pls Help me

[Michel Gallant]

Specifically, here is a worked example which I just ran (passwords and private key
printout details excluded) :

(1) ---- (Generate traditional format encrypted OpenSSL private key -----

openssl genrsa -des3 -out privkeytest.pem 1024

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,6D069734D90C3C15

O7UmZH+0IwlK30KhEQfkNjql55ZYpBy636feVI/LQBFYbmYXZnahjLyTFo9+Xpbz
e1bvVdsPEH+fYHpwYI5w2W0WaVSCilYb/uW3D+M1y/TSBg9/h+XCTyiHhy54bQZj
o2nUiUsiJEnqxhWzD/+cAAYZAtJGBezcim0HGczJls75/3G8kkmRrPCKBPe2s3iF
L3Wy3lrAcvv1VjRxz89zNeiKSuFxmKQEk9euT0q3hgAwbMG8JvfbbTpGVZRCieaG
hYbIXsse0IOm9Xowf/wEnLQz4lBc6DXBno0ZMWEzgWoetdp+TsfDM/bhcGVjozr9
Rvqh/JX5dYUKtcycMX2O4Jehlk+swSAx2TlV5tf33Y1rP8BRXrzeFHO/EdhyUFCN
Ly7qfonUJMLHxKC0nBXTiyKvYJGoD2SI2oXfSmWRhYCUKLTnKLtTDlrIgGcuY3ry
/22UZfvFoS6cSO5QVrLUu1SxFhtAIQ/H3Ot1rvl/UyK0NpZ+ByJHlgV5py+rsbtW
n0WTAvAwi6DB3hh4RQU3HczzNr16I6HDXTk6kkSNNyqjiuX+5SkjTuywlDyOhgVH
oKTC8fXzaC/+gttXP3xoMFMdcUyPThVHYfgrXcuIW2Cx2BXNwd9ZpIFyaL/kHfE8
yNhg5GIBz2WITghd7PS4GBkjLFHk4OjPKQtHRRydOcZWI4RQ9vHRCGx6zQoXMVHp
H66H//WwhYFVRsYsFNzOf78F+JJfM76VwXjB3toRCL92BTu36tO6exDGB5LzGItV
rKZY4Soeu44YkchnTtEsBJOeGbQUHQW2C2XvvFKZglE=
-----END RSA PRIVATE KEY-----



(2) ----- Convert to PKCS#8 PrivateKeyInfo (unencrypted) binary form ----

openssl pkcs8 -in privkeytest.pem -topk8 -nocrypt -outform DER -out enc8keytest


(3) ----- Convert from PKCS#8 PrivateKeyInfo to CryptoAPI PRIVATEKEYBLOB ---

java PvkConvert enc8keytest

keyspec 1

KeySize: 1024 bits
Wrote PRIVATEKEYBLOB file '_privatekeyblob' (596 bytes)
Dumping RSA private key components ...

Modulus:
11275472959122150446325246625122651152048954058724157395626130328372671681274708
22335684540068686156463853749343121504455881728476083234244339871729696676671619
35832690407864886928030332233274731098350551648661164391498454916363837880422487
840010992638155541619879590295589352548352571722299723431804279340767
00 A0 91 6C B1 B4 D5 1F 3B 0E ED 59 C4 E5 B3 2B
99 E9 13 E9 4A C5 0A 9A 3F A6 4A B6 F3 1B 3F F6
68 20 50 E1 C8 49 FF E8 08 85 3B D1 9A 7F 3E 1F
25 80 8D 8F 9F 97 00 53 E7 A4 9B 81 7B 83 9D 0B
F8 E3 31 1D 86 C2 E0 50 E5 4F FB FE A6 2A 6B 19
EC 0C D6 E2 A6 37 F6 2B 26 23 2D AF 78 84 02 5C
AD 30 C1 D8 72 C6 54 CF 6F F9 7A 2B 85 5C C5 8A
56 58 E2 1D 5D 82 D4 98 70 D8 6E FF 8D 1D 56 3E
DF

Public Exponent:
65537
01 00 01

Private Exponent:
80993052020024467768010026416264694086372058725376265858445719416279642349770078
...
...

Wrote PUBLICKEYBLOB file '_publickeyblob' (148 bytes)


"Michel Gallant" <***@istar.ca> wrote in message news:%23Iy5%***@TK2MSFTNGP12.phx.gbl...
Always the details .... :-)
The utility PvkConvert handles PrivateKeyInfo format which is an UNENCRYPTED
private key. It also expects a binary format (not the B64 format).

So to get that unencrypted form from openssl you can use the nocrypt and outform switches; e.g.:

openssl pkcs8 -in server.key -topk8 -nocrypt -outform DER -out enc8key.pem

Also, you should update your JVM to 1.4.2 (not sure if 1.2.4 Sun JVM supports PKCS#8 )

- Mitch

"sunit" <***@newsgroup.nospam> wrote in message news:***@TK2MSFTNGP12.phx.gbl...

["Michel Gallant"]
thanx a lot for taking pain to solve my problem
Sorry to annoy u once again.

I converted my private keys from Traditional SSLeay RSAPrivateKey format" to PKCS#8

openssl>pkcs8 -in server.key -topk8 -out private.key
i followed the same procedure to execute the program.But it gave the same error

C:\jdk1.2.4\bin\javac PvkConvert.java
C:\jdk1.2.4\bin\java PvkConvert private.key

output shown on my screen is :-
keyspec 1
java.security.spec.InvalidKeySpecException: Unknown key spec.
KeySize: 0 bits

java.lang.NullPointerException

and my private keys are store in private.key(pkcs#8).The content of this file is:
----BEGIN ENCRYPTED PRIVATE KEY-----
MIICoTAbBgkqhkiG9w0BBQMwDgQI2ep5W6w4Kt8CAggABIICgJgVeg+JFOGfRorc
LpNhYLZxrlDzkwHHRH2ABWIuPq44vcBYnz+NNt30zOuaE1+cMnnhFPO7MX4clLrI
cZLUGHbjJRd4JG0ijjOziXtvO5O9f7Owr0vOsIIALcAEH1dgbnjYwZEbIiBck3oZ
yCAgeS1gP92qmK8lSbW9UNLvlOpn06NNnmanuyB99JB0fQUZszjtOhDA94Zop1WR
FNHhWXZkiMJPKrq+1NtoJ2lDCkjR1IhsVKzGIjr9HbsqE95jly4XDVAaSM8He7lz
mj4vYVYNO1m9w18D6h+13GSYLgY6loDmHawIfPhwxdGu1ZACB0uvxd7s0nK/f8b/
O/F42qlcaxPk2AvxYfiYEs3iE8FdUwrex2L5s/flpBrDMjLWidZmuzSPWQozGsxX
H8Lp4KDm5QAVd7KY4xtz8XrKE0vnsZJoUxHPVZ1jYb2mztE4m/PgVoLBzXNjbhhI
ml5e0esIC7kaF/xOIU23LajADFkw+g/yCF+gJhB3N3K3ZLYd8zjZDGQmZjXD78t+
Ng6/bGFnU9kx0qk8DTkS16O/QjFpSKhRoi0K435233hOJU2ftw1f8cvOYwmWiFxu
5xumzB61IDqVe60agPlttmOOhOQBwFq0oBY2BR0LZ1kQILYDcsb0+apH/Qnt++B7
gZt/e6EJ4s2RE1mIj6BKUTv1ocbeSgFzF8MyVZg/mSEps2nQRSjGAD+sc21IW5eB
BW2O8vFnLyCsevUYTEodoo1nyFJZVtp5BvPFnrDvgnSvzn0lvU6qUsyTk83BB/Cl
Tycp6xmqLIjHGEvc0pUQ6eAZ4JsA72QRUpuxh1G81d305d4WkUv2F2A1wudQBnmX
IWGrgpg=
-----END ENCRYPTED PRIVATE KEY-----

Pls Help me

[sunit]

"Michel Gallant"

Thank u very much.I got the PRIVATEKEYBLOB.I beg ur pardon as I have annoyed u a lot .I am a newbie in Crytography(2 months back I started).What ever I learnt in Cryptograhy,I learnt from this news group and person like u who helped me

Thank you sir for considering my problem.

i am also thankfull to Rhett Gong and lelteto

[Michel Gallant]

What form is your certificate private key in? A file blob? (pvk file?)
If so, the simplest way is to use the pvk and the cer files and convert to a pfx file (pkcs#12 format),
and then import that into your MY store using Cert import dialogs.
- Mitch Gallant

"sunit" <***@newsgroup.nospam> wrote in message news:***@TK2MSFTNGP10.phx.gbl...
I have a certificate and assosicated private keys with that certificate.I want to add both the things in the certificate store
MY.
i added my certicate in MY through mmc

start->Run->mmc->console->Add/Remave Snapp-in->Add->Certificates->Computer Account->Local computer

.In the tree i chose personal .Then right clicked and chose import to add my certificate.The certicate is present in a key whose
path in registry is HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\MY\certficates. The name of the Key is the value of
the field Thumbprint of the certificate.Inside the key certificate is present in BLOB.

But i dont know how to add my private keys with this certificate .Pls help me .Thanx in advance