(Tcl) Generate RSA Key and Export to PKCS1 / PKCS8

Tcl example code showing how to generate an RSA public/private key and save to PKCS1 and PKCS8 format files. In a PKCS1 or PKCS8 formatted file, the key is stored in binary ASN.1 format (and ASN.1 is itself written according to DER -- Distinguished Encoding Rules). A PEM file simply contains the binary ASN.1 base64 encoded and delimited by BEGIN/END lines. PKCS1 format files are never encrypted. PKCS8 can be encrypted or unencrypted. Public keys are never encrypted (there is no need). Private keys *should* always be encrypted - unless perhaps the unencrypted private key is obtained and itself stored in some sort of secure place.

Chilkat Tcl Extension Downloads Chilkat Tcl Extension Downloads

load ./chilkat.dll

# This example assumes the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

set rsa [new_CkRsa]

# Generate a 2048-bit key.  Chilkat RSA supports
# key sizes ranging from 512 bits to 8192 bits.
set success [CkRsa_GenerateKey $rsa 2048]
if {$success != 1} then {
    puts [CkRsa_lastErrorText $rsa]
    delete_CkRsa $rsa
    exit
}

# Get the public and private key parts:
# pubKey is a CkPublicKey
set pubKey [CkRsa_ExportPublicKeyObj $rsa]
# privKey is a CkPrivateKey
set privKey [CkRsa_ExportPrivateKeyObj $rsa]

# Get the public key as a PKCS8 PEM string
set pubKeyPem [CkPublicKey_getPem $pubKey 0]
puts "$pubKeyPem"

# Get the public key in PKCS8 format, in a Base64 encoded string.
set pubKeyPkcs8Base64 [CkPublicKey_getEncoded $pubKey 0 "base64"]
puts "$pubKeyPkcs8Base64"

# Get the public key in PKCS1 format, in a Base64 encoded string.
set pubKeyPkcs1Base64 [CkPublicKey_getEncoded $pubKey 1 "base64"]
puts "$pubKeyPkcs1Base64"

# Get the private key in a PKCS8 PEM string.
set privKeyPem [CkPrivateKey_getPkcs8Pem $privKey]
puts "$privKeyPem"

# Get the private key in a PKCS8 encrypted PEM string.
set privKeyEncPem [CkPrivateKey_getPkcs8EncryptedPem $privKey "myPassword"]
puts "$privKeyEncPem"

# Get the private key in PKCS1 Base64 format
set privKeyPkcs1Base64 [CkPrivateKey_getPkcs1ENC $privKey "base64"]
puts "$privKeyPkcs1Base64"

# Get the private key in PKCS8 Base64 format
set privKeyPkcs8Base64 [CkPrivateKey_getPkcs8ENC $privKey "base64"]
puts "$privKeyPkcs8Base64"

# Save to PKCS1 / PKCS8 / PEM files...

# Save the public key to PKCS8 binary DER
set success [CkPublicKey_SaveDerFile $pubKey 0 "pubKey_pkcs8.der"]

# Save the public key to PKCS1 binary DER
set success [CkPublicKey_SaveDerFile $pubKey "pubKey_pkcs1.der"]

# Save the private key to unencrypted binary PKCS1 DER.
# Note: PKCS1 is never found in an encrypted format. 
set success [CkPrivateKey_SavePkcs1File $privKey "privKey_pkcs1.der"]

# Save the private key to unencrypted binary PKCS8
set success [CkPrivateKey_SavePkcs8File $privKey "privKey_pkcs8.der"]

# Save the private key to encrypted binary PKCS8
set success [CkPrivateKey_SavePkcs8EncryptedFile $privKey "myPassword" "privKey_enc_pkcs8.der"]

# Save the private key to unencrypted PKCS8 PEM
set success [CkPrivateKey_SavePkcs8PemFile $privKey "privKey.pem"]

# Save the private key to encrypted PKCS8 PEM
set success [CkPrivateKey_SavePkcs8EncryptedPemFile $privKey "myPassword" "privKey_enc.pem"]

delete_CkPublicKey $pubKey

delete_CkPrivateKey $privKey


delete_CkRsa $rsa