Problem - Kevin Tafuro

Solution
The PEM format represents DER-encoded data in a printable format. Traditionally,
PEM encoding simply base64-encodes DER-encoded data and adds a simple header
and footer. OpenSSLprovides an API for such functionality that handles the DER
encoding and header writing for you.
OpenSSLhas introduced extensions for using encrypted DER representations, allowing
you to use PEM to store encrypted private keys and other cryptographic data in
ASCII format.
Discussion
Privacy Enhanced Mail (PEM) is the original encrypted email standard. Although the
standard is long dead, a small subset of its encoding mechanism has managed to survive.
In today’s day and age, PEM-encoded data is usually just DER-encoded data with a
header and footer. The header is a single line consisting of five dashes followed by
the word “BEGIN”, followed by anything. The data following the word “BEGIN” is
not really standardized. In some cases, there might not be anything following this
word. However, if you are using the OpenSSLPEM outputting routines, there is a
textual description of the type of data object encoded. For example, OpenSSLproduces
the following header line for an RSA private key:
-----BEGIN RSA PRIVATE KEY-----
This is a good convention, and one that is widely used.
The footer has the same format, except that “BEGIN” is replaced with “END”. You
should expect that anything could follow. Again, OpenSSLuses a textual description
of the content.
In between the two lines is a base64-encoded DER representation, which may contain
line breaks (\r\n, often called CRLFs for “carriage return and line feed”), which get
ignored. We cover base64 in Recipes 4.5 and 4.6, and DER encoding in Recipe 7.16.
If you want to encrypt a DER object, the original PEM format supported that as well,
but no one uses these extensions today. OpenSSLdoes implement something similar.
First, we’ll describe what OpenSSLdoes, because this will offer compatibility
with applications built with OpenSSLthat use this format—most notably Apache
with mod_ssl. Next, we’ll demonstrate how to use OpenSSL’s PEM API directly.
We’ll explain this format by walking through an example. Here’s a PEM-encoded,
encrypted RSA private key:
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,F2D4E6438DBD4EA8
356 | Chapter 7: Public Key Cryptography
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.