RSA public key/private key pair generation generator (PEM compatible) | ZeroTools

This system is an asymmetric cryptographic key pair generation mechanism built around the crypto.subtle.generateKey method of the Web Crypto API, which is an encryption standard built into the client-side JavaScript execution environment.

Fundamentally different from the traditional server-side key generation process, it generates random numbers by collecting entropy directly within the browser's sandbox environment, without any intervening network communication.

It natively supports multiple padding schemes and signature algorithms such as RSA-OAEP, RSA-PSS, and even RSASSA-PKCS1-v1_5, and is executed by passing the appropriate algorithm identifier as a parameter depending on the required cryptographic strength and usage.

Defined as an asynchronous process, this API processes advanced mathematical operations behind the scenes without interfering with UI rendering on the main thread, and returns the generated CryptoKey object as a promise.

This object can only be passed to a subsequent export process by setting the extractable flag to true, which constitutes a prerequisite for safely retrieving raw data from the browser's memory space.

Relying on crypto.getRandomValues, a secure pseudo-random number generator provided by the browser, ensures unpredictable seed values ​​and permanently guarantees cryptographically secure key generation.

The security of the RSA cryptosystem relies entirely on the computational difficulty of factoring large composite numbers, and our organization offers key length options of 2048 bits, 3072 bits, and even 4096 bits for applications that require long-term security.

In the generation process, two huge prime numbers p and q, corresponding to half the specified bit length, are independently generated.

These prime numbers can be verified to be prime with extremely high accuracy using probabilistic primality testing algorithms such as Fermat's Little Theorem and Miller-Rabin primality testing.

65537 is generally adopted as a fixed value as the value of the public index, that is, the public component e.

65537 is a Fermat prime number, and in binary notation, only the most significant and least significant bits are 1, so it has the property of dramatically speeding up arithmetic processing for encryption and signature verification while minimizing the number of multiplications.

Furthermore, it is easy to satisfy the condition that the values ​​of L derived by e and Euler's tortient function are coprime, and the extended Euclidean algorithm for calculating the modular reciprocal works efficiently in calculating the secret exponent d.

As the key length increases, the prime number search space expands exponentially and consumes more computational resources, but this follows the principle of complexity theory, which dramatically improves resistance to decryption.

The CryptoKey object generated by the Web Crypto API is not compatible with external systems as it is, so it is essential to convert it to a standard data structure.

This mechanism calls the crypto.subtle.exportKey method, specifies PKCS8 format for the private key and SPKI format for the public key, and extracts binary data as ArrayBuffer.

The extracted binary data has a hierarchical data structure that is strictly serialized according to the Distinguished Encoding Rules of Abstract Syntax Notation One.

Since this DER format byte array is not human readable as it is, a process is immediately performed that splits the byte sequence into 8-bit units and applies a Base64 encoding algorithm to convert it into a printable ASCII string.

The generated Base64 string is strictly formatted by inserting a newline character every 64 characters in order to conform to the Privacy-Enhanced Mail format specified in RFC7468.

The end result is a header and footer around the private key data block with BEGIN RSA PRIVATE KEY and END RSA PRIVATE KEY, and a BEGIN PUBLIC KEY and END PUBLIC KEY around the public key, resulting in PEM text that is fully compatible with OpenSSL and other standard cryptographic toolkits.

The most vulnerable point in cryptographic key management is the transit path from the point of key generation to the time it is moved to a permanent storage area, but this system solves this at the architectural level.

All key generation algorithms and format conversion processes are performed completely within the JavaScript engine of the browser running on the user's local machine.

The raw private key data generated and any intermediate variables in the extraction process are never sent to the server side and are never included in the HTTP request payload or URL parameters.

This completely eliminates the risk of key information leakage due to man-in-the-middle attacks or server-side logging, both mathematically and physically.

Additionally, although it relies on JavaScript's garbage collection mechanism, the scope of references to ArrayBuffer and CryptoKey objects expanded in memory is designed to be strictly limited so that they are discarded immediately after processing is completed.

As a result, even if the memory space is later scanned by attack methods such as cross-site scripting, the idea of ​​memory protection that minimizes the possibility of extracting the remains of the private key runs through the underlying implementation.

Advanced DOM manipulation and collaboration with the latest browser APIs work seamlessly as an interface layer for users to safely and reliably store generated PEM format key data in their local environment.

The generated string data is transferred to the system clipboard with one click via the writeText method of the browser's Clipboard API.

This process adheres to a strict security model that only allows execution within the context of an explicit user gesture, or click event.

Furthermore, the function to save as a file dynamically generates a Blob object, specifies application/x-pem-file or general text/plain as the MIME type of text data, and constructs a virtual file pointer.

Generate a URL for this Blob using the URL.createObjectURL function, dynamically assign it to the href attribute of the hidden anchor element, and forcibly fire a click event from the program.

This triggers a direct download dialog to the user's file system and safely completes the process by saving the file to local disk using a standard naming convention based on its purpose.

The generated RSA key pairs are ready for immediate implementation as the basis for a wide range of system management and secure application development.

In the context of a system infrastructure, the generated PEM-formatted private key can be directly applied to the public key authentication process for secure shell connections to remote servers by placing it in the SSH client's credentials directory and setting appropriate file permissions.

By adding the public key to the server's permission list file, a robust access control model that eliminates password authentication can be instantly realized.

Additionally, in the implementation of JSON Web Token, which is a stateless authentication and authorization mechanism for web applications, a private key generated by specifying the RSASSA-PKCS1-v1_5 algorithm is used directly to generate the cryptographic signature of the payload.

The authentication server uses a private key to add a signature to the token, and the resource server uses a public key to verify the validity of the signature, mathematically proving that the data has not been tampered with and the authenticity of the issuer.

Furthermore, key pairs based on the RSA-OAEP algorithm can be incorporated into a wide range of encrypted communication tests as an elemental technology in the construction of next-generation zero trust networks, such as the secure delivery process of common keys in hybrid cryptography between clients and servers.