Why are pem2der and der2pem not inverses? - php

Question

In the supplementary comments for PHP's OpenSSL functions there's this snippet
function pem2der($pem_data) {
$begin = "CERTIFICATE-----";
$end = "-----END";
$pem_data = substr($pem_data, strpos($pem_data, $begin)+strlen($begin));
$pem_data = substr($pem_data, 0, strpos($pem_data, $end));
$der = base64_decode($pem_data);
return $der;
}
function der2pem($der_data) {
$pem = chunk_split(base64_encode($der_data), 64, "\n");
$pem = "-----BEGIN CERTIFICATE-----\n".$pem."-----END CERTIFICATE-----\n";
return $pem;
}
These functions aren't inverses. My test code:
$priv_key = ...;
print $priv; // dev data, of course
print der2pem (pem2der ($priv));
Prints
-----BEGIN PRIVATE KEY-----
MIIJQwIBADANBgkqhkiG9w0BAQEFAAS... (etc)
then
-----BEGIN CERTIFICATE-----
TEKEYMIIJQwIBADANBgkqhkiG9w0BAQEFA... (etc)
Note the second one has a TEKEY prefix. In hex that's 4c4284 which doesn't look significant.
Where did this come from?

Answer 1

These functions are only designed to handle certificates, not private keys. The reason the result is wrong is because the pem2der function is looking for the start of a certificate (CERTIFICATE----- from -----BEGIN CERTIFICATE-----). You're trying to decode a key starting with -----BEGIN PRIVATE KEY-----. The "TE KEY" part of the result comes from here: "-----BEGIN PRIVATE KEY-----" and is a result of the functions not handling that header so the substr calls return the wrong result.
In theory, the functions should be very easy to modify to process private key files though.