Node encrypt with forge-node and bouncyCastle decryp

I currently generate a key pair and then encrypt the private key with a paraphase as you can see in the following code in node with the node-forge library.

const keypair = forge.pki.rsa.generateKeyPair({ bits: 4096 });
const publicKey = forge.pki.publicKeyToPem(keypair.publicKey);
const privateKey = forge.pki.encryptRsaPrivateKey(keypair.privateKey, passphrase, { algorithm: 'aes256' });

However, when I try to do client-side decryption in C# with the BouncyCastle library I get the following error.

      public static string DecryptPrivateKey(string privateKey, string passphrase)
      {
        // Utiliza Bouncy Castle para descifrar la clave privada
        AsymmetricCipherKeyPair keyPair;
        using (TextReader reader = new StringReader(privateKey))
        {
          PemReader pemReader = new PemReader(reader, new PasswordFinder(passphrase));
          keyPair = (AsymmetricCipherKeyPair)pemReader.ReadObject();
        }
    
        // Extrae la clave privada en formato PEM
        StringWriter stringWriter = new StringWriter();
        PemWriter pemWriter = new PemWriter(stringWriter);
        pemWriter.WriteObject(keyPair.Private);
        pemWriter.Writer.Flush();
    
        return stringWriter.ToString();
      }

  private class PasswordFinder : IPasswordFinder
  {
    private readonly string password;

    public PasswordFinder(string password)
    {
      this.password = password;
    }

    public char[] GetPassword()
    {
      return password.ToCharArray();
    }
  }

"The input is not a valid Base-64 string as it contains a non-base 64 character, more than two padding characters, or an illegal character among the padding characters"

I have looked for information so that what Forge generates is compatible with Bouncycastle, but I still cannot achieve it. I would be grateful if you could give me a clue or perhaps a node -> c# implementation that has worked for you. Thank you

C#: .net 6.0, BouncyCastle.NetCore 2.2.1 Node: v16.16.0, node-forge ^1.3.1

privateKey:

passphrase: "my-new-secret-key"

Solution

The posted key is a PEM encoded, encrypted private RSA key in PKCS#8 format. The C# code, on the other hand, is written for the import of a PEM encoded, encrypted private RSA key in PKCS#1 format, which is why the import fails.

So that the import of the posted key works, the DecryptPrivateKey() method must be changed as follows:

using Org.BouncyCastle.Crypto.Parameters;
...
public static string DecryptPrivateKey(string privateKey, string passphrase)
{
    RsaPrivateCrtKeyParameters privKey;
    using (TextReader reader = new StringReader(privateKey))
    {
        PemReader pemReader = new PemReader(reader, new PasswordFinder(passphrase));
        privKey = (RsaPrivateCrtKeyParameters)pemReader.ReadObject();
    }
    StringWriter stringWriter = new StringWriter();
    PemWriter pemWriter = new PemWriter(stringWriter);
    pemWriter.WriteObject(privKey);
    pemWriter.Writer.Flush();
    return stringWriter.ToString();
}

Note the use of the RsaPrivateCrtKeyParameters type instead of the AsymmetricCipherKeyPair type.

For completeness: Be aware that the key is exported as PEM encoded private RSA key in PKCS#1 format.

However, in my environment I cannot reproduce the error message you observed, instead I get the (more plausible) message:

System.InvalidCastException: Unable to cast object of type 'Org.BouncyCastle.Crypto.Parameters.RsaPrivateCrtKeyParameters' to type 'Org.BouncyCastle.Crypto.AsymmetricCipherKeyPair'.

Note that as of .NET 5 there is a built-in support for importing a PEM encoded, encrypted private RSA key in PKCS#8 format, namely RSA.ImportFromEncryptedPem(), as well as for PEM encoding, namely PemEncoding, so BouncyCastle is actually not needed for this.

using System.Security.Cryptography;
...
RSA rsa = RSA.Create();
rsa.ImportFromEncryptedPem(privateKey, Encoding.UTF8.GetBytes(passphrase));
Console.WriteLine(new string(PemEncoding.Write("PRIVATE RSA KEY", rsa.ExportRSAPrivateKey())));