def create_rsa_public_and_private_from_pem(pem, passphrase=None):
<EOL>securesystemslib.formats.PEMRSA_SCHEMA.check_match(pem)<EOL>if passphrase is not None:<EOL><INDENT>securesystemslib.formats.PASSWORD_SCHEMA.check_match(passphrase)<EOL>passphrase = passphrase.encode('<STR_LIT:utf-8>')<EOL><DEDENT>try:<EOL><INDENT>private_key = load_pem_private_key(pem.encode('<STR_LIT:utf-8>'),<EOL>passphrase, backend=default_backend())<EOL><DEDENT>except (ValueError, TypeError, cryptography.exceptions.UnsupportedAlgorithm) as e:<EOL><INDENT>raise securesystemslib.exceptions.CryptoError('<STR_LIT>'<EOL>'<STR_LIT>' + str(e))<EOL><DEDENT>private_pem = private_key.private_bytes(encoding=serialization.Encoding.PEM,<EOL>format=serialization.PrivateFormat.TraditionalOpenSSL,<EOL>encryption_algorithm=serialization.NoEncryption())<EOL>public_key = private_key.public_key()<EOL>public_pem = public_key.public_bytes(encoding=serialization.Encoding.PEM,<EOL>format=serialization.PublicFormat.SubjectPublicKeyInfo)<EOL>return public_pem.decode(), private_pem.decode()<EOL>
<Purpose>
  Generate public and private RSA keys from an optionally encrypted PEM.  The
  public and private keys returned conform to
  'securesystemslib.formats.PEMRSA_SCHEMA' and have the form:

  '-----BEGIN RSA PUBLIC KEY----- ... -----END RSA PUBLIC KEY-----'

  and

  '-----BEGIN RSA PRIVATE KEY----- ...-----END RSA PRIVATE KEY-----'

  The public and private keys are returned as strings in PEM format.

  In case the private key part of 'pem' is encrypted  pyca/cryptography's
  load_pem_private_key() method is passed passphrase.  In the default case
  here, pyca/cryptography will decrypt with a PBKDF1+MD5
  strengthened'passphrase', and 3DES with CBC mode for encryption/decryption.
  Alternatively, key data may be encrypted with AES-CTR-Mode and the
  passphrase strengthened with PBKDF2+SHA256, although this method is used
  only with TUF encrypted key files.

  >>> public, private = generate_rsa_public_and_private(2048)
  >>> passphrase = 'secret'
  >>> encrypted_pem = create_rsa_encrypted_pem(private, passphrase)
  >>> returned_public, returned_private = \
  create_rsa_public_and_private_from_pem(encrypted_pem, passphrase)
  >>> securesystemslib.formats.PEMRSA_SCHEMA.matches(returned_public)
  True
  >>> securesystemslib.formats.PEMRSA_SCHEMA.matches(returned_private)
  True
  >>> public == returned_public
  True
  >>> private == returned_private
  True

<Arguments>
  pem:
    A byte string in PEM format, where the private key can be encrypted.
    It has the form:

    '-----BEGIN RSA PRIVATE KEY-----\n
    Proc-Type: 4,ENCRYPTED\nDEK-Info: DES-EDE3-CBC ...'

  passphrase: (optional)
    The passphrase, or password, to decrypt the private part of the RSA
    key.  'passphrase' is not directly used as the encryption key, instead
    it is used to derive a stronger symmetric key.

<Exceptions>
  securesystemslib.exceptions.FormatError, if the arguments are improperly
  formatted.

  securesystemslib.exceptions.CryptoError, if the public and private RSA keys
  cannot be generated from 'pem', or exported in PEM format.

<Side Effects>
  pyca/cryptography's 'serialization.load_pem_private_key()' called to
  perform the actual conversion from an encrypted RSA private key to
  PEM format.

<Returns>
  A (public, private) tuple containing the RSA keys in PEM format.