# Create RSA Public/Private Keys with OID rsassaPss

I'd like to create a public/private RSA key pair where the OID of both keys is rsassaPss. I can create the private key fine but when I extract the public key I expected the OID to remain rsassaPss but it actually gets converted to rsaEncryption.

If you reuse the same key material for different algorithms, you rely not on the security of any one algorithm individually, but on the security of the composition of the two algorithms simultaneously.

Given that, I'd assume there'd be someway to generate a public key that is constrained to the same OID as the private key.

This RFC indicates this is possible but I'm not sure what openssl command will generate such a public key.

When the RSA private key owner wishes to limit the use of the public key exclusively to RSASSA-PSS, then the id-RSASSA-PSS object identifier MUST be used in the algorithm field within the subject public key information, and, if present, the parameters field MUST contain RSASSA-PSS-params. The id-RSASSA-PSS object identifier value and the RSASSA-PSS-params syntax are fully described in Section 3.

Here is how I created my private key with OID rsassaPss.

$openssl genpkey -algorithm rsa-pss 2>/dev/null | openssl asn1parse | fold 0:d=0 hl=4 l=1214 cons: SEQUENCE 4:d=1 hl=2 l= 1 prim: INTEGER :00 7:d=1 hl=2 l= 11 cons: SEQUENCE 9:d=2 hl=2 l= 9 prim: OBJECT :rsassaPss 20:d=1 hl=4 l=1194 prim: OCTET STRING [HEX DUMP]:30820...  Here is how I tried to create my public key with OID rsassaPss but actually got rsaEncryption. $ openssl genpkey -algorithm rsa-pss 2>/dev/null | openssl rsa -pubout |  openssl asn1parse
writing RSA key
0:d=0  hl=4 l= 290 cons: SEQUENCE
4:d=1  hl=2 l=  13 cons: SEQUENCE
6:d=2  hl=2 l=   9 prim: OBJECT            :rsaEncryption
17:d=2  hl=2 l=   0 prim: NULL
19:d=1  hl=4 l= 271 prim: BIT STRING


Shouldn't the public key have the same OID as the private key? If not, how do I know what algorithm to use given a public key for a private key using rsassaPss?

Thanks!

• openssl rsa is old (dates back to 0.9.x in versions before 2000) and only supports old-style rsaEncryption keys; instead use openssl pkey [-in private.pem] -pubout Sep 24 at 3:31

## 1 Answer

Per Dave's comment, switch rsa to pkey and the OID is preserved in the public key.

\$ openssl genpkey -algorithm rsa-pss 2>/dev/null | openssl pkey -pubout | openssl asn1parse
0:d=0  hl=4 l= 288 cons: SEQUENCE
4:d=1  hl=2 l=  11 cons: SEQUENCE
6:d=2  hl=2 l=   9 prim: OBJECT            :rsassaPss
17:d=1  hl=4 l= 271 prim: BIT STRING


Also, pkey seems to inspect the private key and take the appropriate action to generate the public key for rsa, rsa-pss, and es private keys.