Create RSA Public/Private Keys with OID rsassaPss

Question

I'd like to create a public/private RSA key pair where the OID of both keys is rsassaPss. I can create the private key fine but when I extract the public key I expected the OID to remain rsassaPss but it actually gets converted to rsaEncryption.

This SO post Why does OpenSSL differentiate between PSS and non-PSS for private key generation? says

If you reuse the same key material for different algorithms, you rely not on the security of any one algorithm individually, but on the security of the composition of the two algorithms simultaneously.

Given that, I'd assume there'd be someway to generate a public key that is constrained to the same OID as the private key.

This RFC indicates this is possible but I'm not sure what openssl command will generate such a public key.

When the RSA private key owner wishes to limit the use of the public key exclusively to RSASSA-PSS, then the id-RSASSA-PSS object identifier MUST be used in the algorithm field within the subject public key information, and, if present, the parameters field MUST contain RSASSA-PSS-params. The id-RSASSA-PSS object identifier value and the RSASSA-PSS-params syntax are fully described in Section 3.

Here is how I created my private key with OID rsassaPss.

$ openssl genpkey -algorithm rsa-pss 2>/dev/null | openssl asn1parse | fold
    0:d=0  hl=4 l=1214 cons: SEQUENCE          
    4:d=1  hl=2 l=   1 prim: INTEGER           :00
    7:d=1  hl=2 l=  11 cons: SEQUENCE          
    9:d=2  hl=2 l=   9 prim: OBJECT            :rsassaPss
   20:d=1  hl=4 l=1194 prim: OCTET STRING      [HEX DUMP]:30820...

Here is how I tried to create my public key with OID rsassaPss but actually got rsaEncryption.

$ openssl genpkey -algorithm rsa-pss 2>/dev/null | openssl rsa -pubout |  openssl asn1parse
writing RSA key
    0:d=0  hl=4 l= 290 cons: SEQUENCE          
    4:d=1  hl=2 l=  13 cons: SEQUENCE          
    6:d=2  hl=2 l=   9 prim: OBJECT            :rsaEncryption
   17:d=2  hl=2 l=   0 prim: NULL              
   19:d=1  hl=4 l= 271 prim: BIT STRING        

Shouldn't the public key have the same OID as the private key? If not, how do I know what algorithm to use given a public key for a private key using rsassaPss?

Thanks!

Answer 1

Per Dave's comment, switch rsa to pkey and the OID is preserved in the public key.

$ openssl genpkey -algorithm rsa-pss 2>/dev/null | openssl pkey -pubout | openssl asn1parse
    0:d=0  hl=4 l= 288 cons: SEQUENCE          
    4:d=1  hl=2 l=  11 cons: SEQUENCE          
    6:d=2  hl=2 l=   9 prim: OBJECT            :rsassaPss
   17:d=1  hl=4 l= 271 prim: BIT STRING

Also, pkey seems to inspect the private key and take the appropriate action to generate the public key for rsa, rsa-pss, and es private keys.