In the documentation of ssh-keygen (man ssh-keygen) it says for the option -m that an export to the format “PKCS8” (PEM PKCS8 public key) is possible.

That works, and I can read the files using openssl. But the thing that really confuses me: isn't PKCS#8 a format for private keys?

Or is PKCS#8 a format for the keypair, and the private key is omitted? Those formats are really confusing.

Here is an example key exported with ssh-keygen -m PKCS8 -e:

-----END PUBLIC KEY-----
  • 1
    $\begingroup$ They probably meant either a SubjectPublicKey as specified in the X.509 certificate format, the PKCS#1 format or the wrote "public" instead of "private". And indeed: "Public-Key Cryptography Standards (PKCS) #8: Private-Key Information Syntax Specification Version 1.2". I currently haven't got a Linux machine running, could you base64 encode the output of -m PKCS8 and include it in your question? $\endgroup$ – Maarten Bodewes Sep 3 '15 at 16:57
  • $\begingroup$ @MaartenBodewes, I added an example output based on a throwaway key. Edward, if your version of ssh generates different kind of output, feel free to edit and replace. $\endgroup$ – otus Sep 3 '15 at 17:46
  • $\begingroup$ @otus Thanks... I've installed a Fedora client VM on my laptop, hopefully I can make due with that from now on. $\endgroup$ – Maarten Bodewes Sep 4 '15 at 8:40

What you have here is indeed a structure called SubjectPublicKeyInfo. It's usually part of an X.509 certificate, but it is often also used separate from a certificate. It's, for instance, the default encoding for RSA public keys in Java and - if I'm not mistaken - OpenSSL.

You can view the complete structure here and compare it with the SubjectPublicKeyInfo structure defined here. Of course, you'll only see it up to the BIT STRING. The BIT STRING itself contains the structure defined as RSAPublicKey here. That the BIT STRING contains the RSAPublicKey structure is identified by the 1.2.840.113549.1.1.1 (RSAEncryption) object identifer (OID).

It's certainly not PKCS#8. That's indeed for private keys.

Note that what you are currently showing is the PEM encoding of said SubjectPublicKeyInfo. The PEM structure, sometimes also called "ASCII armor", makes it possible to send binary data over text interfaces, e.g. mail. It consists of the header, the footer and the base 64 encoding of the binary contents.

| improve this answer | |
  • 1
    $\begingroup$ SPKI is indeed the default for publickey (for all PK algorithms) in Java crypto, which labels it X.509 a bit imprecisely e.g. java.security.spec.X509EncodedKeySpec, and for openssl commandline operations (with a very few exceptions) and library calls named *PUBKEY* while *{RSA,DSA,EC}PublicKey* calls use deprecated algorithm-specific formats. $\endgroup$ – dave_thompson_085 Sep 28 '16 at 8:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.