# Why can ssh-keygen export a public key in PEM PKCS8 format?

In the documentation of ssh-keygen (man ssh-keygen) it says for the option -m that an export to the format “PKCS8” (PEM PKCS8 public key) is possible.

That works, and I can read the files using openssl. But the thing that really confuses me: isn't PKCS#8 a format for private keys?

Or is PKCS#8 a format for the keypair, and the private key is omitted? Those formats are really confusing.

Here is an example key exported with ssh-keygen -m PKCS8 -e:

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuRKdrvmS/1FdSvzljmq8
jNEAPMLLxuTT+yCAw5gZ5VaXQ6BR1LudV2N6YOFYp7yUoOye3CobHI9GhAXrNaHr
S3XoMk7/49g/uNNjJUTPzQ1xXZRbTnRgOkAbstYZDWY53S8X8fqk6ET0h3q2VwTu
vkNkzZpiswkSFi7/SqLF0P+DEewyDTeywaGTUO4ls+8nTtl+T63LRSBGd8qUdOzg
nfhr/YosKg3ePFyw1uC2UCK65KG47kmext+rLGFXT1o8oZ/Mlw5e+0aVSEoa6+MG
vXmhdV0IURnw/DJlalisxppFDHjyg6amBqC08w7r1nooqZvnjCXiXR+LEPlfj6hm
1wIDAQAB
-----END PUBLIC KEY-----

• They probably meant either a SubjectPublicKey as specified in the X.509 certificate format, the PKCS#1 format or the wrote "public" instead of "private". And indeed: "Public-Key Cryptography Standards (PKCS) #8: Private-Key Information Syntax Specification Version 1.2". I currently haven't got a Linux machine running, could you base64 encode the output of -m PKCS8 and include it in your question? Sep 3 '15 at 16:57
• @MaartenBodewes, I added an example output based on a throwaway key. Edward, if your version of ssh generates different kind of output, feel free to edit and replace.
– otus
Sep 3 '15 at 17:46
• @otus Thanks... I've installed a Fedora client VM on my laptop, hopefully I can make due with that from now on. Sep 4 '15 at 8:40

What you have here is indeed a structure called SubjectPublicKeyInfo. It's usually part of an X.509 certificate, but it is often also used separate from a certificate. It's, for instance, the default encoding for RSA public keys in Java and - if I'm not mistaken - OpenSSL.
You can view the complete structure here and compare it with the SubjectPublicKeyInfo structure defined here. Of course, you'll only see it up to the BIT STRING. The BIT STRING itself contains the structure defined as RSAPublicKey here. That the BIT STRING contains the RSAPublicKey structure is identified by the 1.2.840.113549.1.1.1 (RSAEncryption) object identifer (OID).
Note that what you are currently showing is the PEM encoding of said SubjectPublicKeyInfo. The PEM structure, sometimes also called "ASCII armor", makes it possible to send binary data over text interfaces, e.g. mail. It consists of the header, the footer and the base 64 encoding of the binary contents.
• SPKI is indeed the default for publickey (for all PK algorithms) in Java crypto, which labels it X.509 a bit imprecisely e.g. java.security.spec.X509EncodedKeySpec, and for openssl commandline operations (with a very few exceptions) and library calls named *PUBKEY* while *{RSA,DSA,EC}PublicKey* calls use deprecated algorithm-specific formats. Sep 28 '16 at 8:17