In the documentation of ssh-keygen (man ssh-keygen) it says for the option -m that an export to the format “PKCS8” (PEM PKCS8 public key) is possible.

That works, and I can read the files using openssl. But the thing that really confuses me: isn't PKCS#8 a format for private keys?

Or is PKCS#8 a format for the keypair, and the private key is omitted? Those formats are really confusing.

Here is an example key exported with ssh-keygen -m PKCS8 -e:

-----END PUBLIC KEY-----
  • 1
    $\begingroup$ They probably meant either a SubjectPublicKey as specified in the X.509 certificate format, the PKCS#1 format or the wrote "public" instead of "private". And indeed: "Public-Key Cryptography Standards (PKCS) #8: Private-Key Information Syntax Specification Version 1.2". I currently haven't got a Linux machine running, could you base64 encode the output of -m PKCS8 and include it in your question? $\endgroup$
    – Maarten Bodewes
    Sep 3, 2015 at 16:57
  • $\begingroup$ @MaartenBodewes, I added an example output based on a throwaway key. Edward, if your version of ssh generates different kind of output, feel free to edit and replace. $\endgroup$
    – otus
    Sep 3, 2015 at 17:46
  • $\begingroup$ @otus Thanks... I've installed a Fedora client VM on my laptop, hopefully I can make due with that from now on. $\endgroup$
    – Maarten Bodewes
    Sep 4, 2015 at 8:40

1 Answer 1


What you have here is indeed a structure called SubjectPublicKeyInfo. It's usually part of an X.509 certificate, but it is often also used separate from a certificate. It's, for instance, the default encoding for RSA public keys in Java and - if I'm not mistaken - OpenSSL.

You can view the complete structure here and compare it with the SubjectPublicKeyInfo structure defined here. Of course, you'll only see it up to the BIT STRING. The BIT STRING itself contains the structure defined as RSAPublicKey here. That the BIT STRING contains the RSAPublicKey structure is identified by the 1.2.840.113549.1.1.1 (RSAEncryption) object identifer (OID).

It's certainly not PKCS#8. That's indeed for private keys.

Note that what you are currently showing is the PEM encoding of said SubjectPublicKeyInfo. The PEM structure, sometimes also called "ASCII armor", makes it possible to send binary data over text interfaces, e.g. mail. It consists of the header, the footer and the base 64 encoding of the binary contents.

  • 1
    $\begingroup$ SPKI is indeed the default for publickey (for all PK algorithms) in Java crypto, which labels it X.509 a bit imprecisely e.g. java.security.spec.X509EncodedKeySpec, and for openssl commandline operations (with a very few exceptions) and library calls named *PUBKEY* while *{RSA,DSA,EC}PublicKey* calls use deprecated algorithm-specific formats. $\endgroup$ Sep 28, 2016 at 8:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.