I can't find anywhere details on how to fingerprint a public RSA key in PKCS1 format.

There are a lot of examples on the internet on how to fingerprint an RSA public key in openssh format using ssh-keygen -lf id_rsa.pub but in my application I am receiving a public key in PCKS1 format and even if I can remove the -----BEGIN RSA PUBLIC KEY----- and -----END RSA PUBLIC KEY----- parts, base64 decode the contents and hash the resulting data, I can't find an example on how to verify this hash/fingerprint using openssl or ssh-keygen.

What am I doing wrong?

  • $\begingroup$ For what (fingerprint) standard would that be? I've seen SHA-1 over the modulus (as unsigned, big endian value) being used in PKCS#11. PKCS#1 itself does not contain a standard for fingerprinting keys AFAIK. $\endgroup$ – Maarten Bodewes Oct 19 '15 at 10:06
  • $\begingroup$ So how does one fingerprint a PKCS#1 key then? I've found this github.com/arekinath/node-sshpk and tried to feed it a PKCS#1 key and reqeust a fingerprint - I was offered the fingerprint of the openssh version. $\endgroup$ – s3v3n Oct 19 '15 at 11:07
  • $\begingroup$ Yes, that one encodes the key internally into SSH format and then fingerprints the key. $\endgroup$ – Maarten Bodewes Oct 19 '15 at 11:18