# Why ssh-gen makes difference between PEM and PKCS8?

Correct me if I am wrong, but PKCS8 is format to store private key info. It could be binary-enoded (DER) or Base64 encoded (PEM).

man ssh-config

-m key_format
Specify a key format for the -i (import) or -e (export) conver‐
sion options.  The supported key formats are: “RFC4716” (RFC
4716/SSH2 public or private key), “PKCS8” (PEM PKCS8 public
key) or “PEM” (PEM public key).  The default conversion format
is “RFC4716”.


I am confused with "PKCS8 Public Key" (while RFC-5208 is "Private-Key Information Syntax Specification Version") but I also can't understand what is "PEM public key" here? PKCS8 could be PEM or DER. What does it mean?

• OpenSSH's terminology is seriously confus{ed,ing} here. What they call 'PKCS8' isn't PKCS#8 at all, but rather PEM encoding of the SubjectPublicKeyInfo structure defined by X.509 to handle multiple PKC algorithms, which is more conveniently available in tools.ietf.org/html/rfc5280#section-4.1.2.7 with the details mostly in rfc3279. This format is ASN.1 based, as is 'PEM' which is PKCS#1 as you found, while rfc4716 is based on the XDR-like format used in SSH protocol. – dave_thompson_085 May 5 '16 at 18:58
• I know this is old but how do i make sure convert it to the proper putty file or how do use keygen to create a file i can use with putty – user86133 Jan 11 at 1:45
• @user86133: the only keyfile format used by the putty program is PPK which OpenSSH does not support and in particular cannot create. But the putty package also includes another program puttygen which among other things can convert PPK keyfiles from or to OpenSSH files. On Windows it's a GUI and just looking at the menu options should be obvious, or you can click on Help. On Unix it's commandline with a man page in the long-standard Unix way which you should read. – dave_thompson_085 Jan 12 at 3:58

Oh, I have found an answer. PEM here is PKCS#1 (RSA) key. Not sure why ssh-keygen used this terminology. And PKCS#8 could be used for Public keys as well since RFC-5958 which obsoletes RFC-5208. A very good article is https://tls.mbed.org/kb/cryptography/asn1-key-structures-in-der-and-pem and this question is also good: https://stackoverflow.com/questions/20065304/what-is-the-differences-between-begin-rsa-private-key-and-begin-private-key

Here is PKCS#1(RSA):

[foo@bar ~]$ssh-keygen -f .ssh/authorized_keys -e -m PEM -----BEGIN RSA PUBLIC KEY----- MIIBCgKCAQEApPGAMzobORnBJdPD0VvBif0cBkRC1KgTi4rDmscp+4F8Ke6nE/jE ..... rf/DnkvPoJPiRLBnyjmyWsQ0dWHnRbSZSwIDAQAB -----END RSA PUBLIC KEY-----  And here is PKCS#8 [foo@bar ~]$ ssh-keygen -f .ssh/authorized_keys -e -m PKCS8
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApPGAMzobORnBJdPD0VvB
...
yk/avnG/lceGqChXgjxcHEKQRJYZRTnqrf/DnkvPoJPiRLBnyjmyWsQ0dWHnRbSZ
SwIDAQAB
-----END PUBLIC KEY-----

• rfc 5958 officially obsoletes 5208, but it is no longer PKCS#8 (or even compatible) and I don't know of anything that implements it. Whereas at least OpenSSL and Java JCE continue to use PKCS#8 -- only for private keys (although for RSA at least the private key representation includes the public key). – dave_thompson_085 May 5 '16 at 19:15