So maybe I'm thinking about this too hard, or maybe I'm missing a piece of information.

We'll use Google for this example. Say I wanted to obtain the modulus of Google's current public key. Well I can do this relatively simply using OpenSSL:

openssl s_client -connect www.google.com:443 | openssl x509 -text -pubkey

Great, so now I export that into a pem file. So now I have their certificate and their public key. Let's discard their certificate for this instance. Also using OpenSSL, I can list the raw hexadecimal value of the modulus:

openssl rsa -in pubKey.pem -pubin -text -noout

Now that lists this information:

Public-Key: (2048 bit) Modulus: 00:c3:d5:12:42:8a:36:02:f5:77:01:8b:f6:83:2f: ab:c5:c7:00:e4:c0:3e:94:33:3a:2e:7a:2d:37:30: c0:6c:75:67:d4:13:d0:30:b1:11:34:16:21:6f:95: 99:b0:f6:31:3c:55:51:b9:3f:8c:c3:63:50:b9:d0: 03:7f:bb:76:53:66:80:4e:3e:51:d6:77:e6:5c:f5: 38:b1:19:88:7b:86:f8:2d:39:d0:12:4c:d0:6a:5e: 37:f1:bb:22:47:ec:d8:08:ca:06:81:44:4b:11:ef: 51:aa:e6:96:b8:ad:ed:6b:15:be:01:4b:bc:60:c9: df:42:0a:df:d3:8b:e5:b0:03:ac:18:ef:c3:f8:3a: 96:5e:a6:77:61:fe:36:1e:f5:f2:aa:83:1f:69:d4: 79:5d:69:a9:d9:a1:18:a2:98:cd:e6:3d:5b:1e:0f: a9:66:c8:42:f2:ba:b0:74:e8:5f:b3:b5:30:6d:79: a9:e8:9f:9c:23:5f:51:aa:36:2e:35:a7:9a:08:76: f9:46:f0:34:de:70:1a:3d:4e:f7:34:68:e4:43:75: bf:20:58:54:66:1c:9f:6d:9b:9d:28:21:15:ae:89: a7:e9:6f:75:7e:22:49:93:85:c6:a4:c5:2b:1a:23: 92:f9:eb:8f:67:a8:26:56:e1:9f:66:e5:74:2a:01: 0c:17 Exponent: 65537 (0x10001)

Great! I have the hexadecimally encoded modulus. I've read many articles and have seen many websites that offer this, but, for future purposes, I'll just say that I don't necessarily prefer uploading keyfiles (public or private) to external services and "hoping" that they don't record it.

For experimental purposes, how might I obtain the plain decimal version of this modulus using a local client in Linux? I've seen a lot of posts showing that people have done it, but I'm having trouble figuring it out for whatever reason.

Also, I've heard a little bit about the prefixing "00" of this hexadecimal string (00:c3:d5:12:42...), about how it's just a bug. Can you give me more information on this, such as why it occurs and if it's relevant?


closed as off-topic by SEJPM Oct 5 '18 at 16:44

  • This question does not appear to be about cryptography within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    $\begingroup$ Actually, the prefix "00" is not a bug - instead, the tool is listing exactly what's in the ASN.1 (DER) of the public key, and for 2048 bit positive integers, the initial 0x00 is mandatory... $\endgroup$ – poncho Jun 14 '16 at 20:36
  • 8
    $\begingroup$ I'm voting to close this question as off-topic because it is about converting numbers between different representations, rather than cryptographic theory. This should be asked on Super User or perhaps Stack Overflow instead. $\endgroup$ – yyyyyyy Jun 14 '16 at 20:50
  • 2
    $\begingroup$ Note that a publickey is already public so someone 'recording' it doesn't matter. You don't want to upload a privatekey, but for RSA the modulus in the privatekey and publickey are defined to be the same, so to get the modulus the privatekey isn't needed. $\endgroup$ – dave_thompson_085 Jun 15 '16 at 12:36
  • $\begingroup$ unix.stackexchange.com/questions/49850/… ... combine this with sed or grep and you should be golden. $\endgroup$ – Maarten Bodewes Jun 15 '16 at 19:12

You've downloaded Google's (or whomever's) certificate. You have it stored in a file called GoogleCert:

$ cat GoogleCert

Use the command openssl x509 -in FILENAME -noout -modulus argument to extract just the Modulus:

$ openssl x509 -in GoogleCert -noout -modulus

Copy and paste the HEX output into BC using the ibase=16 argument to indicate the input is in Hex:

$ echo 'ibase=16;AAC42564448507CB736A37F...9152FD0458ECF42145' | bc

Not the answer you're looking for? Browse other questions tagged or ask your own question.