# Anatomy of an RSA private key

I'm learning about OpenSSL and public key infrastructure and am curious about the structure of an RSA key and how it's related to its corresponding public key.

I can generate a private RSA key with the OpenSSL genrsa command:

$openssl genrsa -aes128 -out fd.key 2048 Generating RSA private key, 2048 bit long modulus ....+++ ...................................................................................... +++ e is 65537 (0x10001) Enter pass phrase for fd.key: **************** Verifying - Enter pass phrase for fd.key: ****************  I know there are three factors to think about when generating a private key: 1. Algorithm 2. Size 3. Passphrase In this case, I'm using the RSA algorithm, 2048 bit size, and encrypting the key with AES-128 encryption. I can view the structure of the RSA key using the rsa command: $ openssl rsa -text -in fd.key
Enter pass phrase for fd.key: ****************
Private-Key: (2048 bit)
modulus:
00:b6:ae:03:fa:d5:ec:3d:7b:1e:a5:33:68:44:5f:
[...]
publicExponent: 65537 (0x10001)
privateExponent:
1a:12:ee:41:3c:6a:84:14:3b:be:42:bf:57:8f:dc:
[...]
prime1:
00:c9:7e:82:e4:74:69:20:ab:80:15:99:7d:5e:49:
[...]
prime2:
00:c9:2c:30:95:3e:cc:a4:07:88:33:32:a5:b1:d7:
[...]
exponent1:
68:f4:5e:07:d3:df:42:a6:32:84:8d:bb:f0:d6:36:
[...]
exponent2:
5e:b8:00:b3:f4:9a:93:cc:bc:13:27:10:9e:f8:7e:
[...]
coefficient:
34:28:cf:72:e5:3f:52:b2:dd:44:56:84:ac:19:00:
[...]
writing RSA key
-----BEGIN RSA PRIVATE KEY-----
[...]
-----END RSA PRIVATE KEY-----


I'm also able to view the public key using the using the rsa command:

$openssl rsa -in fd.key -pubout Enter pass phrase for fd.key: **************** writing RSA key -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyOYm8hJCi3vKLaud2YTU O3glFfQUpJ6d4gXiWp//HkDQIvi2BFmvbUyHMh4XWLwPbmaX2dfJ5Aa8+ZIC9KCY y96Gmbw+v75RzxHq5iFLnZNFhYM2zkMvUUjJs/UqunOL1OoEiC06hb85SBepKtnE JUUKo/rtZ2Sj/pHvF0Wqu1hLyR3iOxdJb26+m2IhOy4wB3HI6FBcvrMd4Hmejpup skIRhTQXkV7XQ79yRCTS3ejiGoVvkPKzWxL+OFWOJTduXAk8McMLEozSGZll8bv7 jJUWLhmegvokKS2eLfA4B16yU59EgNbvuoG5doKUeV0LJ03Iiqv81nFB9SqEG/Xe VQIDAQAB -----END PUBLIC KEY-----  From the Hexadecimal wiki page: One hexadecimal digit represents a nibble (4 bits), which is half of an octet or byte (8 bits). Some things I'm curious about: • Which numbers correspond to the 2048bit length? Is it prime, exponent, coefficient...? • How is the public key related to the private key? Is it calculated from the numbers, or is it embedded in the private key? From reading another answer it sounds like the 2048 length corresponds to the modulus. However when I calculate the length I get 2056: $ echo "00:b6:ae:03:fa:d5:ec:3d:7b:1e:a5:33:68:44:5f:d0:6a:0b:b5:87:31:80:a0:50:32:b0:7c:73:4b:f8:a2:03:91:89:c2:11:32:69:2e:13:90:71:f6:a9:48:21:00:c5:ad:1c:93:f0:21:27:ce:ca:15:04:53:30:c6:88:7b:45:c0:f2:01:d5:a7:9e:c1:c5:f2:ae:b0:7f:31:68:b7:3c:c3:62:13:eb:40:25:a9:3f:cd:81:90:9f:a1:3f:02:84:d8:6e:73:d2:5d:53:28:cc:97:35:f6:fa:5c:b7:dc:11:fb:60:08:1b:75:f7:74:dc:24:29:3e:ff:fb:ba:dc:77:2c:48:0d:3b:a1:7b:d9:9a:3d:52:7d:9a:d6:c1:f1:e7:46:df:be:75:b0:d2:0f:d2:1c:7b:25:57:94:33:8f:d5:b3:ee:7f:30:98:a9:06:25:b5:ab:b1:a6:ab:f9:f2:52:b8:e7:8f:87:5f:6d:96:36:67:47:38:4c:ef:29:c7:71:e4:07:7c:13:19:3a:e2:b4:3c:85:18:32:77:a6:98:0e:0d:b4:70:01:75:79:de:e9:83:c5:df:41:2f:69:f6:30:8d:13:29:84:9a:84:3a:c0:6a:4c:0d:bd:cd:9b:1e:93:de:8e:c9:a4:02:b7:0f:a2:96:45:ad:b8:3e:3a:d3:fd:4d" | tr ':' '\n' | wc -l
257


Each line contains 2 hexadecimal digits

257 * 2 = 514


Each digit contains 4 bits

514 * 4 = 2056


Shouldn't it add up to 2048?

## migrated from security.stackexchange.comMar 30 '17 at 6:34

This question came from our site for information security professionals.

• The key length is explained here (it's the modulus). How the RSA private key corresponds to the public key is well-explained on Wikipedia and elsewhere. About what in particular do you have problems understanding? – Arminius Mar 29 '17 at 16:02
• When you count the bytes you should remove the leading zero, when present. I believe it is due to DER encoding (but openssl should not keep it IMHO). So it's not 257 since there is a leading "00", it's 256, so 256*8 = 2048 – Ruggero Mar 30 '17 at 10:05

Which numbers correspond to the 2048bit length? Is it prime, exponent, coefficient...?

Only the modulus really - the key size is identical to the modulus size by definition. The primes are commonly half of the key size for calculations that use 2 primes (multi-prime RSA is faster and on the uptake). The private exponent may not reach the full key size; it's between 0 and the modulus (exclusive). There is a high chance that the size is the same or slightly less than the modulus in bytes.

How is the public key related to the private key? Is it calculated from the numbers, or is it embedded in the private key?

It's calculated during the key pair generation process - the output of which is both a private key and a public key. The private key and public key share the same modulus. Often the private key - generated by a specific tool such as OpenSSL - contains the public exponent, so you can also extract / use the public key if you have the private key.

Usually the public exponent is a known, small value - such as the fourth prime of Fermat: 0x010001. But as that may not be the case the public exponent (and thus the public key) in general isn't calculated from the private key components. If the public exponent is the same size as the private exponent then you cannot calculate it from the private key values.

From reading another answer it sounds like the 2048 length corresponds to the modulus. However when I calculate the length I get 2056 ...

ASN.1 / DER encoded INTEGER values are signed, big endian. As the most significant bit of the positive modulus is always set - assuming that the key size is dividable by 8 - it will always left-pad the modulus with a padding byte set to 00. Otherwise the encoding would represent a negative value in so-called two-complement encoding - the most significant bit is seen as the sign bit: 0 for positive number representation and 1 for negative number representation.

So the signed encoding in octets of the modulus is 2048 + 8 bits or 257 bytes. But the bit length - as it is called in most programming API's - of the modulus is still 2048.

Note that OpenSSL shows the generation parameters required to use the Chinese Remainder Theorem to speed up RSA calculations. In principle a private key could also consist of just the private exponent and the modulus.

For the relation between public and private key : the second integer of the private key is called the decrypting exponent, it is computed with the encrypting exponent $e$ and $\phi(n)$. It is the modular inverse of $e$ mod $\phi(n)$. $\phi(n)$ is computed with the decomposition in prime factors of $n$.

So, when you encrypt a number using the public encrypting exponent, (and always mod n), the decrypting exponent of the private key lets you get your number back.