# RSA Key Differences (OpenSSL CLI vs. OpenSSL/ssl.h C function)

So, I am sitting here trying to figure out what is happening and why two keys are different in such a vast manner. I've created two key pairs, one key pair with the OpenSSL CLI commands on an Ubuntu 16.04 machine and the other keypair with a C program using the RSA_generate_key functions resident within the library. However, even though both keys are made with identical parameters, the differnce is farily large within the public and Private key. The difference in Public Keys are 25 bytes and it seems it's not formatted the same either.

OpenSSL CLI:

 openssl genrsa -des3 -out private.pem 4096
openssl rsa -in private.pem -outform PEM -pubout -out public.pem


OpenSSL CLI Key:

OpenSSL CLI ASN1Parse:

OpenSSL CLI Key Dump (Base64 -d):

------------------------------------------------------------------------------------------------------

C Program:

C Program Key: C Program ASN1Parse: C Program Key Dump (Base64 -d):

Attempting to dig into what the RSA_generate_key function does I found this: but, that does not tell me if it is in an ASN1 (Which it looks to be from the header). Or if there a a different formatting applied that I need to duplicate in order to create a key similar to that created from teh C Program. Essentially, I have to duplicatie the extact functionality of the C key generation with the CLI tools.

• RSA_generate_key creates (actually modifies) an in-memory structure, not any file. Your C program probably used PEM_write[_bio]_RSAPublicKey to create the file. Look at the man page for that function, and for PEM_write[_bio]_[RSA_]PUBKEY, and see how the descriptions differ. Since OpenSSL 1.0.0 openssl rsa -RSAPublicKey_out can convert SPKI to 'raw', although it was not documented until version 1.1.0. – dave_thompson_085 Dec 21 '17 at 3:39
• Alternatively, openssl asn1parse -strparse offset -out filename can extract a component of any ASN.1 structure as DER; in your example you want the component at offset 19, but for different-size keys it may be different, and then you have to convert the DER to PEM yourself with some literal strings and base64, on the same principle as stackoverflow.com/questions/47599544/… although that's for privatekey. – dave_thompson_085 Dec 21 '17 at 3:44

In contrast, the C program just has the ASN.1 raw public keyl that is, it's just a sequence of two integers, the values for $n$ and $d$.
• Nitpick: both formats are supported by OpenSSL library (see my comment on Q). It is the commandline program openssl that prefers X.509-SPKI format. – dave_thompson_085 Dec 21 '17 at 3:34