Differences between “BEGIN RSA PRIVATE KEY” and “BEGIN PRIVATE KEY”

by

See https://polarssl.org/kb/cryptography/asn1-key-structures-in-der-and-pem (search the page for “BEGIN RSA PRIVATE KEY”) (archive link for posterity, just in case).

BEGIN RSA PRIVATE KEY is PKCS#1 and is just an RSA key. It is essentially just the key object from PKCS#8, but without the version or algorithm identifier in front. BEGIN PRIVATE KEY is PKCS#8 and indicates that the key type is included in the key data itself. From the link:

The unencrypted PKCS#8 encoded data starts and ends with the tags:

-----BEGIN PRIVATE KEY-----
BASE64 ENCODED DATA
-----END PRIVATE KEY-----

Within the base64 encoded data the following DER structure is present:

PrivateKeyInfo ::= SEQUENCE {
  version         Version,
  algorithm       AlgorithmIdentifier,
  PrivateKey      BIT STRING
}

AlgorithmIdentifier ::= SEQUENCE {
  algorithm       OBJECT IDENTIFIER,
  parameters      ANY DEFINED BY algorithm OPTIONAL
}

So for an RSA private key, the OID is 1.2.840.113549.1.1.1 and there is a RSAPrivateKey as the PrivateKey key data bitstring.

As opposed to BEGIN RSA PRIVATE KEY, which always specifies an RSA key and therefore doesn’t include a key type OID. BEGIN RSA PRIVATE KEY is PKCS#1:

RSA Private Key file (PKCS#1)

The RSA private key PEM file is specific for RSA keys.

It starts and ends with the tags:

-----BEGIN RSA PRIVATE KEY-----
BASE64 ENCODED DATA
-----END RSA PRIVATE KEY-----

Within the base64 encoded data the following DER structure is present:

RSAPrivateKey ::= SEQUENCE {
  version           Version,
  modulus           INTEGER,  -- n
  publicExponent    INTEGER,  -- e
  privateExponent   INTEGER,  -- d
  prime1            INTEGER,  -- p
  prime2            INTEGER,  -- q
  exponent1         INTEGER,  -- d mod (p-1)
  exponent2         INTEGER,  -- d mod (q-1)
  coefficient       INTEGER,  -- (inverse of q) mod p
  otherPrimeInfos   OtherPrimeInfos OPTIONAL
}

More Related Contents:

  1. Converting pfx to pem using openssl
  2. Use RSA private key to generate public key? [closed]
  3. C# RSA Public Key Output Not Correct
  4. Multiple OpenSSL RSA signing methods produce different results
  5. RSA: Get exponent and modulus given a public key
  6. How to save public key from a certificate in .pem format
  7. How to create public and private key with openssl?
  8. Unable to load Private Key. (PEM routines:PEM_read_bio:no start line:pem_lib.c:648:Expecting: ANY PRIVATE KEY) [closed]
  9. How to get .pem file from .key and .crt files?
  10. How to read .pem file to get private and public key
  11. Load RSA public key from file
  12. How can I transform between the two styles of public key format, one “BEGIN RSA PUBLIC KEY”, the other is “BEGIN PUBLIC KEY”
  13. How to generate RSA private key using OpenSSL?
  14. Why are the RSA-SHA256 signatures I generate with OpenSSL and Java different?
  15. Use OpenSSL RSA key with .Net
  16. Converting PKCS#12 certificate into PEM using OpenSSL
  17. Difference between openSSL rsautl and dgst
  18. Verify a certificate chain using openssl verify
  19. Convert PEM traditional private key to PKCS8 private key
  20. Using OpenSSL what does “unable to write ‘random state'” mean?
  21. OpenSSL Verify return code: 20 (unable to get local issuer certificate)
  22. How do I manage the error “OpenSSL v1.1.1 ssl_choose_client_version unsupported protocol”? [closed]
  23. Correct location of openssl.cnf file
  24. Get a PrivateKey from a RSA .pem file [duplicate]
  25. Convert pem key to ssh-rsa format
  26. How can I get SecKeyRef from DER/PEM file
  27. How to convert an ECDSA key to PEM format
  28. Creating a .p12 file
  29. Cross Compile OpenSSH for ARM
  30. Why does RSA encrypted text give me different results for the same text

Leave a Comment