Differences between "BEGIN RSA PRIVATE KEY" and "START A PRIVATE KEY"

Question

Hey. I wrote a program that imports private keys from a .pem file and creates a private key to use it later. The problem I ran into is that some pem file pem start with

 -----BEGIN PRIVATE KEY----- 

while others start with

 -----BEGIN RSA PRIVATE KEY----- 

through my search, I knew that the first ones were PKCS#8 formatted, but I couldn’t know which format the other belongs to.

Answer 1

See https://polarssl.org/kb/cryptography/asn1-key-structures-in-der-and-pem (find the page "BEGIN RSA PRIVATE KEY") ( link to the archive for posterity, just in case).

BEGIN RSA PRIVATE KEY is PKCS # 1 and is simply an RSA key. This, in fact, is only a key object from PKCS # 8, but without a version indicator or algorithm in front. BEGIN PRIVATE KEY is PKCS # 8 and indicates that the key type is included in the key data itself. Link:

Unencrypted PKCS # 8 encoded data begins and ends with tags:

 -----BEGIN PRIVATE KEY----- BASE64 ENCODED DATA -----END PRIVATE KEY----- 

Inside base64 encoded data, the following DER structure is present:

 PrivateKeyInfo ::= SEQUENCE { version Version, algorithm AlgorithmIdentifier, PrivateKey BIT STRING } AlgorithmIdentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY DEFINED BY algorithm OPTIONAL } 

So, for the RSA private key, the OID is 1.2.840.113549.1.1.1, and there is RSAPrivateKey as the string string of the PrivateKey data key.

Unlike the BEGIN RSA PRIVATE KEY , which always indicates the RSA key and therefore does not include the OID of the key. BEGIN RSA PRIVATE KEY PKCS#1 :

RSA Private Key File (PKCS # 1)

The PEM file for the RSA private key is specific to RSA keys.

It starts and ends with tags:

 -----BEGIN RSA PRIVATE KEY----- BASE64 ENCODED DATA -----END RSA PRIVATE KEY----- 

Inside base64 encoded data, the following DER structure is present:

 RSAPrivateKey ::= SEQUENCE { version Version, modulus INTEGER, -- n publicExponent INTEGER, -- e privateExponent INTEGER, -- d prime1 INTEGER, -- p prime2 INTEGER, -- q exponent1 INTEGER, -- d mod (p1) exponent2 INTEGER, -- d mod (q-1) coefficient INTEGER, -- (inverse of q) mod p otherPrimeInfos OtherPrimeInfos OPTIONAL } 

Answer 2

Take a look. It gives possible BEGIN markers.

Copy content from the above link for quick reference:

 #define PEM_STRING_X509_OLD "X509 CERTIFICATE" #define PEM_STRING_X509 "CERTIFICATE" #define PEM_STRING_X509_PAIR "CERTIFICATE PAIR" #define PEM_STRING_X509_TRUSTED "TRUSTED CERTIFICATE" #define PEM_STRING_X509_REQ_OLD "NEW CERTIFICATE REQUEST" #define PEM_STRING_X509_REQ "CERTIFICATE REQUEST" #define PEM_STRING_X509_CRL "X509 CRL" #define PEM_STRING_EVP_PKEY "ANY PRIVATE KEY" #define PEM_STRING_PUBLIC "PUBLIC KEY" #define PEM_STRING_RSA "RSA PRIVATE KEY" #define PEM_STRING_RSA_PUBLIC "RSA PUBLIC KEY" #define PEM_STRING_DSA "DSA PRIVATE KEY" #define PEM_STRING_DSA_PUBLIC "DSA PUBLIC KEY" #define PEM_STRING_PKCS7 "PKCS7" #define PEM_STRING_PKCS7_SIGNED "PKCS #7 SIGNED DATA" #define PEM_STRING_PKCS8 "ENCRYPTED PRIVATE KEY" #define PEM_STRING_PKCS8INF "PRIVATE KEY" #define PEM_STRING_DHPARAMS "DH PARAMETERS" #define PEM_STRING_DHXPARAMS "X9.42 DH PARAMETERS" #define PEM_STRING_SSL_SESSION "SSL SESSION PARAMETERS" #define PEM_STRING_DSAPARAMS "DSA PARAMETERS" #define PEM_STRING_ECDSA_PUBLIC "ECDSA PUBLIC KEY" #define PEM_STRING_ECPARAMETERS "EC PARAMETERS" #define PEM_STRING_ECPRIVATEKEY "EC PRIVATE KEY" #define PEM_STRING_PARAMETERS "PARAMETERS" #define PEM_STRING_CMS "CMS"