PKCS#1 and PKCS#8 format for RSA private key [closed]

C

2

77

How an RSA key literally is stored using the formats PKCS#1 and PKCS#8? What is the difference between the PKCS formats vs encodings (DER, PEM)? From what I understand, PEM is more human readable. Is PEM/DER for keys/certs similar to UTF-8/16 for characters? What is the significance of DER/PEM?

Cremona answered 24/2, 2018 at 1:3 Comment(1)

Take a look at my older answer to similar question for a visual explanation. – Antiworld 24/2, 2018 at 7:46

B

41

PKCS#1 and PKCS#8 (Public-Key Cryptography Standard) are standards that govern the use of particular cryptographic primitives, padding, etc. Both define file formats that are used to store keys, certificates, and other relevant information.

PEM (Privacy-Enhanced Mail) and DER (Distinguished Encoding Rules) are a little bit more interesting. DER is the ASN.1 encoding for keys and certificates etc., which you'll be able to Google plenty about. Private keys and certificates are encoded using DER and can be saved directly like this. However, these files are binary and can't be copied and pasted easily, so many (if not most?) implementations accept PEM encoded files also. PEM is basically base64 encoded DER: we add a header, optional meta-data, and the base64 encoded DER data and we have a PEM file.

Berkelium answered 24/2, 2018 at 1:27 Comment(1)

“which you'll be able to Google plenty about” is my favorite phrase to find in the accepted answer to a StackOverflow question that's now a top Google result – Grosso 6/5, 2021 at 10:42

S

193

(Expanding more than I feel is appropriate for an edit.)

PKCS1, available in several versions as rfcs 2313 2437 3447 and 8017, is primarily about using the RSA algorithm for cryptography including encrypting decrypting signing and verifying. But since crypto is often used between systems or at least programs it is convenient to have a defined, interoperable format for keys, and PKCS1 defines fairly minimal formats for RSA public and private keys in appendix A.1. As Luke implied this uses ASN.1 conventionally encoded as DER, which is a standard for interoperably encoding data of almost any kind.

PKCS8 available as rfc5208 on the other hand is a standard for handling private keys for all algorithms, not just RSA. It also uses ASN.1 DER, and starts by simply combining an AlgorithmIdentifier, an ASN.1 structure (first) defined by X.509 which not very surprisingly identifies an algorithm, with an OCTET STRING which contains a representation of the key in a fashion depending on the algorithm. For algorithm RSA, identified by an AlgorithmIdentifier containing an OID which means rsaEncryption, the OCTET STRING contains the PKCS1 private key encoding. PKCS8 also allows arbitrary 'attributes' to be added, but this is rarely used. (E.g. Unable to convert .jks to .pkcs12: excess private key)

PKCS8 also provides an option to encrypt the private key, using password-based encryption (in practice though not explicitly required). This is common, especially when PKCS8 is used as the privatekey portion of PKCS12/PFX, though not universal.

Since most systems today need to support multiple algorithms, and wish to be able to adapt to new algorithms as they are developed, PKCS8 is preferred for privatekeys, and a similar any-algorithm scheme defined by X.509 for publickeys. Although PKCS12/PFX is often preferred to both.

Neither of these has anything to do with certificates or other PKI objects like CSRs, CRLs, OCSP, SCTs, etc. Those are defined by other standards, including some other members of the PKCS series -- although they may use the keys defined by these standards.

PEM format as Luke said is a way of formatting, or (super)encoding, (almost any) binary/DER data in a way that is more convenient. It derives from a 1990s attempt at secure email named Privacy-Enhanced Mail hence PEM. In those days email systems often could transmit, or at least reliably transmit, only printable text with a limited character set, and often only limited line length, so PEM encoded binary data as base64 with line length 64. The PEM scheme itself was not very successful and has been superseded by others like PGP and S/MIME, but the format it defined is still used. Nowadays email systems often can transmit binary data, but as Luke said copy-and-paste often can only handle displayed characters so PEM is still useful, and in addition easier for humans to recognize.

To be more exact, PEM encodes some data, such as but not limited to a PKCS1 or PKCS8 key or a certificate, CSR, etc, as:

a line consisting of 5 hyphens, the word BEGIN, one or a few (space-separated) words defining the type of data, and 5 hyphens
an optional (and rare) rfc822-style header, terminated by an empty line
base64 of the data, broken into lines of 64 characters (except the last); some programs instead use the (slightly newer) MIME limit of 76 characters
a line like the BEGIN line but with END instead

Some readers check/enforce the line length and END line and some don't, so if you get those wrong you may create files that sometimes work and sometimes don't, which is annoying to debug.

Thus for example a PKCS1 private key (unencrypted) in PEM looks like:

The same key in PKCS8 unencrypted:

and PKCS8 encrypted:

Observe the type of data in each file (or other data unit) is easily recognized from the BEGIN/END lines. The actual key values in the data are not easily read without tools, although only the third actually needs secret information (the password used to encrypt).

Subjective answered 24/2, 2018 at 7:6 Comment(3)

In the PKCS8 ENCRYPTED PRIVATE KEY I have read that it is generally AES-256-CBC encrypted. Where is the IV located ? I ask as I have an encrypted key i need to decrypt programmatically. – Commissure 20/2, 2021 at 2:55

@DevilCode: the (outer) structures for PKCS8 are defined in the RFC I linked, with the encrypted form normally using PKCS5 defined in rfc2898 with parameter syntaxes in appendix A. For PBES1 schemes the IV is derived along with the key by PBKDF1; some PBES2 schemes are in appendix B.2, and the one you used (aes-256-cbc) is an obvious extension thereof. But you don't actually need the IV because either JDK or Bouncy handles it for you as I explained on your previous Q stackoverflow.com/questions/66286457 – Subjective 21/2, 2021 at 4:42

@PatS: no -- unless aliens are taking over my body while I'm asleep. – Subjective 19/3, 2023 at 3:37

B

41

PKCS#1 and PKCS#8 (Public-Key Cryptography Standard) are standards that govern the use of particular cryptographic primitives, padding, etc. Both define file formats that are used to store keys, certificates, and other relevant information.

PEM (Privacy-Enhanced Mail) and DER (Distinguished Encoding Rules) are a little bit more interesting. DER is the ASN.1 encoding for keys and certificates etc., which you'll be able to Google plenty about. Private keys and certificates are encoded using DER and can be saved directly like this. However, these files are binary and can't be copied and pasted easily, so many (if not most?) implementations accept PEM encoded files also. PEM is basically base64 encoded DER: we add a header, optional meta-data, and the base64 encoded DER data and we have a PEM file.

Berkelium answered 24/2, 2018 at 1:27 Comment(1)

“which you'll be able to Google plenty about” is my favorite phrase to find in the accepted answer to a StackOverflow question that's now a top Google result – Grosso 6/5, 2021 at 10:42

Recommended topics

Hot tags