Skip to content
ecdsa.com

PKCS #1 key format

The RSA-only ASN.1 structures RSAPublicKey and RSAPrivateKey from RFC 8017 Appendix A, stored in PEM as -----BEGIN RSA PUBLIC KEY----- and -----BEGIN RSA PRIVATE KEY-----.
Also written asRSA PRIVATE KEYRSA PUBLIC KEYRSAPrivateKeytraditional RSA key

RSAPublicKey is just a SEQUENCE of the modulus and the public exponent. RSAPrivateKey holds version, n, e, d, p, q, dP, dQ, qInv and optional extra primes. Neither carries an algorithm identifier, which is why the format can only describe RSA and why the PEM label has to say RSA.

PKCS #8 wraps the same RSAPrivateKey bytes inside a PrivateKeyInfo with an algorithm OID (rsaEncryption, 1.2.840.113549.1.1.1), and SubjectPublicKeyInfo wraps RSAPublicKey the same way for public keys. OpenSSL 3 writes PKCS #8 (BEGIN PRIVATE KEY) by default, including from openssl rsa; -traditional gives PKCS #1. Java's PKCS8EncodedKeySpec and many JWT libraries accept only PKCS #8 or SPKI, which causes the familiar error with old id_rsa-style keys.

Do not confuse the key format with PKCS #1 signature or encryption paddings: RFC 8017 defines all three, and only the file format is meant when people say "a PKCS #1 key".

Standards and references

All terms