Skip to content
ecdsa.com

PKCS #8

The algorithm-agnostic private key container (PrivateKeyInfo, RFC 5208; OneAsymmetricKey, RFC 5958) stored in PEM as -----BEGIN PRIVATE KEY----- or, password-protected, -----BEGIN ENCRYPTED PRIVATE KEY-----.
Also written asPKCS#8PrivateKeyInfoBEGIN PRIVATE KEYOneAsymmetricKey

PrivateKeyInfo is a SEQUENCE of a version, the privateKeyAlgorithm (an AlgorithmIdentifier), the privateKey OCTET STRING and optional attributes; the octet string holds the algorithm-specific key (a PKCS #1 RSAPrivateKey, a SEC 1 ECPrivateKey, a 32-byte Ed25519 seed wrapped per RFC 8410, an ML-DSA seed or expanded key). RFC 5958 version 2 adds an optional public key.

EncryptedPrivateKeyInfo wraps it with password-based encryption, today PBES2 (RFC 8018). OpenSSL 3.6 writes PBES2 with PBKDF2-HMAC-SHA256 and AES-256-CBC when asked to encrypt; older keys may use PBES1 with DES or RC2, which modern libraries refuse.

Because it names the algorithm, PKCS #8 is the format most libraries expect: OpenSSL 3 writes it by default, Java's PKCS8EncodedKeySpec, Go's x509.ParsePKCS8PrivateKey, Node's createPrivateKey and WebCrypto's pkcs8 import all use it. Convert other formats with openssl pkcs8 -topk8 -nocrypt or openssl pkey.

Standards and references

All terms