How to export a public key as PEM in Rust

1[dependencies]
2p256 = { version = "=0.14.0", features = ["pem"] }
3 

1use p256::SecretKey;
2use p256::pkcs8::{DecodePrivateKey, EncodePublicKey, LineEnding};
3 
4fn main() -> Result<(), Box<dyn std::error::Error>> {
5    let pem = std::fs::read_to_string(std::env::args().nth(1).unwrap_or("key.pem".into()))?;
6    // "BEGIN PRIVATE KEY" is PKCS#8; legacy "BEGIN EC PRIVATE KEY" is SEC 1
7    let secret = if pem.contains("BEGIN EC PRIVATE KEY") {
8        SecretKey::from_sec1_pem(&pem)?
9    } else {
10        SecretKey::from_pkcs8_pem(&pem)?
11    };
12 
13    let public_pem = secret.public_key().to_public_key_pem(LineEnding::LF)?; // SPKI
14    std::fs::write("pub.pem", &public_pem)?;
15    print!("{public_pem}");
16    Ok(())
17}
18 

How it works

1. SecretKey::from_pkcs8_pem reads BEGIN PRIVATE KEY and SecretKey::from_sec1_pem reads BEGIN EC PRIVATE KEY; the PEM label decides which one applies.
2. public_key() computes Q = d·G on P-256 — EC public keys are always derivable from the private scalar, whether or not the file stored the point.
3. to_public_key_pem (trait EncodePublicKey) writes the SPKI with the curve OID, at 64 columns with the line ending you choose; to_public_key_der gives the same structure as bytes.
4. The run compares the output byte for byte with openssl pkey -pubout and checks that the SEC 1 file yields the identical PEM.

Gotchas

• The key type is per curve: p256::SecretKey rejects a P-384 key with a decoding error. For keys of unknown curve, inspect the algorithm OID first (for example with the pkcs8 crate's PrivateKeyInfo) and dispatch to p384, p521 or k256.
• from_pkcs8_pem on a SEC 1 file (and vice versa) fails with a PEM label error rather than guessing — check the label, as above, instead of trying both blindly.
• Encrypted keys (BEGIN ENCRYPTED PRIVATE KEY) need the encryption feature of pkcs8 and from_pkcs8_encrypted_pem; the plain loaders refuse them.
• ring cannot export a public key as SPKI: public_key().as_ref() is the bare 65-byte point. Wrap it in SPKI with the spki crate or use RustCrypto types for anything that must be read by other tools.

Related recipes

• How to generate an ECDSA key pair in Rust
• How to compute a public key fingerprint in Rust
• How to export a public key as PEM in Go
• How to export a public key as PEM with OpenSSL