What encoding is used for the keys when using `ssh-keygen -t rsa`?
When I run:
ssh-keygen -t rsa
to generate a public/private key pair in files e.g. id_rsa.pub and id_rsa, my understanding is that the public key encodes a prime number p, and the private key encodes a number pq. But when I open these files I don't see human-readable numbers, I see sequences of characters. So my question is simply: what am I looking at? Are these characters directly mappable to numbers and, if so, by what convention/algorithm/encoding?
ssl openssh
asked yesterday
Anastasius Vivaldus
204
New contributor
Anastasius Vivaldus is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
When I run:
ssh-keygen -t rsa
to generate a public/private key pair in files e.g. id_rsa.pub and id_rsa, my understanding is that the public key encodes a prime number p, and the private key encodes a number pq. But when I open these files I don't see human-readable numbers, I see sequences of characters. So my question is simply: what am I looking at? Are these characters directly mappable to numbers and, if so, by what convention/algorithm/encoding?
ssl openssh
asked yesterday
Anastasius Vivaldus
204
New contributor
Anastasius Vivaldus is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
1
An RSA keypair generates two primes (p and q) and their product n = pq. The public key consists of n and e, the public exponent; the private key must include n and d, the private exponent, but in practice also include p, q, and several additional numbers. See en.wikipedia.org/wiki/RSA_%28cryptosystem%29#Key_generation .
– dave_thompson_085
yesterday
Computers only store numbers as ASCII digits if humans need to read them, otherwise more space efficient methods are available. The Base64 is a mapping onto visible ASCII characters so they could go through any kind of ASCII-based (7-bit) mail system without being distorted.
– Thorbjørn Ravn Andersen
yesterday
add a comment |
When I run:
ssh-keygen -t rsa
to generate a public/private key pair in files e.g. id_rsa.pub and id_rsa, my understanding is that the public key encodes a prime number p, and the private key encodes a number pq. But when I open these files I don't see human-readable numbers, I see sequences of characters. So my question is simply: what am I looking at? Are these characters directly mappable to numbers and, if so, by what convention/algorithm/encoding?
ssl openssh
asked yesterday
Anastasius Vivaldus
204
New contributor
Anastasius Vivaldus is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
When I run:
ssh-keygen -t rsa
to generate a public/private key pair in files e.g. id_rsa.pub and id_rsa, my understanding is that the public key encodes a prime number p, and the private key encodes a number pq. But when I open these files I don't see human-readable numbers, I see sequences of characters. So my question is simply: what am I looking at? Are these characters directly mappable to numbers and, if so, by what convention/algorithm/encoding?
ssl openssh
ssl openssh
asked yesterday
Anastasius Vivaldus
204
New contributor
Anastasius Vivaldus is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked yesterday
Anastasius Vivaldus
204
New contributor
Anastasius Vivaldus is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked yesterday
Anastasius Vivaldus
204
New contributor
Anastasius Vivaldus is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked yesterday
Anastasius Vivaldus
204
asked yesterday
Anastasius Vivaldus
204
204
New contributor
Anastasius Vivaldus is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
Anastasius Vivaldus is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Anastasius Vivaldus is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
1
An RSA keypair generates two primes (p and q) and their product n = pq. The public key consists of n and e, the public exponent; the private key must include n and d, the private exponent, but in practice also include p, q, and several additional numbers. See en.wikipedia.org/wiki/RSA_%28cryptosystem%29#Key_generation .
– dave_thompson_085
yesterday
Computers only store numbers as ASCII digits if humans need to read them, otherwise more space efficient methods are available. The Base64 is a mapping onto visible ASCII characters so they could go through any kind of ASCII-based (7-bit) mail system without being distorted.
– Thorbjørn Ravn Andersen
yesterday
add a comment |
1
An RSA keypair generates two primes (p and q) and their product n = pq. The public key consists of n and e, the public exponent; the private key must include n and d, the private exponent, but in practice also include p, q, and several additional numbers. See en.wikipedia.org/wiki/RSA_%28cryptosystem%29#Key_generation .
– dave_thompson_085
yesterday
Computers only store numbers as ASCII digits if humans need to read them, otherwise more space efficient methods are available. The Base64 is a mapping onto visible ASCII characters so they could go through any kind of ASCII-based (7-bit) mail system without being distorted.
– Thorbjørn Ravn Andersen
yesterday
1
1
An RSA keypair generates two primes (p and q) and their product n = pq. The public key consists of n and e, the public exponent; the private key must include n and d, the private exponent, but in practice also include p, q, and several additional numbers. See en.wikipedia.org/wiki/RSA_%28cryptosystem%29#Key_generation .
– dave_thompson_085
yesterday
An RSA keypair generates two primes (p and q) and their product n = pq. The public key consists of n and e, the public exponent; the private key must include n and d, the private exponent, but in practice also include p, q, and several additional numbers. See en.wikipedia.org/wiki/RSA_%28cryptosystem%29#Key_generation .
– dave_thompson_085
yesterday
Computers only store numbers as ASCII digits if humans need to read them, otherwise more space efficient methods are available. The Base64 is a mapping onto visible ASCII characters so they could go through any kind of ASCII-based (7-bit) mail system without being distorted.
– Thorbjørn Ravn Andersen
yesterday
Computers only store numbers as ASCII digits if humans need to read them, otherwise more space efficient methods are available. The Base64 is a mapping onto visible ASCII characters so they could go through any kind of ASCII-based (7-bit) mail system without being distorted.
– Thorbjørn Ravn Andersen
yesterday
add a comment |
1 Answer
1
active
oldest
votes
The ssh and ssl keys (private and public) are usually stored in so named PEM format.
Privacy-Enhanced Mail (PEM) is a de facto file format for storing and
sending cryptographic keys, certificates, and other data, based on a
set of 1993 IETF standards defining "privacy-enhanced mail." While the
original standards were never broadly adopted, and were supplanted by
PGP and S/MIME, the textual encoding they defined became very popular.
The PEM format was eventually formalized by the IETF in RFC 7468.
This format is actually header, then base64 encoded binary data and footer.
Base64 is a group of similar binary-to-text encoding schemes that
represent binary data in an ASCII string format by translating it into
a radix-64 representation. The term Base64 originates from a specific
MIME content transfer encoding. Each Base64 digit represents exactly 6
bits of data. Three 8-bit bytes (i.e., a total of 24 bits) can
therefore be represented by four 6-bit Base64 digits.
answered yesterday
Romeo Ninov
5,27731827
1
Note ssh-keygen uses (several) PEM formats but never the one(s) in 7468. In the past for RSA it defaulted to OpenSSL's two 'traditional' (aka 'legacy') formats, either unencrypted whcih is 7468-like except containing PKCS1, or password-encrypted which is1421-like with Proc-type and DEK-Info and base64 of encrypted PKCS1, but not 7468-like. Since 7.8 it defaults to OpenSSH's own 'new format' (previously invoked by option-o) which is 7468-like but the contents are entirely different (XDR-style not ASN.1). There are numerous Qs about these already on several Stacks.
– dave_thompson_085
yesterday
@dave_thompson_085, thank you for clarification. May I quote you comment in my answer?
– Romeo Ninov
yesterday
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Anastasius Vivaldus is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f492704%2fwhat-encoding-is-used-for-the-keys-when-using-ssh-keygen-t-rsa%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
The ssh and ssl keys (private and public) are usually stored in so named PEM format.
Privacy-Enhanced Mail (PEM) is a de facto file format for storing and
sending cryptographic keys, certificates, and other data, based on a
set of 1993 IETF standards defining "privacy-enhanced mail." While the
original standards were never broadly adopted, and were supplanted by
PGP and S/MIME, the textual encoding they defined became very popular.
The PEM format was eventually formalized by the IETF in RFC 7468.
This format is actually header, then base64 encoded binary data and footer.
Base64 is a group of similar binary-to-text encoding schemes that
represent binary data in an ASCII string format by translating it into
a radix-64 representation. The term Base64 originates from a specific
MIME content transfer encoding. Each Base64 digit represents exactly 6
bits of data. Three 8-bit bytes (i.e., a total of 24 bits) can
therefore be represented by four 6-bit Base64 digits.
answered yesterday
Romeo Ninov
5,27731827
1
Note ssh-keygen uses (several) PEM formats but never the one(s) in 7468. In the past for RSA it defaulted to OpenSSL's two 'traditional' (aka 'legacy') formats, either unencrypted whcih is 7468-like except containing PKCS1, or password-encrypted which is1421-like with Proc-type and DEK-Info and base64 of encrypted PKCS1, but not 7468-like. Since 7.8 it defaults to OpenSSH's own 'new format' (previously invoked by option-o) which is 7468-like but the contents are entirely different (XDR-style not ASN.1). There are numerous Qs about these already on several Stacks.
– dave_thompson_085
yesterday
@dave_thompson_085, thank you for clarification. May I quote you comment in my answer?
– Romeo Ninov
yesterday
add a comment |
The ssh and ssl keys (private and public) are usually stored in so named PEM format.
Privacy-Enhanced Mail (PEM) is a de facto file format for storing and
sending cryptographic keys, certificates, and other data, based on a
set of 1993 IETF standards defining "privacy-enhanced mail." While the
original standards were never broadly adopted, and were supplanted by
PGP and S/MIME, the textual encoding they defined became very popular.
The PEM format was eventually formalized by the IETF in RFC 7468.
This format is actually header, then base64 encoded binary data and footer.
Base64 is a group of similar binary-to-text encoding schemes that
represent binary data in an ASCII string format by translating it into
a radix-64 representation. The term Base64 originates from a specific
MIME content transfer encoding. Each Base64 digit represents exactly 6
bits of data. Three 8-bit bytes (i.e., a total of 24 bits) can
therefore be represented by four 6-bit Base64 digits.
answered yesterday
Romeo Ninov
5,27731827
1
Note ssh-keygen uses (several) PEM formats but never the one(s) in 7468. In the past for RSA it defaulted to OpenSSL's two 'traditional' (aka 'legacy') formats, either unencrypted whcih is 7468-like except containing PKCS1, or password-encrypted which is1421-like with Proc-type and DEK-Info and base64 of encrypted PKCS1, but not 7468-like. Since 7.8 it defaults to OpenSSH's own 'new format' (previously invoked by option-o) which is 7468-like but the contents are entirely different (XDR-style not ASN.1). There are numerous Qs about these already on several Stacks.
– dave_thompson_085
yesterday
@dave_thompson_085, thank you for clarification. May I quote you comment in my answer?
– Romeo Ninov
yesterday
add a comment |
The ssh and ssl keys (private and public) are usually stored in so named PEM format.
Privacy-Enhanced Mail (PEM) is a de facto file format for storing and
sending cryptographic keys, certificates, and other data, based on a
set of 1993 IETF standards defining "privacy-enhanced mail." While the
original standards were never broadly adopted, and were supplanted by
PGP and S/MIME, the textual encoding they defined became very popular.
The PEM format was eventually formalized by the IETF in RFC 7468.
This format is actually header, then base64 encoded binary data and footer.
Base64 is a group of similar binary-to-text encoding schemes that
represent binary data in an ASCII string format by translating it into
a radix-64 representation. The term Base64 originates from a specific
MIME content transfer encoding. Each Base64 digit represents exactly 6
bits of data. Three 8-bit bytes (i.e., a total of 24 bits) can
therefore be represented by four 6-bit Base64 digits.
answered yesterday
Romeo Ninov
5,27731827
The ssh and ssl keys (private and public) are usually stored in so named PEM format.
Privacy-Enhanced Mail (PEM) is a de facto file format for storing and
sending cryptographic keys, certificates, and other data, based on a
set of 1993 IETF standards defining "privacy-enhanced mail." While the
original standards were never broadly adopted, and were supplanted by
PGP and S/MIME, the textual encoding they defined became very popular.
The PEM format was eventually formalized by the IETF in RFC 7468.
This format is actually header, then base64 encoded binary data and footer.
Base64 is a group of similar binary-to-text encoding schemes that
represent binary data in an ASCII string format by translating it into
a radix-64 representation. The term Base64 originates from a specific
MIME content transfer encoding. Each Base64 digit represents exactly 6
bits of data. Three 8-bit bytes (i.e., a total of 24 bits) can
therefore be represented by four 6-bit Base64 digits.
answered yesterday
Romeo Ninov
5,27731827
answered yesterday
Romeo Ninov
5,27731827
answered yesterday
Romeo Ninov
5,27731827
answered yesterday
Romeo Ninov
5,27731827
5,27731827
1
Note ssh-keygen uses (several) PEM formats but never the one(s) in 7468. In the past for RSA it defaulted to OpenSSL's two 'traditional' (aka 'legacy') formats, either unencrypted whcih is 7468-like except containing PKCS1, or password-encrypted which is1421-like with Proc-type and DEK-Info and base64 of encrypted PKCS1, but not 7468-like. Since 7.8 it defaults to OpenSSH's own 'new format' (previously invoked by option-o) which is 7468-like but the contents are entirely different (XDR-style not ASN.1). There are numerous Qs about these already on several Stacks.
– dave_thompson_085
yesterday
@dave_thompson_085, thank you for clarification. May I quote you comment in my answer?
– Romeo Ninov
yesterday
add a comment |
1
Note ssh-keygen uses (several) PEM formats but never the one(s) in 7468. In the past for RSA it defaulted to OpenSSL's two 'traditional' (aka 'legacy') formats, either unencrypted whcih is 7468-like except containing PKCS1, or password-encrypted which is1421-like with Proc-type and DEK-Info and base64 of encrypted PKCS1, but not 7468-like. Since 7.8 it defaults to OpenSSH's own 'new format' (previously invoked by option-o) which is 7468-like but the contents are entirely different (XDR-style not ASN.1). There are numerous Qs about these already on several Stacks.
– dave_thompson_085
yesterday
@dave_thompson_085, thank you for clarification. May I quote you comment in my answer?
– Romeo Ninov
yesterday
1
1
Note ssh-keygen uses (several) PEM formats but never the one(s) in 7468. In the past for RSA it defaulted to OpenSSL's two 'traditional' (aka 'legacy') formats, either unencrypted whcih is 7468-like except containing PKCS1, or password-encrypted which is1421-like with Proc-type and DEK-Info and base64 of encrypted PKCS1, but not 7468-like. Since 7.8 it defaults to OpenSSH's own 'new format' (previously invoked by option
-o) which is 7468-like but the contents are entirely different (XDR-style not ASN.1). There are numerous Qs about these already on several Stacks.– dave_thompson_085
yesterday
Note ssh-keygen uses (several) PEM formats but never the one(s) in 7468. In the past for RSA it defaulted to OpenSSL's two 'traditional' (aka 'legacy') formats, either unencrypted whcih is 7468-like except containing PKCS1, or password-encrypted which is1421-like with Proc-type and DEK-Info and base64 of encrypted PKCS1, but not 7468-like. Since 7.8 it defaults to OpenSSH's own 'new format' (previously invoked by option
-o) which is 7468-like but the contents are entirely different (XDR-style not ASN.1). There are numerous Qs about these already on several Stacks.– dave_thompson_085
yesterday
@dave_thompson_085, thank you for clarification. May I quote you comment in my answer?
– Romeo Ninov
yesterday
@dave_thompson_085, thank you for clarification. May I quote you comment in my answer?
– Romeo Ninov
yesterday
add a comment |
Anastasius Vivaldus is a new contributor. Be nice, and check out our Code of Conduct.
Anastasius Vivaldus is a new contributor. Be nice, and check out our Code of Conduct.
Anastasius Vivaldus is a new contributor. Be nice, and check out our Code of Conduct.
Anastasius Vivaldus is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f492704%2fwhat-encoding-is-used-for-the-keys-when-using-ssh-keygen-t-rsa%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
An RSA keypair generates two primes (p and q) and their product n = pq. The public key consists of n and e, the public exponent; the private key must include n and d, the private exponent, but in practice also include p, q, and several additional numbers. See en.wikipedia.org/wiki/RSA_%28cryptosystem%29#Key_generation .
– dave_thompson_085
yesterday
Computers only store numbers as ASCII digits if humans need to read them, otherwise more space efficient methods are available. The Base64 is a mapping onto visible ASCII characters so they could go through any kind of ASCII-based (7-bit) mail system without being distorted.
– Thorbjørn Ravn Andersen
yesterday