I realize this is rudimentary question, but I can't seem to even google diagnose it. Why is openssl key length different from specified bytes? For example when I use the command:

openssl genrsa -out testKey 512

I produce a key within my testKey file with the message, "Generating RSA private key, 512 bit long modulus". However when I check the length of just the key portion within the file, it is only 424 characters long.

Why is that, and why is it not actually 512 characters long?

Is there a way to generate a RSA key via openssl with a specific length in mind, such as 512 characters? I realize that my misunderstanding may stem from my lack of knowledge of what the above command is actually doing, but I just need a push in the right direction.

  • 1
    A bit is different than a byte. A character (in some cases) can be represented by a byte. So you shouldn't see 512 characters.
    – VenomFangs
    Oct 12 '15 at 18:41

You are generating an RSA private key with a 512 modulus. However, RSA needs quite some more elements to work (the wikipedia article is quite good here). Since this is not a question regarding RSA, I will not go into details and instead give you the command you are looking for.

In order to process the RSA private key and see what all is contained in this data, run the following command:

openssl rsa -noout -text -in testKey

The first block is your 512 bit private modulus.


Key lengths for ciphers are generally expressed in bits, not in bytes. 8 bits = 1 byte. Therefore what you actually would expect to see is a key of 512 bits = 64 bytes, so why didn't you?

First: the format. The output file of your command is a PEM file, which means it's a Base64-encoded DER encoded data structure where the Base64 data is enclosed in these -----BEGIN … ----- and -----END … ----- lines. Base64 is an encoding that outputs 4 characters for every 3 input bytes. So your 424 characters after Base64 encoding were 318 bytes (=2544 bits) before encoding. But that still isn't 64 bytes, is it?

Second: Additional data. When you request a key with a size of 512 bits, what you're requesting is a key whose public modulus has a size of 512 bits. But an RSA key public key consists of this public modulus and the public exponent. The latter usually is rather small, in your example it was 17 bits (stored as 3 bytes). What else?

Third: The private key. Then genrsa command actually generates an RSA key pair consisting of private and public key. There's no command to just generate a public key, since that would be useless. Instead, by convention, when storing the private key you're also storing the public key, since it's just one additional value anyway. Normally the private key would be of roughly the same size as the public exponent, so we've still not quite explained your file size. That is because openssl uses an optimization based on the Chinese remainder theorem and for this it needs to store three additional values with the private key.

How can you see all this for yourself?

  • openssl base64 -d -in testKey -out testKey.raw will decode the base64 encoding and output the raw data. This has a size of 318 bytes.
  • openssl asn1parse -in testKey (or alternatively: openssl asn1parse -in testKey.raw -inform der to tell it to not expect PEM but raw DER) will generically parse the ASN.1 DER encoding and show you the individual fields.
  • openssl rsa -in testKey -text -noout will parse the file as an RSA key and give you an interpretation of all the fields, i.e. their values.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.