RFC5958 defines a set of enhancements to the PKCS#8 key serialization format, bumping the version field up to 1 and additionally permitting serialization of public keys for arbitrary asymmetric cryptographic algorithms.

OneAsymmetricKey ::= SEQUENCE {
  version                   Version,
  privateKeyAlgorithm       PrivateKeyAlgorithmIdentifier,
  privateKey                PrivateKey,
  attributes            [0] Attributes OPTIONAL,
  [[2: publicKey        [1] PublicKey OPTIONAL ]],

PrivateKeyInfo ::= OneAsymmetricKey -- Overwriting the definition in RFC5208 which only supports private keys

However, I'm unclear on the following:

  • What belongs in the third field of the OneAsymmetricKey sequence when one is encoding only a public key?

I'm writing an implementation of some current research/experimental cryptographic algorithms, and I'm currently trying to write the serialization and deserialization capabilities.


1 Answer 1


You misunderstand RFC 5958.

OneAsymmetricKey … when one is encoding only a public key?

PKCS#8 remains a private key serialization format. Just because the v2 update lets you bundle a public key alongside the private key for convenience, does not mean it's become a public key serialization format. You can't use OneAsymmetricKey to encode only a public key.

What you should be producing, instead, when you only intend to serialize a public key, is merely and exactly a SubjectPublicKeyInfo object as defined in IETF RFC 5280 (with, of course, any needed ASCII armoring added on top):

AlgorithmIdentifier  ::=  SEQUENCE  {
     algorithm               OBJECT IDENTIFIER,
     parameters              ANY DEFINED BY algorithm OPTIONAL  }

SubjectPublicKeyInfo  ::=  SEQUENCE  {
     algorithm            AlgorithmIdentifier,
     subjectPublicKey     BIT STRING -- DEFINED BY algorithm --  }

This is how all other standardized public cryptographic keys are serialized for transfer in X.509-adjacent contexts. Everything from Ed25519/X25519 and Ed448/X448 to NIST ECC curves uses this SPKI format. (RSA public keys' legacy PKCS#1 encoding is the exception to this, and even those keys may be reserialized into SPKI format.)

  • PKIX publickey encodings for other algorithms are in 3279 (referenced by 3280/5280) plus 4055 4491 5480 5756. (5758 and 8692 add signatures but not keys.) The PKCS1-labelled-PUBLIC-KEY file in #115862 is NOT standard, as both the bear and I explained, and 7468 (as you linked) specifies. May 20, 2021 at 9:00
  • 1
    @dave_thompson_085 Indeed, that BEGIN RSA PUBLIC KEY encoding is more of a de facto "standard" if anything… certainly not to be imitated for future software implementations May 20, 2021 at 10:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .