How to encode a public key in PKCS#8?

Question

RFC5958 defines a set of enhancements to the PKCS#8 key serialization format, bumping the version field up to 1 and additionally permitting serialization of public keys for arbitrary asymmetric cryptographic algorithms.

OneAsymmetricKey ::= SEQUENCE {
  version                   Version,
  privateKeyAlgorithm       PrivateKeyAlgorithmIdentifier,
  privateKey                PrivateKey,
  attributes            [0] Attributes OPTIONAL,
  ...,
  [[2: publicKey        [1] PublicKey OPTIONAL ]],
  ...
}

PrivateKeyInfo ::= OneAsymmetricKey -- Overwriting the definition in RFC5208 which only supports private keys

However, I'm unclear on the following:

• What belongs in the third field of the OneAsymmetricKey sequence when one is encoding only a public key?

---

I'm writing an implementation of some current research/experimental cryptographic algorithms, and I'm currently trying to write the serialization and deserialization capabilities.

Answer 1

You misunderstand RFC 5958.

OneAsymmetricKey … when one is encoding only a public key?

PKCS#8 remains a private key serialization format. Just because the v2 update lets you bundle a public key alongside the private key for convenience, does not mean it's become a public key serialization format. You can't use OneAsymmetricKey to encode only a public key.

What you should be producing, instead, when you only intend to serialize a public key, is merely and exactly a SubjectPublicKeyInfo object as defined in IETF RFC 5280 (with, of course, any needed ASCII armoring added on top):

AlgorithmIdentifier  ::=  SEQUENCE  {
     algorithm               OBJECT IDENTIFIER,
     parameters              ANY DEFINED BY algorithm OPTIONAL  }

SubjectPublicKeyInfo  ::=  SEQUENCE  {
     algorithm            AlgorithmIdentifier,
     subjectPublicKey     BIT STRING -- DEFINED BY algorithm --  }

This is how all other standardized public cryptographic keys are serialized for transfer in X.509-adjacent contexts. Everything from Ed25519/X25519 and Ed448/X448 to NIST ECC curves uses this SPKI format. (RSA public keys' legacy PKCS#1 encoding is the exception to this, and even those keys may be reserialized into SPKI format.)