Do SSH private keys always contain enough information to derive a public key?

Question

I am working on a persistence model for SSH Private keys. The technology used is Java. Since the persistence structure of the public and private keys is pretty similar and using some of the Java APIs like java.security.interfaces.RSAPrivateCrtKey, I am able to derive the public keys.

So this makes me wonder if only persisting the private keys is enough and later derive the public key out of it?

I believe this boils down to few important questions that I like to get an answer for:

1. Is it always the case that I can get information/ metadata required to create a public key from the Private key. e.g. in case of RSA, it seems java API provides modulus and public exponent.
2. Does the information recreated will always be same?
3. If I get an SSH private key as a file, is there a possibility that it does not contain the public key related information.

Answer 1

There are three sides to this question, RSA in general, RSA with SSH and SSH with other cryptosystems.

In RSA the public and private key each notionally consist of two values.

1. The modulus, this is common to both public and private keys.
2. The exponent, there is a seperate public exponent for the public key and private exponent for the private key.

So in theory A RSA private key doesn't have to contain the public key. In practice however.

3. Most practical private key formats contain additional information. They usually include the public exponent because it's actually useful to be able create a public key file from the private key file. They also normally include the raw p and q values and a handful of extra derived values to speed up private key operations.
4. The public key exponent is usually one of a handful of well-known values. On most RSA keys even if you have is the modulus and private exponent it would not be hard to figure out the public exponent by trial and error.

According to http://blog.oddbit.com/2011/05/08/converting-openssh-public-keys/ openssh uses the pkcs#1 private key format. According to https://www.rfc-editor.org/rfc/rfc3447#appendix-A.1.2 this format contains the modulus, the public and private exponents, both primes and a number of other values that are useful for optimising private key operations. Including the public key information does not appear to be optional.

So for RSA you are fine as you have already discovered you can easilly fish the public key parameters out of the private key structure.

For SSH with ECDSA it seems that the public key parameters are not normally stored as part of the private key but can be easilly derived from it. https://stackoverflow.com/questions/12480776/how-do-i-obtain-the-public-key-from-an-ecdsa-private-key-in-openssl

YMMV with other cryptosystems.