How can the, encrypted with AES, and BASE64 encoded, SSH private key, have size smaller than specified?

Question

This might be obvious to some, but I wonder, if I generated 8192 key in size with:

ssh-keygen -t rsa -b 8192

How can the, encrypted with AES, and BASE64 encoded, SSH private key, have size smaller than specified 8192?

It has a size of 6446.

Is there some compression involved?

score 2 · Accepted Answer · 2018-02-06 23:45:01Z

An 8192 rsa key is 8192 bits, not bytes. That is 1024 bytes.

Encoding bytes in BASE64 increase its size in a factor of 4/3:

$ echo $((1024*8/6))
1365

Which is close to the size of the key inside the public key file.

$ awk '{print $2}' rsatest.pub | wc -c
1397

Of course, the "private key file" contains (at least):

And, in fact, it contains 8 (big and small) numbers:

cat rsatest | grep -v -- ----- | tr -d '\n' | base64 -d | openssl asn1parse -inform DER

That increase the size in a factor of at least 4, it contains 6363 bytes.

Some other way to look inside the private file is:

openssl rsa -text -in rsatest

Which shows that what the file contains are integers for

openssl asn1parse by itself strips PEM(ish) header and trailer and un-base64's by default, but neither it nor your form works for OpenSSL's encrypted 'traditional' (non-PKCS8) privatekey format which is what ssh-keygen writes (by default except ed25519) when encrypting as Q stated. For that use openssl rsa -text or openssl pkey -text. — dave_thompson_085, Feb 6, 2018 at 5:36

Johan Myréen · Accepted Answer · 2018-02-05 19:36:15Z

2

RSA key lengths are specified in bits, not bytes. Your bit RSA key has a modulus of length 8192 bits, i.e. 1024 bytes.

answered Feb 5, 2018 at 19:36

Johan Myréen

13k1 gold badge32 silver badges34 bronze badges

Add a comment |

2 Answers 2