This might be obvious to some, but I wonder, if I generated 8192 key in size with:

ssh-keygen -t rsa -b 8192

How can the, encrypted with AES, and BASE64 encoded, SSH private key, have size smaller than specified 8192?

It has a size of 6446.

Is there some compression involved?

2 Answers 2


An 8192 rsa key is 8192 bits, not bytes. That is 1024 bytes.

Encoding bytes in BASE64 increase its size in a factor of 4/3:

$ echo $((1024*8/6))

Which is close to the size of the key inside the public key file.

$ awk '{print $2}' rsatest.pub | wc -c

Of course, the "private key file" contains (at least):

  1. the value of m (public modulus)
  2. the value of e
  3. the value of d
  4. the value of p
  5. the value of q

And, in fact, it contains 8 (big and small) numbers:

cat rsatest | grep -v -- ----- | tr -d '\n' | base64 -d | openssl asn1parse -inform DER

That increase the size in a factor of at least 4, it contains 6363 bytes.

Some other way to look inside the private file is:

openssl rsa -text -in rsatest

Which shows that what the file contains are integers for

  • modulus
  • publicExponent
  • privateExponent
  • prime1
  • prime2
  • exponent1
  • exponent2
  • coefficient
  • openssl asn1parse by itself strips PEM(ish) header and trailer and un-base64's by default, but neither it nor your form works for OpenSSL's encrypted 'traditional' (non-PKCS8) privatekey format which is what ssh-keygen writes (by default except ed25519) when encrypting as Q stated. For that use openssl rsa -text or openssl pkey -text. Feb 6, 2018 at 5:36

RSA key lengths are specified in bits, not bytes. Your bit RSA key has a modulus of length 8192 bits, i.e. 1024 bytes.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .