This might be obvious to some, but I wonder, if I generated 8192 key in size with:

ssh-keygen -t rsa -b 8192

How can the, encrypted with AES, and BASE64 encoded, SSH private key, have size smaller than specified 8192?

It has a size of 6446.

Is there some compression involved?


An 8192 rsa key is 8192 bits, not bytes. That is 1024 bytes.

Encoding bytes in BASE64 increase its size in a factor of 4/3:

$ echo $((1024*8/6))

Which is close to the size of the key inside the public key file.

$ awk '{print $2}' rsatest.pub | wc -c

Of course, the "private key file" contains (at least):

  1. the value of m (public modulus)
  2. the value of e
  3. the value of d
  4. the value of p
  5. the value of q

And, in fact, it contains 8 (big and small) numbers:

cat rsatest | grep -v -- ----- | tr -d '\n' | base64 -d | openssl asn1parse -inform DER

That increase the size in a factor of at least 4, it contains 6363 bytes.

Some other way to look inside the private file is:

openssl rsa -text -in rsatest

Which shows that what the file contains are integers for

  • modulus
  • publicExponent
  • privateExponent
  • prime1
  • prime2
  • exponent1
  • exponent2
  • coefficient
  • openssl asn1parse by itself strips PEM(ish) header and trailer and un-base64's by default, but neither it nor your form works for OpenSSL's encrypted 'traditional' (non-PKCS8) privatekey format which is what ssh-keygen writes (by default except ed25519) when encrypting as Q stated. For that use openssl rsa -text or openssl pkey -text. – dave_thompson_085 Feb 6 '18 at 5:36

RSA key lengths are specified in bits, not bytes. Your bit RSA key has a modulus of length 8192 bits, i.e. 1024 bytes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.