Return to Answer

The formatting is the actual difference.

The first command outputs keys in "PEM" or "PKCS#1" format. The text header identifies the key type as RSA, and if it's encrypted then there's a sub-header for the cipher parameters (algorithm and IV). The actual data inside is a flat array of numbers (n, e, d, p, q) and if it weren't for the surrounding text, you'd have to guess it was an RSA key.

The second command outputs keys in "PKCS#7" format. Here the same meta-information has been moved inside the binary data: those RSA parameters are now nested inside another array together with an OID indicating this is indeed an RSA key. If encrypted, then the cipher parameters are stored inside as well.

But both formats are similar in that they use ASN.1 DER for structuring the binary data – this means you can see the difference if you pipe both keys through openssl asn1parse -i or upload them to this nice decoder.

You can pipe a key through openssl pkey to convert it between formats.

Note that results of some commands may depend on OpenSSL version. Over time, various subcommands which previously output keys in PKCS#1 format have switched over to producing PKCS#7 by default.

The formatting is the actual difference.

The first command outputs keys in "PEM" or "PKCS#1" format. The text header identifies the key type as RSA, and if it's encrypted then there's a sub-header for the cipher parameters (algorithm and IV). The actual data inside is a flat array of numbers (n, e, d, p, q) and if it weren't for the surrounding text, you'd have to guess it was an RSA key.

The second command outputs keys in "PKCS#8" format. Here the same meta-information has been moved inside the binary data: those RSA parameters are now nested inside another array together with an OID indicating this is indeed an RSA key. If encrypted, then the cipher parameters are stored inside as well.

But both formats are similar in that they use ASN.1 DER for structuring the binary data – this means you can see the difference if you pipe both keys through openssl asn1parse -i or upload them to this nice decoder.

You can pipe a key through openssl pkey to convert it between formats.

Note that results of some commands may depend on OpenSSL version. Over time, various subcommands which previously output keys in PKCS#1 format have switched over to producing PKCS#8 by default.

The formatting is the actual difference.

The first command outputs keys in "PEM" or "PKCS#1" format. The text header identifies the key type as RSA, and if it's encrypted then there's a sub-header for the cipher parameters (algorithm and IV). The actual data inside is a flat array of numbers (n, e, d, p, q).

The second command outputs keys in "PKCS#7" format. Here the same meta-information has been moved inside the binary data: those RSA parameters are now nested inside another array together with an OID indicating this is indeed an RSA key. If encrypted, then the cipher parameters are stored inside as well.

But both formats are similar in that they use ASN.1 DER for structuring the binary data – this means you can see the difference if you pipe both keys through openssl asn1parse -i or upload them to this nice decoder.

You can pipe a key through openssl pkey to convert it between formats.

Note that results of some commands may depend on OpenSSL version. Over time, various subcommands which previously output keys in PKCS#1 format have switched over to producing PKCS#7 by default.

The formatting is the actual difference.

The first command outputs keys in "PEM" or "PKCS#1" format. The text header identifies the key type as RSA, and if it's encrypted then there's a sub-header for the cipher parameters (algorithm and IV). The actual data inside is a flat array of numbers (n, e, d, p, q) and if it weren't for the surrounding text, you'd have to guess it was an RSA key.

The second command outputs keys in "PKCS#7" format. Here the same meta-information has been moved inside the binary data: those RSA parameters are now nested inside another array together with an OID indicating this is indeed an RSA key. If encrypted, then the cipher parameters are stored inside as well.

But both formats are similar in that they use ASN.1 DER for structuring the binary data – this means you can see the difference if you pipe both keys through openssl asn1parse -i or upload them to this nice decoder.

You can pipe a key through openssl pkey to convert it between formats.

Note that results of some commands may depend on OpenSSL version. Over time, various subcommands which previously output keys in PKCS#1 format have switched over to producing PKCS#7 by default.

The first command outputs keys in "PEM" or "PKCS#1" format. The text header identifies the key type as RSA, and if it's encrypted then there's a sub-header for the cipher parameters (algorithm and IV). The actual data inside is a flat array of numbers (n, e, d, p, q).

The second command outputs keys in "PKCS#7" format. Here the same meta-information has been moved inside the binary data: those RSA parameters are now nested inside another array together with an OID indicating this is indeed an RSA key. If encrypted, then the cipher parameters are stored inside as well.

You can see the difference if you pipe both keys through openssl asn1parse -i or upload them to this nice decoder, and you can pipe a key through openssl pkey to convert it between formats.

This may depend on OpenSSL version. Over time, various subcommands which previously output keys in PKCS#1 format have switched over to PKCS#7

The formatting is the actual difference.

The first command outputs keys in "PEM" or "PKCS#1" format. The text header identifies the key type as RSA, and if it's encrypted then there's a sub-header for the cipher parameters (algorithm and IV). The actual data inside is a flat array of numbers (n, e, d, p, q).

The second command outputs keys in "PKCS#7" format. Here the same meta-information has been moved inside the binary data: those RSA parameters are now nested inside another array together with an OID indicating this is indeed an RSA key. If encrypted, then the cipher parameters are stored inside as well.

But both formats are similar in that they use ASN.1 DER for structuring the binary data – this means you can see the difference if you pipe both keys through openssl asn1parse -i or upload them to this nice decoder.

You can pipe a key through openssl pkey to convert it between formats.

Note that results of some commands may depend on OpenSSL version. Over time, various subcommands which previously output keys in PKCS#1 format have switched over to producing PKCS#7 by default.