So I used puttygen to generate a DSA private key and then exported that to the OpenSSH format and here's what I got when I ran OpenSSL's asn1parse on it:

    0:d=0  hl=4 l= 443 cons: SEQUENCE
    4:d=1  hl=2 l=   1 prim:  INTEGER           :00
    7:d=1  hl=3 l= 129 prim:  INTEGER           :B9916796B7A3EFFD5CA36368186D0ED
  139:d=1  hl=2 l=  21 prim:  INTEGER           :D832F5B01F075FEC0F162B91982F34D
  162:d=1  hl=3 l= 129 prim:  INTEGER           :9B73F47AEFF8E39584FD10ACF81CCD5
  294:d=1  hl=3 l= 128 prim:  INTEGER           :6BD9267D2D1E4546EE05F6CD087F311
  425:d=1  hl=2 l=  20 prim:  INTEGER           :15295A12325E5F1A6F7243B7BB3BE74

My question is... where is this format described? What does the first 0 integer value mean for example?

I guess I could look in the puttygen source code but is there an RFC describing this format or something?

  • This question is not on topic, since private key formats are often implementation specific and not necessarily standardized. The above dump of the der encoding shows that the format is at least not consistent with PKCS#8.
    – Henrick Hellström
    Sep 24, 2012 at 13:47
  • As Henrick pointed out, your question is more about key formats and less about crypto. So it is off topic on our site here. I talked to the moderators at our sister site SuperUser and we feel it might be better off on their site, so I'm moving it there.
    – mikeazo
    Sep 24, 2012 at 14:43
  • What command did you use to export the key to OpenSSH format? Sep 25, 2012 at 16:49

1 Answer 1


Private-key formats aren't as standardized as public-key formats because, ideally, they are never sent or received— so interoperability isn't as big of a concern.

However, documentation on that format can be found in a couple of places. It's very similar to the RSAPrivateKey structure described in PKCS#1, which would normally be carried inside a PKCS#8 container. However, the normal way of storing a DSA key in a PKCS#8 container is just to store the private value x, not the whole structure that you have there. I'm guessing that it's a proposed-but-never-technically-standardized DSAPrivateKey format which OpenSSL implemented before the standards settled down. The OpenSSL dsa man page says:

The DER option with a private key uses an ASN1 DER encoded form of an ASN.1 SEQUENCE consisting of the values of version (currently zero), p, q, g, the public and private key components respectively as ASN.1 INTEGERs.

and I'm guessing that OpenSSH reused that format. The comments in PyCrypto's DSA key implementation reinforce this idea; there they call the structure "DSAPrivatKey_OpenSSL" and refer to it as "the custom OpenSSL/OpenSSH encoding".

  • Except for protocol v1, obsoleted around 2000, OpenSSH used OpenSSL libcrypto for most crypto, including writing and reading privatekey files and OpenSSL used PKCS1 for RSA, as you describe for DSA, and SEC1-later-rfc5915 for EC(DSA) -- until OpenSSH 6.5 in 2014-01 added ed25519 which OpenSSL then did not support so OpenSSH created its own 'new' format keyfile with PEM labels BEGIN/END OPENSSH PRIVATE KEY; initially this was default only for ed25519 but since 7.8 in 2018-08 it is default for all algorithms; there are (now) numerous Qs on several stacks about resulting issues. Nov 26, 2019 at 5:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy