PKCS1-CONV(1)

✨ NAME ✨

okay bestie, welcome to pkcs1-conv 💅 — she's part of the Nettle tools squad, and her whole job is converting keys from PKCS#1 format to s-expression format. that's it. that's the girl. 🎀

---

🌸 SYNOPSIS 🌸

pkcs1-conv [{--private-rsa-key|--public-rsa-key|--public-key-info}
[--base-64]] < FILE

like, she reads from stdin and you pipe a FILE into her, that's the whole vibe 🦋

---

💖 DESCRIPTION 💖

so this manual page documents pkcs1-conv briefly — and honestly? iconic of it to admit that. this page was written for the Debian GNU/Linux distribution because the original program did not come with a manual page at all. so we made one. you're welcome. 💅

pkcs1-conv converts private and public RSA keys from PKCS #1 format to sexp format. glow-up complete, no cap. ✨

---

🎀 OPTIONS 🎀

this program follows the usual GNU command line syntax, with long options starting with two dashes (-). periodt.

by default pkcs1-conv expects a PEM-encapsulated RSA key on standard input, and will determine its type from the Pre-Encapsulation Boundary. so she just knows. main character energy fr fr. 😌

to convert a DER-encoded (non PEM-encoded) key, one of the first three options below must be used:

• --private-rsa-key — says "bestie, expect a DER-encoded RSAPrivateKey as input." that's defined by PKCS #1 (RFC 3447), and described in section A.1.2 of its appendix A. private key moment 🔒
• --public-rsa-key — says "expect a DER-encoded RSAPublicKey as input." defined by PKCS #1 (RFC 3447), described in section A.1.1 of its appendix A. public key moment 🔓
• --public-key-info — says "expect a DER-encoded SubjectPublicKeyInfo as input." that's defined by PKCS #6, described in section A.1 of its appendix A, and it's encapsulating an RSAPublicKey. nested. layers. we love a structure 🧚
• --base-64 — together with --private-rsa-key, --public-rsa-key, or --public-key-info, this says base64 encoding is applied on top of the DER encoding. double-wrapped, like a little gift 🎁
• -?, --help — show summary of options (not implemented). 💀 yes really. she's not gonna help you help yourself.
• -V, --version — show version of program. slay, that one works 👑

---

😭 DIAGNOSTICS 😭

pkcs1-conv will complain and exit with a status of 1 if the input doesn't match expectations. she's not mad, she's just disappointed. 🙈

but here's the sneaky part: in PEM mode (when no option is used), if no PEM block is found, pkcs1-conv will output nothing but exit with a zero status. so, silence = success?? literally the quietest flex. keep that in mind or you'll be confused bestie. 😭

---

🔥 EXAMPLES 🔥

run these, they're the whole point:

$ openssl genrsa -out privkey.pem
$ pkcs1-conv < privkey.pem > privkey.sexp
$ openssl rsa -in privkey.pem -outform DER -out privkey.der
$ openssl rsa -in privkey.pem -outform DER -pubout -out pubkey.der
$ pkcs1-conv --rsa-private-key < privkey.der > privkey.sexp
$ pkcs1-conv --public-key-info < pubkey.der > pubkey.sexp

ngl, notice that the fifth line says --rsa-private-key? yeah. we're keeping it exactly as written, character for character. iykyk. 🫶

---

🌈 SEE ALSO 🌈

go be nosy, these are all her friends:

• ssh-conv(1)
• sexp-conv(1)
• rsa(1SSL)
• genrsa(1SSL)
• RFC 3447

---

💜 AUTHOR 💜

this manual page was written by Magnus Holmgren <holmgren@debian.org> for the Debian GNU/Linux system (but may be used by others). king behavior honestly 👑

---

⭐ COPYRIGHT ⭐

Copyright © 2007 Magnus Holmgren.

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. free to share, no strings, we love that for us 💖

---

and that's the whole page bestie! 🦋 this one's from the nettle era, version 1.15, dated June 2007 — vintage, but she still eats. periodt. 💅✨