Considering the PEM document, is it possible to find out the format of bytes from it or a priori obtain information?

Question

Given an arbitrary (valid!) Private or public key encoded inside PEM, with the pre-encapsulation boundary and post-encapsulation boundaries intact, is it possible to know exactly in what format the bytes are taken (i.e. they are OpenSSL traditional, PKCS8, X .509 SubjectPublicKeyInfo , etc.), Or is any a priori information necessary for their proper decoding?

Answer 1

The situation with certificates is almost simple - there the border indicates what is expected (certificate or private key).

In OpenPGP armored data, the boundary line also tells you if the key or data is expected.

SSH keys created by several SSH applications have the same boundary lines, but different key formats. Therefore, you need to try to read the data in all expected formats.

RSA public keys usually have the RSA 1.5 format, so you can assume that you have an RSA key.

PKCS # 12 usually does not fit in PEM (I have never seen such files). The same goes for PKCS8.

PKCS # 7 certificate stores are sometimes PEM encoded, and they have something like BEGIN CERTIFICATE STORAGE in their boundary line.

To summarize - to some extent you can rely on the text of the border line, but this does not give you a 100% guarantee.

Answer 2

You should take a look at the specification, PKCS # 8 is listed in RFC5958 in Section 5.

. When .p8 files are PEM encoded, they use the .pem file extension. PEM encoding is either Base64 encoding of DER-encoded EncryptedPrivateKeyInfo, located between:

----- BEGIN ENCRYPTED PRIVATE KEY -----
----- END ENCRYPTED PRIVATE KEY -----

or the Base64 encoding, see Section 4 of [RFC4648], of the DER-encoded PrivateKeyInfo sandwiched between:

----- BEGIN PRIVATE KEY -----
----- END PRIVATE KEY ----

A slightly longer answer: "Between the tags, in any case, the encoded Base64 encoded DER DER ASN.1 is valid"