{"record":{"id":"5a58d33d406b8f91","repo":"gchq/CyberChef","slug":"unsupported-rsa-public-key-format-only-pkcs-8-is","errorCode":null,"errorMessage":"Unsupported RSA public key format. Only PKCS#8 is supported.","messagePattern":"Unsupported RSA public key format\\. Only PKCS#8 is supported\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/PEMToJWK.mjs","lineNumber":59,"sourceCode":"     */\n    run(input, args) {\n        let output = \"\";\n        let match;\n        const regex = /-----BEGIN ([A-Z][A-Z ]+[A-Z])-----/g;\n        while ((match = regex.exec(input)) !== null) {\n            // find corresponding end tag\n            const indexBase64 = match.index + match[0].length;\n            const header = input.substring(match.index, indexBase64);\n            const footer = `-----END ${match[1]}-----`;\n            const indexFooter = input.indexOf(footer, indexBase64);\n            if (indexFooter === -1) {\n                throw new OperationError(`PEM footer '${footer}' not found`);\n            }\n\n            const pem = input.substring(match.index, indexFooter + footer.length);\n            if (match[1].indexOf(\"KEY\") !== -1) {\n                if (header === \"-----BEGIN RSA PUBLIC KEY-----\") {\n                    throw new OperationError(\"Unsupported RSA public key format. Only PKCS#8 is supported.\");\n                }\n\n                const key = r.KEYUTIL.getKey(pem);\n                if (key.type === \"DSA\") {\n                    throw new OperationError(\"DSA keys are not supported for JWK\");\n                }\n                const jwk = r.KEYUTIL.getJWKFromKey(key);\n                if (output.length > 0) {\n                    output += \"\\n\";\n                }\n                output += JSON.stringify(jwk);\n            } else if (match[1] === \"CERTIFICATE\") {\n                const cert = new r.X509();\n                cert.readCertPEM(pem);\n                const key = cert.getPublicKey();\n                const jwk = r.KEYUTIL.getJWKFromKey(key);\n                if (output.length > 0) {\n                    output += \"\\n\";","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/PEMToJWK.mjs#L41-L77","documentation":"PEMToJWK deliberately rejects PKCS#1 RSA public keys. The header string is compared to the literal '-----BEGIN RSA PUBLIC KEY-----' (the PKCS#1 marker); only PKCS#8 SubjectPublicKeyInfo ('-----BEGIN PUBLIC KEY-----') is accepted because jsrsasign's KEYUTIL.getJWKFromKey expects PKCS#8. A PKCS#1 header short-circuits before any parsing.","triggerScenarios":"User feeds a PKCS#1 RSA public key whose header is '-----BEGIN RSA PUBLIC KEY-----'. Common source: OpenSSL legacy 'openssl rsa -RSAPublicKey_out' which emits PKCS#1, or Java RSA exports.","commonSituations":"Keys exported with older OpenSSL defaults that produce PKCS#1; interop with systems emitting 'RSA PUBLIC KEY'; copy-paste from a tool that wraps RSA public keys in PKCS#1.","solutions":["Convert the key to PKCS#8: openssl rsa -RSAPublicKey_in -in pub.pem -pubout -out pub_pkcs8.pem (the -pubout default writes PKCS#8 'PUBLIC KEY').","Re-export the public key from its source as SubjectPublicKeyInfo / PKCS#8.","Confirm the resulting header reads '-----BEGIN PUBLIC KEY-----' with no 'RSA' prefix."],"exampleFix":"// before (PKCS#1, rejected)\n-----BEGIN RSA PUBLIC KEY-----\n...\n// after (PKCS#8, accepted)\n-----BEGIN PUBLIC KEY-----\n...","handlingStrategy":"validation","validationCode":"function isPkcs8PublicKey(pem) {\n    return /-----BEGIN PUBLIC KEY-----/.test(pem)\n        && !/-----BEGIN RSA PUBLIC KEY-----/.test(pem);\n}","typeGuard":"const isPkcs8RsaPublicKey = (pem) =>\n    typeof pem === 'string' &&\n    pem.includes('-----BEGIN PUBLIC KEY-----') &&\n    !pem.includes('-----BEGIN RSA PUBLIC KEY-----');","tryCatchPattern":null,"preventionTips":["Export RSA public keys as PKCS#8 (SubjectPublicKeyInfo).","Check the BEGIN header: 'PUBLIC KEY' = PKCS#8 (ok), 'RSA PUBLIC KEY' = PKCS#1 (rejected).","Use 'openssl rsa -pubout' (defaults to PKCS#8), not '-RSAPublicKey_out'."],"tags":["pem","rsa","pkcs1","pkcs8","jwk","cryptography"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}