ASC file format: Packets and keys

Under the armour, OpenPGP data is a sequence of packets. This page gives the packet frame, the packet types, the key packets and the algorithm IDs, following RFC 9580 (sections 3, 4, 5.5, 9 and 10.1) and the IANA OpenPGP registries. Numbers (scalars) are unsigned and big-endian. Times are 4-byte counts of seconds since midnight, 1 January 1970 UTC.

Packet header

The first byte always has bit 7 set. Bit 6 chooses the format:

Format	First byte	Length
OpenPGP (new), bit 6 = 1	Bits 5–0: packet type, 0–63.	Follows as described below.
Legacy (old), bit 6 = 0	Bits 5–2: packet type, 0–15. Bits 1–0: length type.	Length type 0: one byte; 1: two bytes; 2: four bytes; 3: indeterminate, to the end of the data (must not be written). The legacy format should not be written at all.

First length byte	Length
0–191	That byte: 0 to 191.
192–223	Two bytes: ((first − 192) × 256) + second + 192, giving 192 to 8,383.
224–254	Partial body length: 2^{(first AND 31)} bytes follow, then another length header; the last one must not be partial. Only for literal, compressed and encrypted data packets, and the first part must be at least 512 bytes.
255	Four more bytes give the length.

So 98 33 is a legacy packet of type 6 with a one-byte length of 51, and C6 33 the same in the new format.

Packet types

Type	Packet
0	Reserved; must not be used
1	Public-Key Encrypted Session Key (PKESK)
2	Signature (SIG)
3	Symmetric-Key Encrypted Session Key (SKESK)
4	One-Pass Signature (OPS)
5	Secret Key
6	Public Key
7	Secret Subkey
8	Compressed Data
9	Symmetrically Encrypted Data (obsolete, no integrity check)
10	Marker (the bytes `PGP`; ignored)
11	Literal Data
12	Trust (local to a keyring; not exported)
13	User ID (UTF-8 text, such as `Alice <alice@example.org>`)
14	Public Subkey
15–16	Not listed in RFC 9580’s table
17	User Attribute (such as a JPEG photo)
18	Symmetrically Encrypted and Integrity Protected Data (SEIPD)
19	Reserved (formerly Modification Detection Code)
20	Reserved
21	Padding
22–39	Unassigned, critical
40–59	Unassigned, non-critical
60–63	Private or experimental use (non-critical)

Types 0–39 are critical: a reader that meets an unknown critical type must reject the whole packet sequence. An unknown non-critical packet (40–63) must be ignored (section 4.3).

A transferable public key (an OpenPGP certificate), the usual content of a key .asc, is laid out as follows for version 6 (section 10.1.1); brackets are optional, “…” repeats, and a Marker packet may appear anywhere:

Primary Key
   [Revocation Signature...]
    Direct Key Signature...
   [User ID or User Attribute
           [Certification Revocation Signature...]
           [Certification Signature...]]...
   [Subkey [Subkey Revocation Signature...]
           Subkey Binding Signature...]...
   [Padding]

A version 4 key (section 10.1.3) has an optional single Revocation Signature, optional Direct Key Signatures, then User IDs or User Attributes each with their signatures, then subkeys each with at least one Subkey Binding Signature.

Key packets

Field	Size	Version 4	Version 6
Version	1	4	6
Creation time	4	Seconds since 1970	Seconds since 1970
Algorithm	1	See public key algorithms	Same
Key material length	4	–	Bytes of key material that follow
Key material	varies	Algorithm-specific; RSA: MPI n, MPI e	Algorithm-specific

An MPI (multiprecision integer) is a 2-byte count of bits, counted from the most significant non-zero bit, followed by the number, big-endian, in the fewest bytes: 00 09 01 FF is 511 (section 3.2). Implementations should create version 6 keys; version 4 keys are deprecated but should be accepted; version 3 keys (RSA only, with a validity period in days) and version 2 keys must not be generated (section 5.5.2).

Version	Fingerprint	Key ID
4	SHA-1 of `99`, a 2-byte length and the packet body: 20 bytes	The low-order 64 bits of the fingerprint
6	SHA2-256 of `9B`, a 4-byte length and the packet body: 32 bytes	The high-order 64 bits of the fingerprint

Subkeys are hashed the same way, starting with 99 or 9B (section 5.5.4).

Secret key packets

A Secret Key or Secret Subkey packet is the public key packet’s fields followed by an S2K usage byte and, depending on it, how the secret part is protected:

S2K usage	Meaning
0	Unprotected; the secret key material follows, then (v3 and v4 only) a 2-byte checksum, the sum of its bytes mod 65,536.
253	AEAD: (v6: parameter length), cipher, AEAD mode, (v6: S2K specifier length), S2K specifier, nonce.
254	CFB with a SHA-1 hash of the secrets: (v6: parameter length), cipher, (v6: S2K specifier length), S2K specifier, IV.
255	MalleableCFB, with the 2-byte checksum: cipher, S2K specifier, IV. Must not be generated.
A cipher ID	LegacyCFB (before RFC 2440): the byte is the symmetric cipher ID and the key is the MD5 of the passphrase; an IV follows. Must not be generated.

Version 6 secret keys using a “must not be generated” form must be rejected, and Argon2 may only be used with usage 253 (section 3.7.2.1).

S2K type	Specifier
0	Simple: hash algorithm (2 bytes in all). Must not be generated.
1	Salted: hash algorithm, 8-byte salt (10 bytes). Only for high-entropy strings.
2	Reserved.
3	Iterated and salted: hash algorithm, 8-byte salt, count byte `c` (11 bytes); (16 + (`c` AND 15)) × 2^{(c ÷ 16) + 6} bytes of salt and passphrase are hashed, an octet count, not an iteration count.
4	Argon2 (Argon2id, version 0x13): 16-byte salt, passes `t`, parallelism `p`, and `m` where the memory is 2^m KiB, from 3 + ⌈log₂ `p`⌉ to 31 (20 bytes). Recommended.
100–110	Private or experimental.

Public key algorithms

ID	Algorithm
0	Reserved
1	RSA (encrypt or sign); deprecated, should not be generated
2	RSA encrypt-only; deprecated, must not be generated
3	RSA sign-only; deprecated, must not be generated
16	Elgamal (encrypt-only); deprecated, must not be generated
17	DSA; deprecated, must not be generated
18	ECDH
19	ECDSA
20	Reserved (formerly Elgamal encrypt or sign)
21	Reserved for Diffie–Hellman (X9.42)
22	EdDSALegacy (deprecated)
23	Reserved (AEDH)
24	Reserved (AEDSA)
25	X25519 (must be implemented, for encryption)
26	X448
27	Ed25519 (must be implemented, for signatures)
28	Ed448
30	ML-DSA-65+Ed25519 (RFC 9980)
31	ML-DSA-87+Ed448
32	SLH-DSA-SHAKE-128s
33	SLH-DSA-SHAKE-128f
34	SLH-DSA-SHAKE-256s
35	ML-KEM-768+X25519
36	ML-KEM-1024+X448
4–15, 29, 37–99, 111–255	Unassigned
100–110	Private or experimental

IDs 0–28 are from RFC 9580 Table 18; 30–36 were added to the IANA registry (updated 2026-07-02) by RFC 9980.

ECDH, ECDSA and EdDSALegacy keys name their curve by OID (RFC 9580 Table 19; the key stores the DER encoding without its tag and length bytes): NIST P-256 (1.2.840.10045.3.1.7), P-384 (1.3.132.0.34), P-521 (1.3.132.0.35), brainpoolP256r1 (1.3.36.3.3.2.8.1.1.7), brainpoolP384r1 (…1.1.11), brainpoolP512r1 (…1.1.13), Ed25519Legacy (1.3.6.1.4.1.11591.15.1) and Curve25519Legacy (1.3.6.1.4.1.3029.1.5.1).

Other algorithm IDs

ID	Symmetric cipher
0	Plaintext
1	IDEA
2	TripleDES
3	CAST5
4	Blowfish
5–6	Reserved
7, 8, 9	AES-128, AES-192, AES-256
10	Twofish
11, 12, 13	Camellia-128, -192, -256
100–110	Private or experimental
253–255	Reserved (they would clash with S2K usage values)

ID	Hash
0	Reserved
1	MD5
2	SHA-1
3	RIPEMD-160
4–7	Reserved
8	SHA2-256
9	SHA2-384
10	SHA2-512
11	SHA2-224
12	SHA3-256
13	Reserved
14	SHA3-512
100–110	Private or experimental

ID	Compression	ID	AEAD mode
0	Uncompressed	0	Reserved
1	ZIP (raw deflate)	1	EAX
2	ZLIB	2	OCB
3	BZip2	3	GCM
100–110	Private or experimental	100–110	Private or experimental