RSA Private Key Header
Detects PKCS#1 RSA private-key armor. A BEGIN line is discovery-only, the first DER-like Base64 line supports medium confidence, and several normally wrapped body lines near the header support high confidence.
- Type
- regex
- Engine
- universal
- Confidence
- high
- Confidence justification
- High confidence: structurally constrained pattern with corroborative keyword support reduces false positive rates significantly. Added context gating and exclusion rules improve precision and reduce incidental matches.
- Detection quality
- Verified
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2
- Data categories
- credentials, security
- Scope
- specific
- Risk rating
- 8
- Platform compatibility
- Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible
Pattern
-----BEGIN RSA PRIVATE KEY-----Corroborative evidence keywords
private key, secret key, key file, PEM, certificate, RSA, cryptographic, api key, api_key, apikey, access key, access token, auth token, authorization, bearer, conn str, connection string, connectionstring, cookie, credential (+38 more)
Proximity: 300 characters
Should match
-----BEGIN RSA PRIVATE KEY-----— Low-tier probe - PKCS#1 header without a container body-----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEAsUCYqdw/QHCmWnNK7RjYIZaE3QnXQAf5a6znOdg0MAk2X4t3 QQ==— Medium-tier probe - realistic first PKCS#1 DER armor line-----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEAsUCYqdw/QHCmWnNK7RjYIZaE3QnXQAf5a6znOdg0MAk2X4t3 JaRH3xVNipwkmjbVL5omeBWECLtSWJ3hHKfiF+wTFcOZikifLBYiTAAGBAdE9C+v rF63QS9D+9KSrdgmfqRdYmozlw9ySrTJn8kdxdz0a9A1b1c+3KDGRIQHXDW6q8Mm lB6vkByKUyCR9/KybDjpQXV6KOhKrWHV7R0OUh46iNF4h9udhMrr3o7CmF/iyGP1 WbHmmHzZPBQ1Oa8SJnHIGwZCDBf8/7k6jz65SHEjJxO3PlQOCsxGUnNoAj7TA2z2 xsXdl1wurK9QTX/dXzas4Hno+xMTZBbFH+b30QIDAQABAoIBABOnMGYhDAhWlTNR -----END RSA PRIVATE KEY-----— High-tier probe - realistically long PKCS#1 body with footer beyond proximity
Should not match
-----BEGIN PUBLIC KEY-----— Public key, not private-----BEGIN CERTIFICATE-----— Certificate, not private key-----BEGIN RSA PRIVATE KEY----- QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB— Adversarial wrapped Base64 lacks a PKCS#1 DER prelude-----BEGIN RSA PRIVATE KEY----- PLACEHOLDER -----END RSA PRIVATE KEY-----— Placeholder container has no DER-like bodyDocumentation example: -----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEAsUCYqdw/QHCmWnNK7RjYIZaE3QnXQAf5a6znOdg0MAk2X4t3 JaRH3xVNipwkmjbVL5omeBWECLtSWJ3hHKfiF+wTFcOZikifLBYiTAAGBAdE9C+v rF63QS9D+9KSrdgmfqRdYmozlw9ySrTJn8kdxdz0a9A1b1c+3KDGRIQHXDW6q8Mm -----END RSA PRIVATE KEY-----— Documentation quoting realistic wrapped key data must not enforce-----BEGIN EC PRIVATE KEY-----— Sibling EC private-key armor is not PKCS#1 RSA
Known false positives
- PEM-encoded certificates or public keys that use similar header formats Mitigation: The pattern specifically matches the private key header text, but verify the full PEM block contains actual key material.