Difference between X.509 and pem [duplicate]

Question

In cryptography, what is the difference between X.509 and pem?

Can X.509 format contain a private key? Can private key be in pem format?

Answer 1

X.509 is a series of standards, while PEM is just X.509 object representation in a file (encoding). Literally any data can be represented in PEM format. Anything that can be converted to a byte array (and anything can be, because RAM is a very large byte array) can be represented in PEM format.

All X.509 objects are transferrable and are presented by using Abstract Syntax Notation One (ASN.1) as a byte array. Byte arrays are great when are transmitted over networks but not always useful when stored somewhere. Another thing is that you cannot easily determine X.509 object type without thorought content analyzing.

PEM stands for Privacy Enhanced Mail and is defined in RFC1421. While PEM was developed for a bit different purposes, the standard defines PEM presentation, especially when need to represent non-printable characters with printable characters only. In cryptography, PEM is associated only with X.509 object presentation. In addition, PEM provides additional data to identify embedded object.

ASN.1 form of X.509 object is a byte array, for example (series of octets to represent bytes):

3a 20 63 65 72 74 6c 69  62 5c 6c 64 61 70 2e 63
70 70 28 32 31 33 31 29  3a 20 6c 64 61 70 65 72

Since hex is not useful to represent binary data because it requires two times more space than original data, a more efficient Base64 encoding is used. And special headers and footers are used to denote embedded object type:

X.509 Certificate

-----BEGIN CERTIFICATE-----
MIIEITCCA+CgAwIBAgIUKMmxmDbjbHqt+Yzwj5lflBxuQwEwCQYHKoZIzjgEAzAjMSEwHwYDVQQD
ExhUb2tlbiBTaWduaW5nIFB1YmxpYyBLZXkwHhcNMTIxMTE2MTgzODMwWhcNMTIxMTIzMTgzODMw
WjAtMSswKQYDVQQDHiIAYgBiADEANAAxADkAYQAyAGMAZgBjADEAZQAwADAAOAAAMIGfMA0GCSqG
<...>
-----END CERTIFICATE-----

X.509 Certificate Revocation List

-----BEGIN X509 CRL-----
MIIDBjCCAm8CAQAwcTERMA8GA1UEAxMIcXV1eC5jb20xDzANBgNVBAsTBkJyYWlu
czEWMBQGA1UEChMNRGV2ZWxvcE1lbnRvcjERMA8GA1UEBxMIVG9ycmFuY2UxEzAR
BgNVBAgTCkNhbGlmb3JuaWExCzAJBgNVBAYTAlVTMIGfMA0GCSqGSIb3DQEBAQUA
<...>
-----END X509 CRL-----

X.509 Certificate Request

-----BEGIN NEW CERTIFICATE REQUEST-----
MIIDBjCCAm8CAQAwcTERMA8GA1UEAxMIcXV1eC5jb20xDzANBgNVBAsTBkJyYWlu
czEWMBQGA1UEChMNRGV2ZWxvcE1lbnRvcjERMA8GA1UEBxMIVG9ycmFuY2UxEzAR
BgNVBAgTCkNhbGlmb3JuaWExCzAJBgNVBAYTAlVTMIGfMA0GCSqGSIb3DQEBAQUA
<...>
-----END NEW CERTIFICATE REQUEST-----

PKCS#1 private key

-----BEGIN RSA PRIVATE KEY-----
MIIDBjCCAm8CAQAwcTERMA8GA1UEAxMIcXV1eC5jb20xDzANBgNVBAsTBkJyYWlu
czEWMBQGA1UEChMNRGV2ZWxvcE1lbnRvcjERMA8GA1UEBxMIVG9ycmFuY2UxEzAR
BgNVBAgTCkNhbGlmb3JuaWExCzAJBgNVBAYTAlVTMIGfMA0GCSqGSIb3DQEBAQUA
<...>
-----END RSA PRIVATE KEY-----

PKCS#8 private key

-----BEGIN PRIVATE KEY-----
MIIDBjCCAm8CAQAwcTERMA8GA1UEAxMIcXV1eC5jb20xDzANBgNVBAsTBkJyYWlu
czEWMBQGA1UEChMNRGV2ZWxvcE1lbnRvcjERMA8GA1UEBxMIVG9ycmFuY2UxEzAR
BgNVBAgTCkNhbGlmb3JuaWExCzAJBgNVBAYTAlVTMIGfMA0GCSqGSIb3DQEBAQUA
<...>
-----END PRIVATE KEY-----

and so on.