Tink: What format does tink give your keys in? Pem or der?

Question

First time user of tink (and overall cryptography noob, but I'm learning)

I'm able to create a private key using

tinkey create-keyset --key-template [MY TEMPLATE] --out-format json --out foo.json

then once I have that file I try to create the public keyset via

tinkey create-public-keyset --in-format=json --in=foo.json

The output is

{"primaryKeyId":3104918340,"key":[{"keyData":{"typeUrl":"type.googleapis.com/google.crypto.tink.HpkePublicKey","value":"EgYIAxACGAIaYQTKiU+xhistDls5CMGMC311ZRfELnUGdfLXBx++SHiMOMOzsaFryaKljLlHHKegOeC6vbG8AXXpoPrvaouxtU5CgHCXGEczYwo9p/PHN4gKnJFfJJWCerzC5lEtV4SJUVo=","keyMaterialType":"ASYMMETRIC_PUBLIC"},"status":"ENABLED","keyId":3104918340,"outputPrefixType":"TINK"}]}

So now I need to send pem across the wire to a server, but my server team keeps telling me that I'm giving them an invalid pem document. I was under the understanding that the valud in the json above is pem format. Any tips?

Answer 1

Neither its base64-encoded. Here is a good article from Google that goes over it: https://developers.google.com/tink/wire-format

It goes over the key's bites and stuff.