Do we need a similar change for EdDSA curves?

I would like to propose existing output lines to keep as is. Long story, but "printed" information could be the only way to know details for "externally managed keys". Please output new details on new line.

The original (now modified) output was a throw-away comment (%d bits) that was for human eyes only, unclear and often plausibly misleading. There is no stability contract on that particular output detail, especially in a new major release.

Perhaps "print" could write NIST security category(level) it is not in output yet. But this looks like general requirement for all key types. Roumen

That's a separate issue. There isn't presently a natural place to place such additional commentary, so a comment right after the key type is where it goes. It appears you're saying that this belongs across key types, that may be reasonable, but the TEXT output formats of the various key types are rather algorithm-specific, and we probably don't want to do a big-bang change for all the keys at once. If we can converge on a consensus in this PR, perhaps we could then tackle:

$ ./util/wrap.pl ./apps/openssl genpkey -quiet -algorithm rsa \
        -pkeyopt rsa_keygen_bits:1024 |
    ./util/wrap.pl ./apps/openssl pkey -noout -text | grep -v '^ '
Private-Key: (1024 bit, 2 primes)
modulus:
publicExponent: 65537 (0x10001)
privateExponent:
prime1:
prime2:
exponent1:
exponent2:
coefficient:

$ ./util/wrap.pl ./apps/openssl genpkey -genparam -algorithm DSA \
        -pkeyopt pbits:2048 -pkeyopt qbits:224 -pkeyopt digest:SHA256 \
        -pkeyopt gindex:1 -text |
    ./util/wrap.pl ./apps/openssl genpkey -paramfile /dev/stdin |
    ./util/wrap.pl ./apps/openssl pkey -noout -text | grep -v '^ ' 
Private-Key: (2048 bit)
priv:
pub: 
P:   
Q:   
G:   

$ ./util/wrap.pl ./apps/openssl genpkey -quiet -algorithm dh \
        -pkeyopt group:ffdhe2048 |
    ./util/wrap.pl ./apps/openssl pkey -noout -text | grep -v '^ '
DH Private-Key: (2048 bit)
private-key:
public-key:
GROUP: ffdhe2048

$ ./util/wrap.pl ./apps/openssl genpkey -quiet -algorithm ec \
        -pkeyopt ec_paramgen_curve:sm2 |
    ./util/wrap.pl ./apps/openssl pkey -noout -text | grep -v '^ '
Private-Key: (256 bit field, 128 bit security level)
priv:
pub:
ASN1 OID: SM2

$ ./util/wrap.pl ./apps/openssl genpkey -quiet -algorithm x25519 |
    ./util/wrap.pl ./apps/openssl pkey -noout -text | grep -v '^ '
X25519 Private-Key:
priv:
pub:

$ ./util/wrap.pl ./apps/openssl genpkey -quiet -algorithm ed25519 |
    ./util/wrap.pl ./apps/openssl pkey -noout -text | grep -v '^ '
ED25519 Private-Key:
priv:
pub:

$ ./util/wrap.pl ./apps/openssl genpkey -quiet -algorithm ml-kem-512 |
    ./util/wrap.pl ./apps/openssl pkey -noout -text | grep -v '^ '
ML-KEM-512 Private-Key:
seed:
dk:
ek:

$ ./util/wrap.pl ./apps/openssl genpkey -quiet -algorithm ml-dsa-44 |
    ./util/wrap.pl ./apps/openssl pkey -noout -text | grep -v '^ '
ML-DSA-44 Private-Key:
seed:
priv:
pub:

$ ./util/wrap.pl ./apps/openssl genpkey -quiet -algorithm slh-dsa-sha2-128f |
    ./util/wrap.pl ./apps/openssl pkey -noout -text | grep -v '^ '
SLH-DSA-SHA2-128f Private-Key:
priv:
pub:

Note I do not think this should be merged as yet even though it has the necessary approvals - but I am not placing any hold as this follows our current process (only two approvals required).

There should be broader discussion on this change as we don't want to merge a change and then back it out if the consensus view differs.

I suggest anyone interested in this carefully read through the summary of what the current output is and how it is not what the user would expect and it not particularly useful. This change returns something the user can related to (the degree which is in the name) and also the security bits which is an addition I think we should place in all of the output formats to encourage awareness and use of that value.

24 hours has passed since 'approval: done' was set, but as this PR has been updated in that time the label 'approval: ready to merge' is not being automatically set. Please review the updates and set the label manually.

So I'm wondering if we should do the same for something like RSA keys. That currently returns something like: "Private-Key: (2048 bit, 2 primes)"

I guess this can be set ready for merge as the last approval was a week ago.

pushed to master branch as e57f7941af