24

I have a public key in the format:

---- BEGIN SSH2 PUBLIC KEY ---- Comment: "somename-20060227" AAAAB3NzaC1yc2EAAAABJQAAAIBmhLUTJiP[and so on]== ---- END SSH2 PUBLIC KEY ----

Usually I see keys in the format like this:

ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIEAqof[and so on]

Can I just copy the first key in the authorized_keys file or do I have to modify it somehow so it looks like the second one? I think the first one was generated by PUTTYgen while the second one was generated by ssh-keygen.

Improve this question
2
  • Puttygen generates both. On Windows the GUI box cleverly labeled "Public key for pasting into OpenSSH authorized_keys" is the OpenSSH format, but the button SavePublicKey or the equivalent item in the File menu gives the RFC4716/Tectia format. On Unix you specify -O public-openssh or -O public. Commented Mar 6, 2024 at 2:32
  • Will there ever be standardization of key formats? I'm a Windows user and this stuff confuses me. WinSCP requires a .ppk file for authentication, but the PHP ssh2 library requires something else that I can't find documentation for. I've spent a total of many hours trying to understand and debug my use of wrong formats. Commented Jun 30, 2024 at 15:10

5 Answers 5

Reset to default
23

use ssh-keygen -i to convert SSH2-compatible format to OpenSSH compatible format.

from man ssh-keygen:

-i This option will read an unencrypted private (or public) key file in SSH2-compatible format and print an OpenSSH compatible private (or public) key to stdout. ssh-keygen also reads the RFC 4716 SSH Public Key File Format. This option allows importing keys from several commercial SSH implementations.

&

-f filename Specifies the filename of the key file.

example:

ssh-keygen -i -f ssh2.pub

Improve this answer
0
11

This is the complete, correct answer:

ssh-keygen -i -m PKCS8 -f public-key.pem

Improve this answer
2
  • 1
    "RFC4716" is the default key_format, and -m does appear to be for specifying the format of the INPUT in this instance, not the output, so you are correct. Commented Mar 28, 2018 at 15:42
  • 1
    Technically alexus' "correct" answer is NOT wrong though, as that answer is not spelling out full syntax - only pointing to which primary flag should be used, leaving the need to check -i syntax/usage in the man page. Commented Mar 28, 2018 at 15:48
4

You do have to convert the public key to openssh convention: 

ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIBmhLUTJiP[and so on]== somename-20060227

Also make sure that the key occupies exactly one line and no line breaks were introduced while copying.

Improve this answer
3

Just rewrite your key in format suited for authorized_keys:

keytype keybody keyname

Keep in mind that trailing "==" are necessary placeholders to keep keylength equal to desired length.

Improve this answer
2
  • 6
    The trailing "==" are Base64 padding Commented Apr 18, 2012 at 14:46
  • how do I know if its RSA or DSA? Commented Apr 18, 2012 at 16:07
0

To create public keys for a number of password encrypted private keys the following script will:

  1. Read the private key with ssh-keygen -e and output a public key - and ask for the private key password
  2. Create a PEM based public key and store in an environment variable
  3. Use ssh-keygen -i to create and OpenSSH compatible public key
  4. And write to a .pub output file
for i in $(ls -1 id_rsa_* | grep -v "\.pub$") # Ignore .pub files do PEM=$(ssh-keygen -e -f $i -m PEM) # Will ask for the private key password echo $(ssh-keygen -i -m PEM -f <(echo "$PEM")) KEY-ALIAS > $i.pub done

A side note, seahorse, the Ubuntu "Passwords and keys" agent, requires the public keys to be able to store the private keys.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.