Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two files, id_rsa and, what command can be used to validate if they are the valid pair.

share|improve this question
I'll confirm Michuelnik's answer; it saved me from having to make a new key pair, thanks. ssh -v helps a lot too. – Chris K Dec 30 '13 at 5:06
up vote 38 down vote accepted

Question is already answered on stackoverflow:

(Can I mark a question as duplicate on another stackexchange network?)

I would prefer the ssh-keygen -y -e -f <private key> way instead of the accepted answer on SO.

ssh-keygen -y -e -f <private key> takes a private key an prints the corresponding public key which can be directly compared to your available public keys. (Hint: beware of comments or key-options)

(How the hell is it doing that? I can only hope the public key is encoded directly or indirectly in the private key...)

Needed this myself and used the following bash-oneliner. It should output nothing if the keys belong together. Apply a little -q to the diff in scripts and diff only sets the return code appropriately.

diff <( ssh-keygen -y -e -f "$PRIVKEY" ) <( ssh-keygen -y -e -f "$TESTKEY" )
share|improve this answer
No answer has been accepted yet. And I like yours better. – Michael Hampton Sep 11 '12 at 18:03
@MichaelHampton: now I understand your comment. "the accepted answer" should refer to the question on stackoverflow not this question... – Michuelnik Sep 12 '12 at 5:38
@Sirch: I thought the decision which key is private and which one is public is pure random since the two keys are equal. What one key encrypts can only be decrypted with the other. And if one key could be obtained from the other this all would not work out. – Michuelnik Sep 25 '13 at 11:42
@Michuelnik You can derive the public key from the private key. You cant derive the private key from the public key. Were not talking about the material that it encrypts. – Sirch Sep 25 '13 at 13:35
As long as exists, ssh-keygen -y -e -f id_rsa will not check id_rsa at all but just return the value from So e.g. if you echo 5 > id_rsa to erase the private key, then do the diff, the diff will pass! Also, running ssh-keygen -yef foo where foo is not a valid key (and has no corresponding will block waiting for user input, so be careful using this in a script. – drewbenn Jul 10 '15 at 22:45

If they're on your local system, stick in your $HOME/.ssh/authorized_keys and ssh to localhost using the id_rsa key. If it works, then they match.

cat $HOME/.ssh/ >> $HOME/.ssh/authorized_keys
ssh -i $HOME/.ssh/id_rsa localhost
share|improve this answer

Depending on where you get the public key file you are testing, the accepted answer may give false positive results. This is because of the behavior described in the comment by @drewbenn. Specifically, when the -e option is used with the private key file as the -f option parameter, it simply parrots (but reformats) what's in the associated public key file.

In other words,

ssh-keygen -y -f id_rsa

(apparently) generates the public key value, and

ssh-keygen -y -e -f id_rsa

simply and outputs (and reformats) the key in the existing whatever it is.

In my case, I have to verify that the pair has not been corrupted. So, I decided to compare the following:

ssh-keygen -y -f id_rsa | cut -d' ' -f 2


cat | cut -d' ' -f 2


diff <(cat | cut -d' ' -f 2) <(ssh-keygen -y -f id_rsa | cut -d' ' -f 2)

Perhaps this is not as flexible, but it is better for my needs. Maybe it helps someone else.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.