23

I have a public key in the format:

---- BEGIN SSH2 PUBLIC KEY ----

Comment: "somename-20060227"
AAAAB3NzaC1yc2EAAAABJQAAAIBmhLUTJiP[and so on]==

---- END SSH2 PUBLIC KEY ----

Usually I see keys in the format like this:

ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIEAqof[and so on]

Can I just copy the first key in the authorized_keys file or do I have to modify it somehow so it looks like the second one? I think the first one was generated by PUTTYgen while the second one was generated by ssh-keygen.

1
  • Puttygen generates both. On Windows the GUI box cleverly labeled "Public key for pasting into OpenSSH authorized_keys" is the OpenSSH format, but the button SavePublicKey or the equivalent item in the File menu gives the RFC4716/Tectia format. On Unix you specify -O public-openssh or -O public. Mar 6 at 2:32

5 Answers 5

20

use ssh-keygen -i to convert SSH2-compatible format to OpenSSH compatible format.

from man ssh-keygen:

-i This option will read an unencrypted private (or public) key file in SSH2-compatible format and print an OpenSSH compatible private (or public) key to stdout. ssh-keygen also reads the RFC 4716 SSH Public Key File Format. This option allows importing keys from several commercial SSH implementations.

&

-f filename
        Specifies the filename of the key file.

example:

ssh-keygen -i -f ssh2.pub

2
  • partial answer, does not help at all.
    – karatedog
    Mar 17, 2021 at 10:19
  • Incomplete answer, one might try ssh-key -i the-file.pub but that doesn't work.
    – kizzx2
    Mar 2, 2023 at 8:02
11

This is the complete, correct answer:

ssh-keygen -i -m PKCS8 -f public-key.pem

2
  • 1
    "RFC4716" is the default key_format, and -m does appear to be for specifying the format of the INPUT in this instance, not the output, so you are correct.
    – JimNim
    Mar 28, 2018 at 15:42
  • Technically alexus' "correct" answer is NOT wrong though, as that answer is not spelling out full syntax - only pointing to which primary flag should be used, leaving the need to check -i syntax/usage in the man page.
    – JimNim
    Mar 28, 2018 at 15:48
4

You do have to convert the public key to openssh convention:

ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIBmhLUTJiP[and so on]== somename-20060227

Also make sure that the key occupies exactly one line and no line breaks were introduced while copying.

3

Just rewrite your key in format suited for authorized_keys:

keytype keybody keyname

Keep in mind that trailing "==" are necessary placeholders to keep keylength equal to desired length.

2
  • 6
    The trailing "==" are Base64 padding
    – Andrew
    Apr 18, 2012 at 14:46
  • how do I know if its RSA or DSA?
    – Björn
    Apr 18, 2012 at 16:07
0

To create public keys for a number of password encrypted private keys the following script will:

  1. Read the private key with ssh-keygen -e and output a public key - and ask for the private key password
  2. Create a PEM based public key and store in an environment variable
  3. Use ssh-keygen -i to create and OpenSSH compatible public key
  4. And write to a .pub output file
for i in $(ls -1 id_rsa_* | grep -v "\.pub$")  # Ignore .pub files
do
  PEM=$(ssh-keygen -e -f $i -m PEM)  # Will ask for the private key password
  echo $(ssh-keygen -i -m PEM -f <(echo "$PEM")) KEY-ALIAS > $i.pub
done

A side note, seahorse, the Ubuntu "Passwords and keys" agent, requires the public keys to be able to store the private keys.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .