.PUB

Introduction

When OpenSSH’s ssh-keygen makes a key pair, it writes the private key to a file such as id_ed25519 and the public key to the same name with .pub added. The public key is the half that is shared: it is pasted into a server’s authorized_keys file, or into GitHub and other services, to allow signing in with the private key.

The private key file has no extension. Since OpenSSH 7.8 it is written in OpenSSH’s own format, between -----BEGIN OPENSSH PRIVATE KEY----- lines.

Structure

A public key file is one line of text with three fields separated by spaces: the key type, the key itself in base64, and a comment, often the user and machine that made it. Lines in authorized_keys have the same form, optionally preceded by options such as from="…".

The base64 field decodes to the key in SSH’s wire format: a series of length-prefixed values, starting with the key type again. An RSA key continues with the public exponent and the modulus; an Ed25519 key with its 32-byte public key.

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI… alice@laptop

Links