sshpk-conv(1)

💖 sshpk-conv — bestie's guide to key glow-ups 💖

okay so this lil page lives in the sshpk Commands manual, and it's literally just... converting keys between formats? iconic behaviour, honestly.

✨ NAME ✨

sshpk-conv — convert between key formats 🦋

---

✨ SYNOPSYS ✨

(yes that's how the original spells it, and yes I'm keeping it, it's part of the vibe)

sshpk-conv -t FORMAT [FILENAME] [OPTIONS...]

sshpk-conv -i [FILENAME] [OPTIONS...]

---

✨ DESCRIPTION ✨

So the whole thing is: it reads in a public or private key and converts it between different formats — especially the formats the SSH protocol uses and the well-known PEM PKCS#1/7 formats. That's the job. That's the whole assignment. 💅

And then there's the second form: if you give it the -i option, it doesn't convert anything, it just identifies a key and prints info about its nature, size and fingerprint — to stderr. Slay.

---

✨ EXAMPLES ✨

okay imagine we've got this SSH-format public key sitting in id_ecdsa.pub:

ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTI...9M/4c4= user@host

Identify it with -i:

$ sshpk-conv -i id_ecdsa.pub
id_ecdsa: a 256 bit ECDSA public key
ECDSA curve: nistp256
Comment: user@host
Fingerprint:
  SHA256:vCNX7eUkdvqqW0m4PoxQAZRv+CM4P4fS8+CbliAvS4k
  81:ad:d5:57:e5:6f:7d:a2:93:79:56:af:d7:c0:38:51

Convert it to pkcs8 format, for use with e.g. OpenSSL:

$ sshpk-conv -t pkcs8 id_ecdsa
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEAsA4R6N6AS3gzaPBeLjG2ObSgUsR
zOt+kWJoijLnw3ZMYUKmAx+lD0I5XUxdrPcs1vH5f3cn9TvRvO9L0z/hzg==
-----END PUBLIC KEY-----

Retrieve the public half of a private key:

$ openssl genrsa 2048 | sshpk-conv -t ssh -c foo@bar
ssh-rsa AAAAB3NzaC1yc2EAAA...koK7 foo@bar

Convert a private key to PKCS#1 (OpenSSL) format from a new-style OpenSSH key format (the ssh-keygen -o format):

$ ssh-keygen -o -f foobar
...
$ sshpk-conv -p -t pkcs1 foobar
-----BEGIN RSA PRIVATE KEY-----
MIIDpAIBAAKCAQEA6T/GYJndb1TRH3+NL....
-----END RSA PRIVATE KEY-----

---

✨ OPTIONS ✨

• -i, --identify — don't convert anything bestie, just spit out identifying info about the key to stderr — its type, size and fingerprints. 🫶
• -p, --private — treat the key as a private key instead of a public one (public is the default). Heads up: if you hand sshpk-conv a private key and don't give this option, it'll extract only the public half from it and work with that. so like... it takes the public half. no cap. 😭
• -f PATH, --file=PATH — the input file to grab the key from, instead of stdin. And if you just pass a filename as a positional argument? that's equivalent to using this option. same energy, different spelling. ✨
• -o PATH, --out=PATH — output file name to use instead of stdout. 📝
• -T FORMAT, --informat=FORMAT
• -t FORMAT, --outformat=FORMAT — these two pick the input and output formats to be used (peep the FORMATS section right below, bestie).
• -c TEXT, --comment=TEXT — sets the key comment for the output file, if supported. 💬

---

✨ FORMATS ✨

Currently supported formats, ranked in no particular order because they're all valid:

• pem, pkcs1 — the standard PEM format, used by older OpenSSH and most TLS libraries such as OpenSSL. The classic id_rsa file is usually in this format. It's an ASN.1 encoded structure, base64-encoded and placed between PEM headers. 💜
• ssh — the SSH public key text format (i.e. the format of an id_rsa.pub file). A single line, containing 3 space separated parts: the key type, key body and optional key comment. 🌸
• pkcs8 — a newer PEM format, usually used only for public keys by TLS libraries such as OpenSSL. The ASN.1 structure is more generic than that of pkcs1. ✨
• openssh — the new ssh-keygen -o format from OpenSSH. Lowkey it can be mistaken for a PEM encoding but it's actually an OpenSSH internal format. don't get got. 🙈
• rfc4253 — the internal binary format of keys when sent over the wire in the SSH protocol. This is also the format that the ssh-agent uses in its protocol. 👑

---

✨ SEE ALSO ✨

ssh-keygen(1), openssl(1) — go read those too, they're the co-stars 💖

---

✨ BUGS ✨

🚨 Encrypted (password-protected) keys are not supported. 🚨 like, at all. don't come for me, it's just not happening. 💀

Report bugs at Github ⟨https://github.com/arekinath/node-sshpk/issues⟩ — the link is right there, use it, tell them everything. 🐛

---

sshpk · Jan 2016 — that's the source and the date bestie, and that's the whole page. go forth and convert some keys, you're gonna ate. 💅✨🎀🦋💖