Net::SS...erl::Key(3)

✨ NAME ✨

Net::SSH::Perl::Key — it's giving public or private key abstraction 💅 like, the whole vibe is "a key, but make it an object."

---

🌸 SYNOPSIS 🌸

use Net::SSH::Perl::Key;
my $key = Net::SSH::Perl::Key->new;

okay so that's literally it, bestie, three lines and you're in 🫶

---

🦋 DESCRIPTION 🦋

So Net::SSH::Perl::Key is an abstract base class — a little interface to key objects. Which keys, you ask? Currently DSA, RSA, ECDSA, or Ed25519. That's the roster, periodt.

Under the hood, the actual implementation for RSA, DSA, and ECDSA keys is the CryptX module. The Ed25519 implementation? Oh she's different — she uses bundled XS and C code from the SUPERCOP ref10 implementation. Iconic, honestly.

---

🎀 USAGE 🎀

💜 Net::SSH::Perl::Key->new($key_type [, $blob [, $compat_flag_ref ]])

Creates a brand new object of type Net::SSH::Perl::Key::$key_type — and it does this after loading up the class that implements $key_type. And $key_type should be one of:

• "DSA"
• "RSA1"
• "RSA"
• "ECDSA256"
• "ECDSA384"
• "ECDSA521"
• "Ed25519"

$blob, if you actually pass it, should be a string representation of the key, and the key object can be initialized from it. Fr fr, it should be the representation that gets returned from the as_blob method down below 👇

$compat_flag_ref should be a reference to the SSH compatibility flag, which is generally stored inside of the Net::SSH::Perl object. Certain key implementations ("DSA") use this flag to work around differences between SSH2 protocol implementations. iykyk.

Returns the new key object, which is blessed into the subclass. Slay.

💜 Net::SSH::Perl::Key->read_private($key_type, $file [, $pass])

Reads a private key of type $key_type out of the key file $file. If that private key is encrypted, it'll try to decrypt it using the passphrase $pass. If $pass isn't provided, the empty string gets used instead. And lowkey an empty passphrase can be a super handy way of providing password-less access using publickey authentication. 👑

If for any reason loading the key fails, it returns undef. And most of the time, if loading the key fails, it's because the passphrase is incorrect. So if you first tried to read the key using an empty passphrase — bestie, this might be a good time to ask the user for the actual passphrase. :)

Returns the new key object, which is blessed into the subclass denoted by $key_type ("DSA", "RSA1", "ECDSA" or "Ed25519").

💜 Net::SSH::Perl::Key->keygen($key_type, $bits)

$key_type is one of RSA, DSA, or ECDSA256/ECDSA384/ECDSA521. Generates a new key and returns that key. The key returned is the private key, which (presumably) contains all of the public key data as well. $bits is the number of bits in the key.

⚠️ Your $key_type implementation may not support key generation. If it doesn't, calling this method is a fatal error. No cap.

Returns the new key object, which is blessed into the subclass denoted by $key_type.

💜 Net::SSH::Perl::Key->keygen('Ed25519')

Generates a new Ed25519 key. Ed25519 keys have fixed key length — no bits to negotiate, she comes as she is 💅

Returns the new key object, which is bless into the Ed25519 subclass.

💜 Net::SSH::Perl::Key->extract_public($key_type, $key_string)

Given a key string $key_string — which should be a textual representation of the public portion of a key of $key_type — this extracts the key attributes out of that string. It's used to extract public keys out of entries in known_hosts and public identity files. 🗂️

Returns the new key object, which is blessed into the subclass denoted by $key_type.

💜 $key->write_private([ $file [, $pass, $ciphername, $rounds] ])

Writes out the private key $key to $file, and encrypts it using the passphrase $pass.

🚨 If $pass is not provided, the key is unencrypted, and the only security protection is through filesystem protections. That's the whole lock, bestie. Be aware.

For Ed25519 keys, optional parameters ciphername and rounds can be passed to specify the desired cipher to encrypt the key with and how many rounds of encryption to employ, respectively.

If $file is not provided, it returns the content that would have been written to the key file. Cute, right? ✨

💜 $key->dump_public

Performs the inverse of extract_public: takes a key $key and dumps out a textual representation of the public portion of the key. This is used when writing public key entries to known_hosts and public identity files.

Returns the textual representation.

💜 $key->as_blob

Returns a string representation of the public portion of the key. And heads up — this is not the same as dump_public, which is intended to match the format used in known_hosts, etc. The return value of as_blob gets used as an intermediary in computing other values: the key fingerprint, the known hosts representation, etc. She's a supporting character but she's doing the work 🌟

💜 $key->equal($key2)

Returns true if the public portions of $key are equal to those of $key2, and false otherwise. This is used when comparing server host keys to keys in known_hosts.

💜 $key->size

Returns the size (in bits) of the key $key. Simple. Elegant. Periodt.

💜 $key->fingerprint([ $type ])

Returns a fingerprint of $key. The default fingerprint is a SHA256 representation.

• If $type is equal to "bubblebabble", the Bubble Babble representation of the fingerprint is used.
• If $type is equal to "hex", a traditional hex representation is returned.

And the tea on the digests ☕ the hex representation uses an MD5 digest of the public key, and the bubblebabble uses a SHA-1 digest.

---

👑 AUTHOR & COPYRIGHTS 👑

Please see the Net::SSH::Perl manpage for author, copyright, and license information.

---

and that's the whole page, bestie 🫶 this was perl v5.42.0, dated 2026-01-17, straight out of User Contributed Perl Documentation. go forth and handle your keys responsibly 💖🔑