| 1 | .TH sshpk\-conv 1 "Jan 2016" sshpk "sshpk Commands"
|
|---|
| 2 | .SH NAME
|
|---|
| 3 | .PP
|
|---|
| 4 | sshpk\-conv \- convert between key formats
|
|---|
| 5 | .SH SYNOPSYS
|
|---|
| 6 | .PP
|
|---|
| 7 | \fB\fCsshpk\-conv\fR \-t FORMAT [FILENAME] [OPTIONS...]
|
|---|
| 8 | .PP
|
|---|
| 9 | \fB\fCsshpk\-conv\fR \-i [FILENAME] [OPTIONS...]
|
|---|
| 10 | .SH DESCRIPTION
|
|---|
| 11 | .PP
|
|---|
| 12 | Reads in a public or private key and converts it between different formats,
|
|---|
| 13 | particularly formats used in the SSH protocol and the well\-known PEM PKCS#1/7
|
|---|
| 14 | formats.
|
|---|
| 15 | .PP
|
|---|
| 16 | In the second form, with the \fB\fC\-i\fR option given, identifies a key and prints to
|
|---|
| 17 | stderr information about its nature, size and fingerprint.
|
|---|
| 18 | .SH EXAMPLES
|
|---|
| 19 | .PP
|
|---|
| 20 | Assume the following SSH\-format public key in \fB\fCid_ecdsa.pub\fR:
|
|---|
| 21 | .PP
|
|---|
| 22 | .RS
|
|---|
| 23 | .nf
|
|---|
| 24 | ecdsa\-sha2\-nistp256 AAAAE2VjZHNhLXNoYTI...9M/4c4= user@host
|
|---|
| 25 | .fi
|
|---|
| 26 | .RE
|
|---|
| 27 | .PP
|
|---|
| 28 | Identify it with \fB\fC\-i\fR:
|
|---|
| 29 | .PP
|
|---|
| 30 | .RS
|
|---|
| 31 | .nf
|
|---|
| 32 | $ sshpk\-conv \-i id_ecdsa.pub
|
|---|
| 33 | id_ecdsa: a 256 bit ECDSA public key
|
|---|
| 34 | ECDSA curve: nistp256
|
|---|
| 35 | Comment: user@host
|
|---|
| 36 | Fingerprint:
|
|---|
| 37 | SHA256:vCNX7eUkdvqqW0m4PoxQAZRv+CM4P4fS8+CbliAvS4k
|
|---|
| 38 | 81:ad:d5:57:e5:6f:7d:a2:93:79:56:af:d7:c0:38:51
|
|---|
| 39 | .fi
|
|---|
| 40 | .RE
|
|---|
| 41 | .PP
|
|---|
| 42 | Convert it to \fB\fCpkcs8\fR format, for use with e.g. OpenSSL:
|
|---|
| 43 | .PP
|
|---|
| 44 | .RS
|
|---|
| 45 | .nf
|
|---|
| 46 | $ sshpk\-conv \-t pkcs8 id_ecdsa
|
|---|
| 47 | \-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-
|
|---|
| 48 | MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEAsA4R6N6AS3gzaPBeLjG2ObSgUsR
|
|---|
| 49 | zOt+kWJoijLnw3ZMYUKmAx+lD0I5XUxdrPcs1vH5f3cn9TvRvO9L0z/hzg==
|
|---|
| 50 | \-\-\-\-\-END PUBLIC KEY\-\-\-\-\-
|
|---|
| 51 | .fi
|
|---|
| 52 | .RE
|
|---|
| 53 | .PP
|
|---|
| 54 | Retrieve the public half of a private key:
|
|---|
| 55 | .PP
|
|---|
| 56 | .RS
|
|---|
| 57 | .nf
|
|---|
| 58 | $ openssl genrsa 2048 | sshpk\-conv \-t ssh \-c foo@bar
|
|---|
| 59 | ssh\-rsa AAAAB3NzaC1yc2EAAA...koK7 foo@bar
|
|---|
| 60 | .fi
|
|---|
| 61 | .RE
|
|---|
| 62 | .PP
|
|---|
| 63 | Convert a private key to PKCS#1 (OpenSSL) format from a new\-style OpenSSH key
|
|---|
| 64 | format (the \fB\fCssh\-keygen \-o\fR format):
|
|---|
| 65 | .PP
|
|---|
| 66 | .RS
|
|---|
| 67 | .nf
|
|---|
| 68 | $ ssh\-keygen \-o \-f foobar
|
|---|
| 69 | \&...
|
|---|
| 70 | $ sshpk\-conv \-p \-t pkcs1 foobar
|
|---|
| 71 | \-\-\-\-\-BEGIN RSA PRIVATE KEY\-\-\-\-\-
|
|---|
| 72 | MIIDpAIBAAKCAQEA6T/GYJndb1TRH3+NL....
|
|---|
| 73 | \-\-\-\-\-END RSA PRIVATE KEY\-\-\-\-\-
|
|---|
| 74 | .fi
|
|---|
| 75 | .RE
|
|---|
| 76 | .SH OPTIONS
|
|---|
| 77 | .TP
|
|---|
| 78 | \fB\fC\-i, \-\-identify\fR
|
|---|
| 79 | Instead of converting the key, output identifying information about it to
|
|---|
| 80 | stderr, including its type, size and fingerprints.
|
|---|
| 81 | .TP
|
|---|
| 82 | \fB\fC\-p, \-\-private\fR
|
|---|
| 83 | Treat the key as a private key instead of a public key (the default). If you
|
|---|
| 84 | supply \fB\fCsshpk\-conv\fR with a private key and do not give this option, it will
|
|---|
| 85 | extract only the public half of the key from it and work with that.
|
|---|
| 86 | .TP
|
|---|
| 87 | \fB\fC\-f PATH, \-\-file=PATH\fR
|
|---|
| 88 | Input file to take the key from instead of stdin. If a filename is supplied
|
|---|
| 89 | as a positional argument, it is equivalent to using this option.
|
|---|
| 90 | .TP
|
|---|
| 91 | \fB\fC\-o PATH, \-\-out=PATH\fR
|
|---|
| 92 | Output file name to use instead of stdout.
|
|---|
| 93 | .PP
|
|---|
| 94 | \fB\fC\-T FORMAT, \-\-informat=FORMAT\fR
|
|---|
| 95 | .TP
|
|---|
| 96 | \fB\fC\-t FORMAT, \-\-outformat=FORMAT\fR
|
|---|
| 97 | Selects the input and output formats to be used (see FORMATS, below).
|
|---|
| 98 | .TP
|
|---|
| 99 | \fB\fC\-c TEXT, \-\-comment=TEXT\fR
|
|---|
| 100 | Sets the key comment for the output file, if supported.
|
|---|
| 101 | .SH FORMATS
|
|---|
| 102 | .PP
|
|---|
| 103 | Currently supported formats:
|
|---|
| 104 | .TP
|
|---|
| 105 | \fB\fCpem, pkcs1\fR
|
|---|
| 106 | The standard PEM format used by older OpenSSH and most TLS libraries such as
|
|---|
| 107 | OpenSSL. The classic \fB\fCid_rsa\fR file is usually in this format. It is an ASN.1
|
|---|
| 108 | encoded structure, base64\-encoded and placed between PEM headers.
|
|---|
| 109 | .TP
|
|---|
| 110 | \fB\fCssh\fR
|
|---|
| 111 | The SSH public key text format (the format of an \fB\fCid_rsa.pub\fR file). A single
|
|---|
| 112 | line, containing 3 space separated parts: the key type, key body and optional
|
|---|
| 113 | key comment.
|
|---|
| 114 | .TP
|
|---|
| 115 | \fB\fCpkcs8\fR
|
|---|
| 116 | A newer PEM format, usually used only for public keys by TLS libraries such
|
|---|
| 117 | as OpenSSL. The ASN.1 structure is more generic than that of \fB\fCpkcs1\fR\&.
|
|---|
| 118 | .TP
|
|---|
| 119 | \fB\fCopenssh\fR
|
|---|
| 120 | The new \fB\fCssh\-keygen \-o\fR format from OpenSSH. This can be mistaken for a PEM
|
|---|
| 121 | encoding but is actually an OpenSSH internal format.
|
|---|
| 122 | .TP
|
|---|
| 123 | \fB\fCrfc4253\fR
|
|---|
| 124 | The internal binary format of keys when sent over the wire in the SSH
|
|---|
| 125 | protocol. This is also the format that the \fB\fCssh\-agent\fR uses in its protocol.
|
|---|
| 126 | .SH SEE ALSO
|
|---|
| 127 | .PP
|
|---|
| 128 | .BR ssh-keygen (1),
|
|---|
| 129 | .BR openssl (1)
|
|---|
| 130 | .SH BUGS
|
|---|
| 131 | .PP
|
|---|
| 132 | Encrypted (password\-protected) keys are not supported.
|
|---|
| 133 | .PP
|
|---|
| 134 | Report bugs at Github
|
|---|
| 135 | \[la]https://github.com/arekinath/node-sshpk/issues\[ra]
|
|---|
