Encoding SSH RSA public key - openssh

This is a discussion on Encoding SSH RSA public key - openssh ; Hello, I'm trying to build a valid public ssh v2 RSA key from a java application but I have some problems understanding how the two numbers (e and n) are base64 encoded into ~/.ssh/id_rsa.pub or ~/.ssh/authorized_keys2 file. My question is ...

+ Reply to Thread
Results 1 to 3 of 3

Thread: Encoding SSH RSA public key

  1. Encoding SSH RSA public key

    Hello,

    I'm trying to build a valid public ssh v2 RSA key from a java
    application but I have some problems understanding how the two numbers
    (e and n) are base64 encoded into ~/.ssh/id_rsa.pub or
    ~/.ssh/authorized_keys2 file.

    My question is what exactly is encoded into the base64 string? For
    example for this public key:

    ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6p76zG+8aOkFZT1y4O+Y7n
    +n0jWo6eW3DDPWVMddrR6z37uUsCZXPm1a6Inogp4NOt6UNaa1 IrEtRkCWKF/kWoAzpVeJsJCXNc7EGzSBG9Q0JZ43F07X9mQHneUi+SKwDl/dp5O2Mnyi/az2OatyW1XNnpf94yJC1dhPnJSgXNAmp2R5Bq5qktzo0GMUfw1 1rdZzVNBMwgxZVp6mvuvgQFQ3xJVRIGE54IpW6iTXLOgxCSwL8 Xj37fI22wOg7mYlNMIzyy3vUqyx73e00VnxxVp0DcaM347bFvy rRSm3hnBVDmdbTjP/ryHobNpSbPrP6vzNVww5Y61OFyTa60OPjQ== robert@robert

    There must be options (optional), bits, e, n and comments (optional),
    but how are these represented before encoding? Are each of these data
    encoded to base64 separately and then concatenated? What exactly is
    encoded?

    Could anyone describe me the algorithm for obtaining the base64 string?
    I couldn't find it anywhere.

    Thanks,
    --
    Robert

    _______________________________________________
    openssh-unix-dev mailing list
    openssh-unix-dev@mindrot.org
    https://lists.mindrot.org/mailman/li...enssh-unix-dev


  2. Re: Encoding SSH RSA public key

    _______________________________________________
    openssh-unix-dev mailing list
    openssh-unix-dev@mindrot.org
    https://lists.mindrot.org/mailman/li...enssh-unix-dev

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.9 (GNU/Linux)

    iQIVAwUBSKNSAMzS7ZTSFznpAQK/tg/+OB8mD/KM6j/MmosiuzUynSXPREVa5/dZ
    CdvFaIUhW+u29YjSR25izoyV/ir2dmohoz9KNOQKF2qLy8EZ8+g4DbqCGq2zFRyw
    vJfRReCa695pTZUFw+MxFUFPlI13CueNadng9dd7bRulEtfUG0 PnqjZSfJeATV+J
    5hsw93z6Pjd0i9LHhewrBM4t//HtmFFoHeVDOFFIM1l8A58qm35a2U1qxu42KCUM
    s5Fb50iZiHsKc2bVuxxZZn9VzBGCS9/9hjCLrwf/K41m6o+v88rsocJJe3f6UVaM
    zkPB6zrFo7J44GWhoYoPVCKQF9YjoDKvv0W71ZfJFcAJt6Sk0x LceabD7JgaPo2J
    l51ibnY862ONVEOCiFKpccBdkqH1Zx07YrIVAh0W3Oj91UU44H 9NgG8/DFykgmKe
    GsMRb96Jd5P4k3HOWQNatenjuw8aHF6OKf3EuFTJypsD7oyq/xXY+DCqgaS7ICnS
    Goisla9+y0sHcLOUCYi38wZxPwwCXBparKrwm02ku2bsz/APJrUsz1PHOGifGxc9
    oXAPS/T9LARf9Sby4sBRUrpJSWY484Ne79/YwEe+xSq9+KBQG4iAIiF0AdyXOCdm
    0ogz7EqiN5x0BNYD87/lpMkKs1rNf3027iI9WGU6hcLuj3O1t4iC179eYE9jxnCW
    BLopxo77y+8=
    =IMjp
    -----END PGP SIGNATURE-----

  3. Re: Encoding SSH RSA public key

    Thanks, Daniel. You were right.

    On Wed, 2008-08-13 at 17:28 -0400, Daniel Kahn Gillmor wrote:
    > On Wed 2008-08-13 10:54:02 -0400, robert wrote:
    >
    > > There must be options (optional), bits, e, n and comments (optional),
    > > but how are these represented before encoding? Are each of these data
    > > encoded to base64 separately and then concatenated? What exactly is
    > > encoded?
    > >
    > > Could anyone describe me the algorithm for obtaining the base64 string?
    > > I couldn't find it anywhere.

    >
    > The format for the base64-encded data (the unreadable stuff in the
    > middle of the line) appears to be:
    >
    > A series of length-prefixed bitstrings, where the length for each
    > bitstring is encoded as a network-order, 32-bit unsigned integer
    > representing the number of bytes in the following bitstring.
    >
    > The first bitstring indicates the type of the key. This can be used
    > to determine the nature of the bitstrings which follow. The type is
    > represented by a 7-byte string ("ssh-rsa" or "ssh-dss"), so the first
    > 4 bytes are 0x00,0x00,0x00,0x07 (this indicates the length of the
    > type string).
    >
    > For RSA keys, the exponent follows next as a multi-precision integer
    > (MPI), and then the modulus (also an MPI).
    >
    > So for example, for a 2048-bit key, you can unpack it this way:
    >
    > [0 dkg@squeak ~]$ < ./.example/id_rsa.pub cut -f2 -d\ | base64 -d | hd | head -n2
    > 00000000 00 00 00 07 73 73 68 2d 72 73 61 00 00 00 03 01 |....ssh-rsa.....|
    > 00000010 00 01 00 00 01 01 00 c4 68 99 07 36 4f d4 7a 35 |........h..6O.z5|
    > [0 dkg@squeak ~]$
    >
    > the example above uses a 3-byte exponent of 0x10001 (65537), followed
    > by a 257(==0x101)-byte modulus, which is the rest of the key.
    >
    > Be careful that your MPIs all have the first bit set to 0, though!
    > OpenSSH appears to treat the MPIs as a two's-complement signed
    > representation, so if your first bit is a 1, ssh will think you're
    > trying to provide a negative value. If your calculations produce a
    > number with the high bit set to 1, just increase the length by another
    > byte and pad the beginning with 0x00 to keep it positive. (this is
    > why the modulus above is 257 bytes starting with 0x00,0xc4 instead of
    > 256 starting with 0xc4,0x68).
    >
    > Hope this is helpful,
    >
    > --dkg
    > _______________________________________________
    > openssh-unix-dev mailing list
    > openssh-unix-dev@mindrot.org
    > https://lists.mindrot.org/mailman/li...enssh-unix-dev


    _______________________________________________
    openssh-unix-dev mailing list
    openssh-unix-dev@mindrot.org
    https://lists.mindrot.org/mailman/li...enssh-unix-dev


+ Reply to Thread