, https://r00t2.io"><br>OpenSSH Key Structure Guide

OpenSSH Key Structure Guide

brent saner , https://r00t2.io

Last updated 2025-09-02 21:33:25 -0400

Table of Contents

1. Purpose

2. Basic Introduction

2.1. Legacy

2.1.1. Private Keys

2.1.2. Public Keys

2.2. New "v1" Format

2.2.1. Private Keys

2.2.2. Public Keys

3. Keytype-Specific Breakdowns

3.1. RSA

3.1.1. Public

3.1.1.1. Structure

3.1.1.2. Example

3.1.2. Private

3.1.2.1. Legacy (Plain)

3.1.2.1.1. Structure

3.1.2.1.2. Example

3.1.2.2. Legacy (Encrypted)

3.1.2.2.1. Structure

3.1.2.2.2. Example

3.1.2.3. v1 (Plain)

3.1.2.3.1. Structure

3.1.2.3.2. Example

3.1.2.4. v1 (Encrypted)

3.1.2.4.1. Structure

3.1.2.4.2. Example

3.2. ED25519

3.2.1. Public

3.2.1.1. Structure

3.2.1.2. Example

3.2.2. Private

3.2.2.1. Legacy

3.2.2.2. v1 (Plain)

3.2.2.2.1. Structure

3.2.2.2.2. Example

3.2.2.3. v1 (Encrypted)

3.2.2.3.1. Structure

3.2.2.3.2. Example

4. Further Information

1. Purpose

This document attempts to present a much more detailed, thorough, and easily-understood form of the key formats used by OpenSSH. The extent of those formats' canonical documentation is the OpenSSH source tree’s PROTOCOL.key, which is a little lacking.

2. Basic Introduction

2.1. Legacy

2.1.1. Private Keys

In OpenSSH pre-7.8, private keys are stored in their respective PEM encoding[1] with no modification. These legacy private keys should be entirely usable by OpenSSL/LibreSSL/GnuTLS etc. natively with no conversion necessary.

2.1.2. Public Keys

Each public key file (*.pub) is written out in the following format:

A B C

Where:

The key type (e.g. ssh-rsa, ssh-ed25519, etc.)

The public key itself, Base64[2]-encoded

The key’s comment

The structures specified in the breakdowns later in this document describe the decoded version of B only . They are specific to each keytype and format version starting with item 2.0.

2.2. New "v1" Format

2.2.1. Private Keys

Private key structures have been retooled in the "v1" format. In recent OpenSSH versions, all new keys use the v1 format. They no longer are in straight PEM-compatible format.

Refer to PROTOCOL.key (GitHub mirror) for a (very) general description, or each key type’s specific breakdown in this document for more detailed information.

The v1 format offers several benefits over the legacy format, including:

customizable key derivation and encryption ciphers for encrypted private keys

embedded comments

embedded public key (no need to derive from the private key)

"checksumming" to confirm proper decryption for encrypted keys

2.2.2. Public Keys

All public keys in v1 continue to use the same packed binary format as the legacy format.

3. Keytype-Specific Breakdowns

3.1. RSA

RSA[3] is a widely-supported PKI system. It is ubiquitous, but it is recommended to use newer systems (e.g. ED25519) for OpenSSH if all clients and destinations support it.

The key structures have references to the RSA notations in single quotes. You can find these enumerated in RFC 8017 § 2 or RFC 8017 § 3.2. See also the Wikipedia article.

It is highly recommended to use 4096-bit RSA if using RSA keys.

3.1.1. Public

3.1.1.1. Structure

Public keys are stored in the following structure:

Key Structure

0 uint32 allocator for 0.0 (4 bytes)<br>0.0 Public key type string (ASCII bytes)<br>1 uint32 allocator for 1.0 (4 bytes)<br>1.0 Public exponent ('e') (hex numeric)<br>2 uint32 allocator for 2.0 (4 bytes)<br>2.0 modulus ('n') (bytes)

3.1.1.2. Example

.pub format

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC3zsBGAc4qEvDJJMuaMOuZAGaBLLFDaRk/MLK5/dSvyzAMkY8qd9ZEEPNheufIyjGMJX08TfTixBCLu+k6holLoUs1dfL3IVC8OB3L+3QsehloZv0xhKzpZ2Gt2g/CmS9shm11aZGfwi2cS/DeQFqMdtUZqipTKdxoJXdyKaXQt1OnglqJuVJ1+cAl4hU0PGyIzWaQoiH4rp72de5GTcfRGNpBBQfqXWtkid1gr9imZGSS2z4nnxp4JA24q72mxQcUyWNmUKcggef6XUcsFCiwfq5dFbZOoeKnUIUS/pq2VfhqMTSG08yh3Y6QrMXJ+6TW52dQf7q586f2jHSBQq8qNwHTGoqbdRGViqdxh7pwLtk004WvzuQjgOleDn6bwPTSM2f8dwN0Fnt/CSb7b9ttBarRz9GRgkhFsBThgVO/DR08Ox+tuyWj8dFR+baEYz2MFpD82MrQWqwq6yPb8Zo35ICgCJEDGcEW1HvZJLOZQlQ7iKD2EnlSstjhKQ8wKfVCrr6cDI42zzKWhlzWZDyJJNVm6/SXGAk5mhrAlv4e3Dtfhxv17wtNRODqJ2INIFFC4L/PZ3tNsCVTISGj8HRapNBYYzFzMleFWlzsvjrEQD0E/wzAxYt8BJBLQCElwrwqY6IOuzCcxvPmXbMBoFi42s4H5xs48/NZVDP2mxmPBw== This is a comment string

Structure Reference (Hex) (Decoded Base64 component only; AAA…​PBw==)

10<br>11<br>12<br>13<br>14<br>15<br>16<br>17<br>18<br>19<br>20<br>21<br>22<br>0 00000007 (7)<br>0.0 7373682d727361 ("ssh-rsa")<br>1 00000003 (3)<br>1.0 010001 (65537)<br>2 00000201 (513)<br>2.0...