I seem to be not able to generate a RSA-4096 SSH key in OpenSSH's new key format with the following command:
$ ssh-keygen \ -f rsa4096_key \ -t rsa \ -b 4096 \ -C 'This is a test' \ -o \ -N ''
At least I get the following error message after trying to change the existing comment of the RSA-4096 SSH key:
$ ssh-keygen -cf rsa4096_key Comments are only supported for keys stored in the new format (-o).
So even though I specified the
-o flag during key generation the RSA-4096 SSH key seems to be written in the old PEM key format instead of OpenSSH's new key format.
N.B. For an Ed25519 SSH key I'm able to retroactively change its comment.
According to the manpage
SSH-KEYGEN(1) of OpenSSH version
-o Causes ssh-keygen to save private keys using the new OpenSSH format rather than the more compatible PEM format. The new format has increased resistance to brute-force password cracking but is not supported by versions of OpenSSH prior to 6.5. Ed25519 keys always use the new private key format.
Does someone has a solution to this problem or can tell me what I did wrong? Thanks!
Update: The solution proposed by @slm works for me albeit the misleading manpage and confusing console output. Basically the command:
$ ssh-keygen -f rsa4096_key -o -c -C 'here goes your comment' Key now has comment 'This is a test' The comment in your key file has been changed.
When run again it proves that it changed the comment to the one given on the previous command line:
$ ssh-keygen -f rsa4096_key -o -c -C 'Hello World!' Key now has comment 'here goes your comment' The comment in your key file has been changed.
Therefore I accepted @slm's answer.