(note this question uses both 'openssh' and 'openssl' in the text, I am not confusing the two.)

If I use openssh to general an RSA keypair (ssh-keygen) then I can use 'openssl rsa -in ...' to view the key parameters (modulus, exponents, primes etc).

If I generate an RSA key but store it using the openssh format (using the -o option to ssh-keygen) I cannot directly read that file by openssl. I first use ssh-keygen -p -f and remove the password. The resulting file is an "RSA PRIVATE KEY". Then I can proceed in the usual way with openssl to view the parameters.

Using openssl's 'ec' and 'ecparam' commands I can generate files and view the parameters that make up EC keys.

If I generate an ed25519 keypair using ssh-keygen -t ed25519 I get a file of the format "OPENSSH PRIVATE KEY".

Obviously if I use 'ssh-keygen -p ...' as above on this file I'm never going to get an 'RSA' output because its not an RSA key.

So how can I get my "OPENSSH PRIVATE KEY" file generated by ssh-keygen using ed25519 into a format such that I can see the parameters?

openssl EC commands produce files such as "BEGIN EC PARAMETERS" and "BEGIN EC PRIVATE KEY".

So is there a method to see the ed25519 parameters in the OPENSSH PRIVATE KEY? or a method to turn that file format into one of the EC formats that openssl understands?


TLDR: (because now-anonymous editor prohibits use of bold): you can't convert to OpenSSL

UPDATED 2021-02: You can't convert an OpenSSH ed25519 key to a form supported by OpenSSL. At the date of the Q and original A, OpenSSL didn't support any stored form of ed25519 key, nor the Ed25519 (or any other EdDSA) algorithm. It did support X25519 for TLS keyexchange, but that uses only transient keys, which don't need any storage format. OpenSSL 1.1.1, released later in the same month of Sep. 2018, does support Ed25519 and Ed448 (and X25519 and X448) using PKCS8 format for privatekey. However, ssh-keygen (OpenSSH) can't write an Ed25519 key in this OpenSSL-compatible format, and OpenSSL can't read the OpenSSH-proprietary format used for it since 6.5 (and other types also by default since 7.8).

Ed25519 doesn't require any parameters, and the OpenSSH keyfile format doesn't store any for it; Ed25519 is defined as EdDSA instantiated (parameterized) for Bernstein's curve25519 (in Edwards form) which defines all the needed parameters. See RFCs 8032 and 7748 for details.

For the EC algorithms defined by X9 and SECG which are standardly called ECDSA and ECDH, OpenSSL uses the parameters defined in those standards, which support only elliptic curves with equations expressed in short Weierstrass form. Bernstein's curve25519 (and curve448) use Montgomery and Edwards forms instead, for reasons discussed at some length in the papers on his website, and in any case the EdDSA algorithm is different from the ECDSA algorithm. But this is no longer relevant.

If you don't want to use the key with OpenSSL, but just would like to know what it is, ssh-keygen -y already outputs the public key in OpenSSH's preferred form, which is the typename in ASCII ssh-ed25519 plus the base64 encoding of the (SSH2) wire format, which in turn is 4 bytes length + typename + 4 bytes length + 32 bytes public key (using the encoding defined in RFC8032). If you really want the private key, you can first decrypt the file with ssh-keygen -p (making sure not to put any copy where an evil-doer could get it), and dump with e.g. od -tx1; the publickey blob starts at offset 053 with length 063 (both octal), and the normally-but-not-now-encrypted part starts at offset 0142 with length 0210 ditto which is 8 bytes check, then the private 'blob' which is 4 bytes length + 32 bytes copy of the public key + 4 bytes length + 64 bytes API 'secret' key of which only 32 bytes are really the private key and the rest is another(!) copy of the public key, then 4 bytes length + comment.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.