(note this question uses both 'openssh' and 'openssl' in the text, I am not confusing the two.)

If I use openssh to general an RSA keypair (ssh-keygen) then I can use 'openssl rsa -in ...' to view the key parameters (modulus, exponents, primes etc).

If I generate an RSA key but store it using the openssh format (using the -o option to ssh-keygen) I cannot directly read that file by openssl. I first use ssh-keygen -p -f and remove the password. The resulting file is an "RSA PRIVATE KEY". Then I can proceed in the usual way with openssl to view the parameters.

Using openssl's 'ec' and 'ecparam' commands I can generate files and view the parameters that make up EC keys.

If I generate an ed25519 keypair using ssh-keygen -t ed25519 I get a file of the format "OPENSSH PRIVATE KEY".

Obviously if I use 'ssh-keygen -p ...' as above on this file I'm never going to get an 'RSA' output because its not an RSA key.

So how can I get my "OPENSSH PRIVATE KEY" file generated by ssh-keygen using ed25519 into a format such that I can see the parameters?

openssl EC commands produce files such as "BEGIN EC PARAMETERS" and "BEGIN EC PRIVATE KEY".

So is there a method to see the ed25519 parameters in the OPENSSH PRIVATE KEY? or a method to turn that file format into one of the EC formats that openssl understands?


You can not convert an OpenSSH ed25519 key to a form supported by OpenSSL, because OpenSSL doesn't (by the day of writing this answer) support any stored form of ed25519 key, nor the Ed25519 (or EdDSA) algorithms. It does support X25519 for TLS keyexchange, but that uses only transient keys, so they don't need any storage format.

Ed25519 doesn't require any parameters, and the OpenSSH keyfile format doesn't store any for it; Ed25519 is defined as EdDSA instantiated (parameterized) for Bernstein's curve25519 (in Edwards form) which defines all the needed parameters. See RFCs 8032 and 7748 for details.

The EC parameters and key structures used by OpenSSL are those defined by X9 and SECG (i.e. Certicom), which support only elliptic curves with equations expressed in short Weierstrass form. Although curve25519 can be expressed in Weierstrass form, X25519 and Ed25519 do not do so; they use Montgomery and Edwards forms instead, for reasons discussed at some length in the papers on Bernstein's website, and in any case the EdDSA algorithm is different from the ECDSA algorithm, so even if you use the Weierstrass-form curve it isn't interoperable.

If you don't want to use the key with OpenSSL, but just would like to know what it is, ssh-keygen -y already outputs the public key in OpenSSH's preferred form, which is the typename in ASCII ssh-ed25519 plus the base64 encoding of the (SSH2) wire format, which in turn is 4 bytes length + typename + 4 bytes length + 32 bytes public key. If you really want the private key, you can first decrypt the file with ssh-keygen -p (making sure not to put any copy where an evil-doer could get it), and dump with e.g. od -tx1; the publickey blob starts at offset 053 with length 063 both octal (see above for contents), and the normally-but-not-now-encrypted part starts at offset 0142 with length 0210 ditto which is 8 bytes check, then the private 'blob' which is 4 bytes length + 32 bytes copy of the public key + 4 bytes length + 64 bytes API 'secret' key of which only 32 bytes are really the private key and the rest is another(!) copy of the public key, then 4 bytes length + comment.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.