The command

ssh-keygen -lf /etc/ssh/ssh_host_rsa_key.pub

prints the 128-bit fingerprint of the RSA key.

What is the command to get the 160-bit fingerprint of a RSA key?

  • Why do you expect a 160-bit fingerprint? What tool supports this? – Gilles 'SO- stop being evil' Jul 31 at 13:47
  • I'm troubleshooting an obscure piece of software which connects to a SSH server and outputs the host key as a 40-hex digits (160 bits) fingerprint. – dr01 Jul 31 at 13:53

The key fingerprint is a hash of the key material. In a public key file, the key material is the second whitespace-separated field on the line, encoded in base64. The display format for the fingerprint depends on the hash that's being used.

The 128-bit fingerprint uses MD5 and is displayed in hexadecimal. For example, the following commands display the same fingerprint, with different punctuation and surrounding material:

ssh-keygen -f /etc/ssh/ssh_host_rsa_key.pub -l -E md5
</etc/ssh/ssh_host_rsa_key.pub awk '{print $2}' | base64 -d | md5sum

The SHA256 fingerprint (256 bits) is displayed in Base64. Again, here are two commands to display the fingerprint.

ssh-keygen -f /etc/ssh/ssh_host_rsa_key.pub -l -E sha256
</etc/ssh/ssh_host_rsa_key.pub awk '{print $2}' | base64 -d | openssl sha -sha256 -binary | base64

If you need a 160-bit fingerprint, it's using SHA-1, which was never commonly supported (I think SHA-1 wasn't introduced as an alternative to MD5 until a time when SHA-1 itself was deprecated). Current versions of OpenSSH don't support it, but you can use either of the alternative methods above with sha1 instead of md5 or sha256, depending on whether you need the hex or base64 format.

  • Thank you. The command I used was < /etc/ssh/ssh_host_rsa_key.pub awk '{print $2}' | base64 -d | openssl sha1, and it effectively printed the hash in hex format, which was what I needed. – dr01 Aug 2 at 6:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.