Skip to content

standard for authorized_keys format? #2117

@simonLeary42

Description

@simonLeary42

Here is the implementation:

$parts = explode(' ', $key, 3);
if (!isset($parts[1])) {
$key = base64_decode($parts[0]);
$comment = false;
} else {
$asciiType = $parts[0];
self::checkType($parts[0]);
$key = base64_decode($parts[1]);
$comment = $parts[2] ?? false;
}
if ($key === false) {
throw new UnexpectedValueException('Key should be a string - not a ' . gettype($key));
}

It splits by whitespace to find 3 "parts": $type, $key, and $comment.

I have been looking around for an authoritative standard that defines this structure, but I haven't found a clear winner:

  • There is the sshd manpage section on "the authorized_keys file format" which is close but incompatible:

    Public keys consist of the following space-separated fields: options, keytype, base64-encoded key, comment.

  • Some blog post seems to agree:

    The OpenSSH public key format is fully documented RFC 4253. Briefly, an OpenSSH public key consists of three fields:

    • The key type
    • A chunk of PEM-encoded data
    • A comment

    But I haven't found where in RFC 4253 that is actually written. RFC 4253 seems to be concerned about each byte of the actual key, and not the type / comment fields.

  • This Super User answer also only addresses the bytes of the actual key and not the type / comment fields, but adds that "The SSH protocol does not document any file formats at all".

  • I thought maybe the openLDAP schema for sshPublicKey would have a clue, but it seems to be an arbitrary ascii string.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions