Class SshPrivateKey

Namespace

SshSharp

Assembly

SshSharp.dll

A private key for public-key authentication. Load one with Parse(string, string?) or LoadAsync(string, string?, CancellationToken). Supported formats: the OpenSSH key format (BEGIN OPENSSH PRIVATE KEY, as ssh-keygen writes by default, also passphrase-protected), PuTTY .ppk (versions 2 and 3, also encrypted), PKCS#8 (BEGIN PRIVATE KEY, and BEGIN ENCRYPTED PRIVATE KEY for RSA and ECDSA), and PKCS#1/SEC1 PEM (BEGIN RSA PRIVATE KEY, BEGIN EC PRIVATE KEY). Key types: Ed25519, ECDSA (nistp256/384/521) and RSA (2048 bits or more).

public abstract class SshPrivateKey : IDisposable

Inheritance

object

SshPrivateKey

Implements

IDisposable

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Properties

Certificate

The user certificate this key authenticates with, if it was paired with one (WithCertificate(SshCertificate)).

Comment

The comment stored with the key (often user@host), if the format has one.

Fingerprint

The OpenSSH-style SHA-256 fingerprint of the public key, as ssh-keygen -lf prints it.

KeyType

The key type name, for example ssh-ed25519.

PublicKey

The public key in SSH wire format (what authorized_keys holds, base64-decoded).

Methods

Dispose()

Clears the private key material.

FromECDsa(ECDsa, string?)

A key that .NET's ECDsa holds, on P-256, P-384 or P-521, used without exporting it, as FromRsa(RSA, string?) does for RSA.

FromRsa(RSA, string?)

A key that .NET's RSA holds, used without exporting it: a software key, or a non-exportable one in Windows CNG (a TPM through the Microsoft Platform Crypto Provider, Windows Hello) or in any provider that implements RSA. Only the public key is read. Signs with rsa-sha2-512 or rsa-sha2-256.

FromSigner(SshKeySigner, string?)

A key that signs through signer: one in a key vault, a KMS, an HSM or on a smart card. Usable wherever a key is: PrivateKeys, WithCertificate(SshCertificate), SshSignature. Each signature is checked against the public key before it is used.

Generate(SshKeyType, string?, int)

Generates a new key pair, as ssh-keygen -t does. Write it with SaveAsync(string, string?, CancellationToken) or ToOpenSshPrivateKey(string?, int), and give the server ToAuthorizedKeysLine().

LoadAsync(string, string?, CancellationToken)

Reads and parses a private key file.

Parse(string, string?)

Parses a private key.

SaveAsync(string, string?, CancellationToken)

Writes the key as ssh-keygen does: the private key to path (ToOpenSshPrivateKey(string?, int)), readable only by the current user (mode 0600 on Unix, an owner-only ACL on Windows), and the public key to path.pub. Neither file may exist yet: an existing key is never overwritten.

ToAuthorizedKeysLine()

The public key as an authorized_keys line (type, base64, comment).

ToOpenSshPrivateKey(string?, int)

The key in the OpenSSH private key format (BEGIN OPENSSH PRIVATE KEY), as ssh-keygen writes it: encrypted with aes256-ctr and bcrypt_pbkdf when passphrase is given, otherwise unencrypted. The text holds the private key: do not log it, and write it only to files other users cannot read (SaveAsync(string, string?, CancellationToken) does).

WithCertificate(SshCertificate)

This key paired with an OpenSSH user certificate for it (id_ed25519-cert.pub, made with ssh-keygen -s): authentication then presents the certificate, which servers that trust its authority (TrustedUserCAKeys) accept without an authorized_keys entry. The returned key shares this key's private material: disposing this key disposes both.