36

I am using public/private key pairs for a long time now. And nearly the same time I'm asking myself over and over again, which file extension I should use. It seems to be that at least for the public and the private(openssh) keys is no convention at all?

I mean in PuTTy there is a special extension .ppk for "PuTTy Private Key" and the public key is stored either without an extension, or with .pub. I personally prefere not to use .pub, because Microsoft is using this extension already for MS Publisher. So for PuTTy I store both keys with the same name and add .ppk to the private and nothing to the public key. And for that case I can live with that. I can identify which key is the public and which the private one and that the private one is for PuTTy only.

But what should I do with the private openssh key? Just store it without an extension? Or use something like .openssh? Also if there is no convention really, if someone just thought about that and sorted out some sort of concept for himself, I would also appreciate that...

Thanks in advance!

Improve this question
3
  • It doesn't matter what extension you give them as long as the content stays the same.
    – Farhan.K
    Sep 6, 2017 at 15:56
  • Yes, I know that - I think I should've wrote this in my question ^^
    – I-GaLaXy-I
    Sep 8, 2017 at 7:21
  • That's the exact reason for the existence of extensions: So the user knows at a glance what a file may contain inside, instead of manually reviewing each one with an editor. More fast searching, less security thru obscurity.
    – alejandrob
    Jun 3, 2020 at 2:22

2 Answers 2

Reset to default
28

First off, there really is no official convention for naming keys. They filenames don't matter. They are only important to you, who has to manage them. The software is only concerned with the content of files.

That being said, OpenSSH key files are just text files, so you could name them with a .txt extension.

I typically just stick with the convention that the ssh-keygen tool uses, which is id_{key_algorithm}(ie. id_rsa or id_dsa) for the private key and then the private key name + .pub for the public key (id_rsa.pub or id_dsa.pub). If I need to keep multiple keys I will add an additional identifier to the end of the name so I would get names like id_rsa_myhost and id_rsa_myhost.pub.

Improve this answer
4
  • I know that the name is not important. It's just a good idea to get some sort of concept to manage them more easily - like you said. This is nearly the same I ended up to. I have several keys for several servers and sometimes also more than one keypairs for one server... And some other colleagues have to use them sometimes as well. Some of them using PuTTY, so I need to save the private key in this format as well... Thinking and searching the web about this, I thought maybe someone has already come to a good concept to maintain overview.
    – I-GaLaXy-I
    Sep 8, 2017 at 7:20
  • Can you tell ssh-keygen that it should use different filenames (e.g. ssh.key, ssh.pub instead of ssh, ssh.pub) or do you have to rename files afterwards?
    – Drux
    Jul 20, 2018 at 18:54
  • So how do you tell a private key from a public key? Or a PPK from an OpenSSH private key? I think that mistake inducing (via ambiguity) with such sensitive information should not be regarded as sound security practice. "I sent you the private key instead of the public one. My bad!"
    – alejandrob
    Jun 3, 2020 at 2:26
  • 1
    Lack of filename convention serves no one. Firstly, it only allows for people to mistakenly send the private key when they really intended to send the public one. And no, expectation of human perfection, nor fastidious double checking the inside of all keyfiles is NOT a substitute for that major oversight. Thanks for these suggestion.
    – alejandrob
    Apr 20, 2021 at 16:23
22

So I thought about some naming concepts and ended up like this now. I know there is no convention except for .ppk (PuTTy Private Key) in PuTTy - so this is not a "You have to do it like this", it's rather an idea how a naming concept could look like. So I thought to share it with you anyways - maybe it helps someone at least to build his own concept.

What I want / don't want

  • I want to use OpenSSH and PuTTy keypairs
  • I want the keys to be immediately identifiable and not be able to get mixed up - therefore I want to identify
    • the algorithm
    • if it's a private or a public key
    • if it's OpenSSH or PuTTy format
  • I want the name to be Windows and Unix "compatible/compliant" (e.g. I don't want spaces in Linux - even if it's no offical policy)
  • I don't want to change all keys on all servers, if whatever (maybe some sort of security issue) happens, so I may
    • don't want to use the same keypair for several servers
    • want to use a keypair for only one purpose (purpose could be a user, a service or a task for example)

The name therefore should contain the following information:

  • Purposal information if it's (username or taskname for example)
  • The servername, if it's a server specific key
  • The algorithm
  • Is it a private or public key?
  • Is it OpenSSH or PuTTy format?

A possible name scheme

As heavyd mentioned, I think it's really an good idea to stick to the syntax of the ssh-keygen tool. So I use this (except for the .pub for public keys, because this file extension is used by Microsoft Publisher and could be interpreted wrong on Windows Systems - there is also an own icon for MS Publisher) and combine it with the convention of PuTTy (.ppk) and the conditions above. Therefore a possible name scheme could be:

id_<key_algorithm>_<servername>_<purpose>.<format_information>

With the following rules:

  • If it's not for a specific server, remove <servername>
  • If it's not for a specific purpose, remove <purpose>
  • At least one of the information (<purpose> or <servername>) has to be contained in the name

The format information (OpenSSH/PuTTy and private/public)

PuTTy uses .ppk for private keys and the ssh-keygen tool comes with .pub for public keys here, which I don't want to use because of MS Publisher. Therefore I stick to PuTTys .ppk, differ just a little bit from ssh-keygens .pub and use both "conventions" as basis to build the others close to this names. So this information is added as "file extension":

Name of OpenSSH private key:  .pk        an alternative could be .opk or   .ospk
Name of OpenSSH public key:   .pubk      an alternative could be .opubk or .ospubk
Name of PuTTY private key:    .ppk
Name of PuTTy Public Key:     .ppubk

Some examples:

id_rsa_foo_bar.ppk
id_dsa_foo.pk

id_rsa_server01_rsync.pk
id_rsa_server01_rsync.pubk
id_rsa_server01_rsync.ppk
id_rsa_server01_rsync.ppubk
Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.