1

I'm having a weird problem with SSH.

I'm using ssh-keygen -lf id_rsa to generate the public fingerprint from my private ssh key id_rsa.

However, no matter how I replace or change the contents of my private ssh key file id_rsa, the ssh-keygen -l command gives the same results.

It's like the key or fingerprint are being cached somehow.

What is going on?

Improve this question

1 Answer 1

Reset to default
1

I discovered the answer while writing the question.

If you do not have a public key file which corresponds to your private key (id_rsa.pub in this example), then ssh-keygen -l will calculate the public key from your private key, and use this calculated public key to calculate the public fingerprint, as expected.

However, if you DO have a public key file (e.g. id_rsa.pub), then ssh-keygen -l will not bother to calculate the public key, and will instead use the public key file to get the fingerprint.

This is weird behavior, since all the data you could need is in the private key, and it doesn't take long to calculate the public key from the private one. It also doesn't check if the private and public keys actually match. However, this odd behavior is actually documented in the man page for ssh-keygen. So, basically, yes, there is a cache: the cache is the public key file (e.g. id_rsa.pub).

You can safely delete the public key file and regenerate it with ssh-keygen -y -f id_rsa > id_rsa.pub.

Improve this answer
1
  • 1
    The .pub file has a purpose: The private key formats used by OpenSSH are fully encrypted, so ssh tools would need to ask you for your passphrase even if it was just to retrieve "public" data. For people who have multiple keys, this could result in a lot of unnecessary passphrase prompts during authentication.
    – u1686_grawity
    May 5, 2020 at 8:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .