Convert OpenSSH public key fingerprints to different formats #ssh #openssh

convertSshFingerprint.md

Convert SHA256 OpenSSH digests to other representations

➜  ssh-add -l
256 SHA256:DpDdSJhFYZAa1jz4cE9PMAevia1C/yb4Gi5nW7dMqmw [email protected] (ED25519)


➜  ssh-keygen -lf ~/.ssh/keyName.pub -E md5
256 MD5:a5:89:b4:ab:99:9d:5b:9a:8e:99:63:f5:84:6e:a0:a9 [email protected] (ED25519)


➜  ssh-keygen -lf ~/.ssh/keyName.pub -E sha1
256 SHA1:SHa5tpTXNOKHMibwKaWEou/1MYM [email protected] (ED25519)


➜  ssh-keygen -lf ~/.ssh/keyName.pub -E sha256
256 SHA256:DpDdSJhFYZAa1jz4cE9PMAevia1C/yb4Gi5nW7dMqmw [email protected] (ED25519)
# The same result as in `ssh-add -l` in 1st example


➜  res=$( ssh-keygen -lf ~/.ssh/keyName.pub -E sha256 ) &&
   res=$( awk '{ print gensub("^SHA256:", "", "g", $2) }' <<<"$res" ) &&
   printf '%s\n' "$res"
DpDdSJhFYZAa1jz4cE9PMAevia1C/yb4Gi5nW7dMqmw


➜  printf '%s\n' "$res"  |  base64 --ignore-garbage --decode
��H�Ea���<�pOO0���B�&��.g[�L�lbase64: invalid input
# Length of string is not a multiple of 4


➜  printf '%s=\n' "$res" |  base64 --ignore-garbage --decode
��H�Ea���<�pOO0���B�&��.g[�L�l
# If appended with '=' to nearest 4x string, base64 decodes fine


➜  printf '%s=\n' "$res" |  base64 --ignore-garbage --decode | xxd --ps --cols 60
0e90dd48984561901ad63cf8704f4f3007af89ad42ff26f81a2e675bb74caa6c


➜  ssh-keygen -lf ~/.ssh/keyName.pub -E sha256 | \
   |  awk '{ 
         b64 = gensub("^SHA256:", "", "g", $2)
         b64 = sprintf("%-44s##", b64)
         sub(/ *##.*$/, "=", b64)
         print b64 
      }' \
   |  base64 --ignore-garbage --decode
   |  xxd --ps --cols 60
0e90dd48984561901ad63cf8704f4f3007af89ad42ff26f81a2e675bb74caa6c
# Just to repeat everything in one step