Create Public Key using OpenSSL instead of PuTTYgen for PKCS#8

Question

I'm trying to create a public key pair for ssh-rsa authentication. If I'm using puttygen.exe, the "OpenSSH authorized_keys file" string looks like this:

"ssh-rsa AAAAB3 ... 6yIK9Nbw== rsa-key-20150709"

This works fine, however I would like to attempt to create such a file using OpenSSL instead. Mostly because I just want to convert/create a private key later in PKCS#8 format using:

openssl pkcs8 -topk8 -v2 des3

I read this can be done independent of the public key after the fact. So I used "openssl" and just generated a key, but I couldn't get it into the "ssh-rsa" format .

Does anybody know how to "convert" or output my public key to the seemingly standard "OpenSSH authorized_keys file" without using PuTTY tools?

Answer 1

The OpenSSH format is unsurprisingly supported by OpenSSH tools. (The OpenSSH public-key format, used in authorized_keys and with a prefix added in known_hosts, isn't itself a "de jure" standard, but is a trivial modification of a public-key encoding within the SSH2 protocol which is standardized.)

Less obviously, OpenSSH uses OpenSSL format(s) for private keys, although they recently (6.5) added a optional format of their own. Thus a private-key file you generated with OpenSSL is an OpenSSH private key, and OpenSSH can convert it to an OpenSSH public key with the -y option of ssh-keygen. See http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/ssh-keygen.1?query=ssh-keygen .

(Dupe of https://stackoverflow.com/questions/10271197/openssl-how-to-extract-public-key and https://serverfault.com/questions/52285/create-a-public-ssh-key-from-the-private-key .)