3

I have a public key as the following 64 bytes encoded string

AAAAB3NzaC1yc2EAAAADAQABAAABAQDapfZSmaVBZimVC7YAsISc+fKzuhbVmmbJNYELWov4ZVbdbFxf790xC0sKQTmbe1iDt25DdsandggApKZh6yvWD0Li5RV+h5wV6chTNwOUe6A7Q4Y4nbMozxTzT0vpMOzZv8+RffzbSnS9GVin/4BACnih10tYzwgCe6y3ei3E5hytSGMkviYIcRQ5x4W2KgSa+BXRSGnpYU69u/b/uF7KDaIhcMqenZBy5YKt4nBYnbKFAgUk/yZRrPq9knVqXO+cQ3ZZlF1KNnrx+o3oR9OqtgjqFyXMyFIiT4oqtXXiVNmoc5C+kg7pDxR4Fcr15xTJpZl8kc8qt+WS5QpLgJjT

when I do a sha256 digest in python and print the result in base64 like this:

sha256 = hashlib.sha256()
sha256.update(plaintext.encode())
hash_sha256 = sha256.digest()
print(base64.b64encode(hash_sha256))

I get a different fingerprint than when I do

ssh-keygen -lf key.pub

I thought the sha256 fingerprint was just the sha256 of the public key... I tried also adding exactly what's in the key.pub file, that is:

ssh-rsa ... user@host

but I also get a different result

So how exactly is the fingerprint calculated? The same applies to MD5?

5

Unfortunately you did not show the full code, i.e. did not make clear where plaintext in your code comes from. My guess is that you did not decode the base64 encoded public key first but just fed the encoded key directly into the digest. The following works for me:

b64pubkey='AAAAB3Nz....'  # base64 encoded public key
sha256 = hashlib.sha256()
sha256.update(base64.b64decode(b64pubkey))
hash_sha256 = sha256.digest()
print(base64.b64encode(hash_sha256))
  • 1
    And the traditional/obsolete MD5 version is computed on the same input, but displayed in hex with colons between octets. – dave_thompson_085 Feb 27 '17 at 8:08
  • An important note: in case there's an 'ssh-rsa' prefix in the public key, it must be removed before generating the fingerprint. – Juuso Ohtonen Apr 8 at 12:10
  • @dave_thompson_085 Do you know why now the fingerprint is given in base64 format instead of hex? – Rick Jun 26 at 10:47
  • 1
    @Rick: no, although I would guess it's because 32 bytes in hex is at least 64 chars (95 in the old format with colons) whereas 43 chars is just about the same as the old 47. – dave_thompson_085 Jun 27 at 3:48
  • @dave_thompson_085 Ya, I see some other users also guess that base64 wins because of shorter chars, compared to hex. Thanks for replying :) – Rick Jun 27 at 4:02
0

I would like to remind you that:

the base64 fingerprint calucuated by ssh-keygen will:

SSH by convention omits any trailing padding (the padding =s)

see my question here https://stackoverflow.com/questions/56769749/calculate-ssh-public-key-fingerprint-into-base64-why-do-i-have-an-extra

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.