Key handling

Parent key class

Common API for all public keys.

class paramiko.pkey.PKey(msg=None, data=None)

Base class for public keys.

__cmp__(other)

Compare this key to another. Returns 0 if this key is equivalent to the given key, or non-0 if they are different. Only the public parts of the key are compared, so a public key will compare equal to its corresponding private key.

Parameters:other (Pkey) – key to compare to.
__init__(msg=None, data=None)

Create a new instance of this public key type. If msg is given, the key’s public part(s) will be filled in from the message. If data is given, the key’s public part(s) will be filled in from the string.

Parameters:
  • msg (Message) – an optional SSH Message containing a public key of this type.
  • data (str) – an optional string containing a public key of this type
Raises:

SSHException – if a key cannot be created from the data or msg given, or no key was passed in.
__weakref__

list of weak references to the object (if defined)

asbytes()

Return a string of an SSH Message made up of the public part(s) of this key. This string is suitable for passing to __init__ to re-create the key object later.

can_sign()

Return True if this key has the private part necessary for signing data.

classmethod from_private_key(file_obj, password=None)

Create a key object by reading a private key from a file (or file-like) object. If the private key is encrypted and password is not None, the given password will be used to decrypt the key (otherwise PasswordRequiredException is thrown).

Parameters:
  • file_obj – the file-like object to read from
  • password (str) – an optional password to use to decrypt the key, if it’s encrypted
Returns:

a new PKey based on the given private key
Raises:
  • IOError – if there was an error reading the key
  • PasswordRequiredException – if the private key file is encrypted, and password is None
  • SSHException – if the key file is invalid
classmethod from_private_key_file(filename, password=None)

Create a key object by reading a private key file. If the private key is encrypted and password is not None, the given password will be used to decrypt the key (otherwise PasswordRequiredException is thrown). Through the magic of Python, this factory method will exist in all subclasses of PKey (such as RSAKey or DSSKey), but is useless on the abstract PKey class.

Parameters:
  • filename (str) – name of the file to read
  • password (str) – an optional password to use to decrypt the key file, if it’s encrypted
Returns:

a new PKey based on the given private key
Raises:
  • IOError – if there was an error reading the file
  • PasswordRequiredException – if the private key file is encrypted, and password is None
  • SSHException – if the key file is invalid
get_base64()

Return a base64 string containing the public part of this key. Nothing secret is revealed. This format is compatible with that used to store public key files or recognized host keys.

Returns:a base64 string containing the public part of the key.
get_bits()

Return the number of significant bits in this key. This is useful for judging the relative security of a key.

Returns:bits in the key (as an int)
get_fingerprint()

Return an MD5 fingerprint of the public part of this key. Nothing secret is revealed.

Returns:a 16-byte string (binary) of the MD5 fingerprint, in SSH format.
get_name()

Return the name of this private key implementation.

Returns:name of this private key type, in SSH terminology, as a str (for example, "ssh-rsa").
sign_ssh_data(data)

Sign a blob of data with this private key, and return a Message representing an SSH signature message.

Parameters:data (str) – the data to sign.
Returns:an SSH signature message.
verify_ssh_sig(data, msg)

Given a blob of data, and an SSH message representing a signature of that data, verify that it was signed with this key.

Parameters:
  • data (str) – the data that was signed.
  • msg (Message) – an SSH signature message
Returns:

True if the signature verifies correctly; False otherwise.
write_private_key(file_obj, password=None)

Write private key contents into a file (or file-like) object. If the password is not None, the key is encrypted before writing.

Parameters:
  • file_obj – the file-like object to write into
  • password (str) – an optional password to use to encrypt the key
Raises:
  • IOError – if there was an error writing to the file
  • SSHException – if the key is invalid
write_private_key_file(filename, password=None)

Write private key contents into a file. If the password is not None, the key is encrypted before writing.

Parameters:
  • filename (str) – name of the file to write
  • password (str) – an optional password to use to encrypt the key file
Raises:
  • IOError – if there was an error writing the file
  • SSHException – if the key is invalid

DSA (DSS)

DSS keys.

class paramiko.dsskey.DSSKey(msg=None, data=None, filename=None, password=None, vals=None, file_obj=None)

Representation of a DSS key which can be used to sign an verify SSH2 data.

static generate(bits=1024, progress_func=None)

Generate a new private DSS key. This factory function can be used to generate a new host key or authentication key.

Parameters:
  • bits (int) – number of bits the generated key should be.
  • progress_func (function) – Unused
Returns:

new DSSKey private key

RSA

RSA keys.

class paramiko.rsakey.RSAKey(msg=None, data=None, filename=None, password=None, key=None, file_obj=None)

Representation of an RSA key which can be used to sign and verify SSH2 data.

static generate(bits, progress_func=None)

Generate a new private RSA key. This factory function can be used to generate a new host key or authentication key.

Parameters:
  • bits (int) – number of bits the generated key should be.
  • progress_func (function) – Unused
Returns:

new RSAKey private key

ECDSA

ECDSA keys

class paramiko.ecdsakey.ECDSAKey(msg=None, data=None, filename=None, password=None, vals=None, file_obj=None, validate_point=True)

Representation of an ECDSA key which can be used to sign and verify SSH2 data.

classmethod generate(curve=<cryptography.hazmat.primitives.asymmetric.ec.SECP256R1 object>, progress_func=None, bits=None)

Generate a new private ECDSA key. This factory function can be used to generate a new host key or authentication key.

Parameters:progress_func (function) – Not used for this type of key.
Returns:A new private key (ECDSAKey) object