Exemplo 05 · RSA 4096

Resumo da chave

Tipo de chave	RSA 4096
Nome do algoritmo SSH	`ssh-rsa · signatures rsa-sha2-512`
Suporte	Suporte alargado; as versões atuais do OpenSSH exigem assinaturas RSA-SHA2 (rsa-sha2-256 ou rsa-sha2-512), pois as assinaturas ssh-rsa com SHA-1 estão desativadas por predefinição desde o OpenSSH 8.8
Formato da chave privada	OpenSSH (openssh-key-v1), unencrypted
Impressão digital	`SHA256:r87pfWBR4SuuEEn1C+YC0c+mntL4rZT3QGXF/+mD6jg`

Chave pública

A chave pública no formato authorized_keys. Adicione-a a um ficheiro allowed_signers para verificar a assinatura abaixo.

Transferir → 744 bytes

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDANehZi+mUwtTuXDW1P2IrqIdU8A5yBi6pGV6rcbLoS0AVi7thjGNw2jMlNhn+n08ODHAmccGPOGZ3rPz5VeNp1VV4s31qF9s+cab242mpVKJd0CbI9q3JYu2OXiXQlwk2Czq9NVGl93YIUO2k3LS8u756epd+rH8NKAAhjNFkLPmrot7vi+FIVzBYNOdPC8y3kiIpU6U6SZW6FG1DRjH/4MoCbUbPpir5GSq/ioS0eHRAKLw3jxkG+CVdTrvth9Et6ArGReil+XaFwisYnkBMn+A2QRjFwTofF2s2xpKuNVEcRGHEyn/SHyUUUvIWy2Z2S5G/JL8W9oXffQChgmuENlcJpQh7tF11+QpjEV1sYY2kR4Qd+qANi5/XxBR36eomVy2WwIB6XKKkmQlYc+fz+Ts7AsNi1wGFxd3zbJHCxU/OwA/TsJQLdTCyvajH4174Rp9O4n6pl1dXfO5BhB6q1RfG7CcOwB1eV29fR1UTe4HvmxpsLb421jMZrmsGtMZBTCVLN38yT1uUVbjbNJwmDC8QCaP2HEviUBTbHQFv52dnh2KRj42SBY2ZI+LL0l87BHbYSkkw8djxjRoo+KP2T4XelCuzWRKyQVo7TC7wQeNkoRAU+hnx/yKax5X0kTOZAnhkw1A0tJ4VUISe62lgBs1ACwJL1wMDCwouSAMC/w== ch-j-ssh-example-05

Chave privada

A chave privada sem cifra. Publicada apenas para testes: qualquer pessoa pode usá-la.

Transferir → 3 389 bytes

Mostrar

Assinatura de test_1MB.bin

Assinatura SSH separada (SSHSIG, espaço de nomes "file") de test_1MB.bin criada com esta chave no CH-J Tools. Guarde-a como test_1MB.bin.sig junto do ficheiro de teste.

Transferir → 1 556 bytes

-----BEGIN SSH SIGNATURE-----
U1NIU0lHAAAAAQAAAhcAAAAHc3NoLXJzYQAAAAMBAAEAAAIBAMA16FmL6ZTC1O5cNbU/Yi
uoh1TwDnIGLqkZXqtxsuhLQBWLu2GMY3DaMyU2Gf6fTw4McCZxwY84Znes/PlV42nVVXiz
fWoX2z5xpvbjaalUol3QJsj2rcli7Y5eJdCXCTYLOr01UaX3dghQ7aTctLy7vnp6l36sfw
0oACGM0WQs+aui3u+L4UhXMFg0508LzLeSIilTpTpJlboUbUNGMf/gygJtRs+mKvkZKr+K
hLR4dEAovDePGQb4JV1Ou+2H0S3oCsZF6KX5doXCKxieQEyf4DZBGMXBOh8XazbGkq41UR
xEYcTKf9IfJRRS8hbLZnZLkb8kvxb2hd99AKGCa4Q2VwmlCHu0XXX5CmMRXWxhjaRHhB36
oA2Ln9fEFHfp6iZXLZbAgHpcoqSZCVhz5/P5OzsCw2LXAYXF3fNskcLFT87AD9OwlAt1ML
K9qMfjXvhGn07ifqmXV1d87kGEHqrVF8bsJw7AHV5Xb19HVRN7ge+bGmwtvjbWMxmuawa0
xkFMJUs3fzJPW5RVuNs0nCYMLxAJo/YcS+JQFNsdAW/nZ2eHYpGPjZIFjZkj4svSXzsEdt
hKSTDx2PGNGij4o/ZPhd6UK7NZErJBWjtMLvBB42ShEBT6GfH/IprHlfSRM5kCeGTDUDS0
nhVQhJ7raWAGzUALAkvXAwMLCi5IAwL/AAAABGZpbGUAAAAAAAAABnNoYTUxMgAAAhQAAA
AMcnNhLXNoYTItNTEyAAACAGwYQDl7SOFU6m7tfgaewL5uFxGTwKjGgG1xgbB5BySd6gZl
t6VT0VKoAuuu/d5qEYV5R4sPWLovSUAgLO2jCcVW3tEMYmVYvOpR9fJjnlnKJjvyb7uqtC
8jpdap1pKg/sSGCn09alIanrqTAT3RmviNC4J3iKun4W6zqdyS59CXSTFRY3IRub2l5C0A
tKf/yl/igQYVwxg21dueiwUtIWsIsSaJx2nZ1k1M8aqBD9mn2/hmTC4co3CPNTgtSgSKJi
WfxHmyvFtSR2vRD74Wr2g3FiWv720J+qExFlJgxFFuuflMgbChzUciPkxdCZzaw6AMNp7S
HtVU0xRHGBQtjtCMjJjzl2s6zIZcYsREXBM+zAL6cYT07EI1kdoQldAGIgCk7UxsmnqyDJ
cZDuz1dE3vXpXplj05aGLHs5bPndKuGx+yxm/qmjLziARWcS1SScZCH8xgGZZVm70La3UM
mLcZpHy0BzmE6VSDozRR+0a8PTkTXTIbisqUXCE2TxbQMrrZawfB6wRmdMZe89U5LawePG
QA8l0CfPLu0DNQ0Agqmm/4AHyl9pYA6821ONupxAIgHGXkMNJ0zQkaJTMTHxPx6H7WsFAC
O0GYFQlKDCdqNb6IA7q7x3JQMIIGrUUcSrOx+yb9Xrwb1mTv6mrcKLLM7A9KSetIaQGi0j
/0X923
-----END SSH SIGNATURE-----

Revogação

As chaves SSH não têm certificado de revogação. Para revogar uma chave, remova-a de authorized_keys ou inclua-a numa lista de revogação de chaves do OpenSSH (KRL, criada com ssh-keygen -k) que o servidor lê através de RevokedKeys.

Verificar a assinatura

Guarde a chave pública e a assinatura junto de test_1MB.bin, crie um ficheiro allowed_signers e execute ssh-keygen:

echo "example@ch-j $(cat id_rsa.pub)" > allowed_signers
ssh-keygen -Y verify -f allowed_signers -I example@ch-j -n file -s test_1MB.bin.sig < test_1MB.bin