Key handling¶
Parent key class¶
Common API for all public keys.
-
class
paramiko.pkey.PKey(msg=None, data=None)¶ Base class for public keys.
-
__cmp__(other)¶ Compare this key to another. Returns 0 if this key is equivalent to the given key, or non-0 if they are different. Only the public parts of the key are compared, so a public key will compare equal to its corresponding private key.
Parameters: other (PKey) – key to compare to.
-
__init__(msg=None, data=None)¶ Create a new instance of this public key type. If
msgis given, the key’s public part(s) will be filled in from the message. Ifdatais given, the key’s public part(s) will be filled in from the string.Parameters: Raises: SSHException– if a key cannot be created from thedataormsggiven, or no key was passed in.
-
__weakref__¶ list of weak references to the object (if defined)
-
asbytes()¶ Return a string of an SSH
Messagemade up of the public part(s) of this key. This string is suitable for passing to__init__to re-create the key object later.
-
can_sign()¶ Return
Trueif this key has the private part necessary for signing data.
-
classmethod
from_private_key(file_obj, password=None)¶ Create a key object by reading a private key from a file (or file-like) object. If the private key is encrypted and
passwordis notNone, the given password will be used to decrypt the key (otherwisePasswordRequiredExceptionis thrown).Parameters: - file_obj – the file-like object to read from
- password (str) – an optional password to use to decrypt the key, if it’s encrypted
Returns: a new
PKeybased on the given private keyRaises: IOError– if there was an error reading the keyRaises: PasswordRequiredException– if the private key file is encrypted, andpasswordisNoneRaises: SSHException– if the key file is invalid
-
classmethod
from_private_key_file(filename, password=None)¶ Create a key object by reading a private key file. If the private key is encrypted and
passwordis notNone, the given password will be used to decrypt the key (otherwisePasswordRequiredExceptionis thrown). Through the magic of Python, this factory method will exist in all subclasses of PKey (such asRSAKeyorDSSKey), but is useless on the abstract PKey class.Parameters: Returns: a new
PKeybased on the given private keyRaises: IOError– if there was an error reading the fileRaises: PasswordRequiredException– if the private key file is encrypted, andpasswordisNoneRaises: SSHException– if the key file is invalid
-
get_base64()¶ Return a base64 string containing the public part of this key. Nothing secret is revealed. This format is compatible with that used to store public key files or recognized host keys.
Returns: a base64 stringcontaining the public part of the key.
-
get_bits()¶ Return the number of significant bits in this key. This is useful for judging the relative security of a key.
Returns: bits in the key (as an int)
-
get_fingerprint()¶ Return an MD5 fingerprint of the public part of this key. Nothing secret is revealed.
Returns: a 16-byte string(binary) of the MD5 fingerprint, in SSH format.
-
get_name()¶ Return the name of this private key implementation.
Returns: name of this private key type, in SSH terminology, as a str(for example,"ssh-rsa").
-
load_certificate(value)¶ Supplement the private key contents with data loaded from an OpenSSH public key (
.pub) or certificate (-cert.pub) file, a string containing such a file, or aMessageobject.The .pub contents adds no real value, since the private key file includes sufficient information to derive the public key info. For certificates, however, this can be used on the client side to offer authentication requests to the server based on certificate instead of raw public key.
See: https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.certkeys
Note: very little effort is made to validate the certificate contents, that is for the server to decide if it is good enough to authenticate successfully.
-
sign_ssh_data(data)¶ Sign a blob of data with this private key, and return a
Messagerepresenting an SSH signature message.Parameters: data (str) – the data to sign. Returns: an SSH signature message.
-
verify_ssh_sig(data, msg)¶ Given a blob of data, and an SSH message representing a signature of that data, verify that it was signed with this key.
Parameters: Returns: Trueif the signature verifies correctly;Falseotherwise.
-
write_private_key(file_obj, password=None)¶ Write private key contents into a file (or file-like) object. If the password is not
None, the key is encrypted before writing.Parameters: - file_obj – the file-like object to write into
- password (str) – an optional password to use to encrypt the key
Raises: IOError– if there was an error writing to the fileRaises: SSHException– if the key is invalid
-
write_private_key_file(filename, password=None)¶ Write private key contents into a file. If the password is not
None, the key is encrypted before writing.Parameters: Raises: IOError– if there was an error writing the fileRaises: SSHException– if the key is invalid
-
-
class
paramiko.pkey.PublicBlob(type_, blob, comment=None)¶ OpenSSH plain public key or OpenSSH signed public key (certificate).
Tries to be as dumb as possible and barely cares about specific per-key-type data.
- ..note::
- Most of the time you’ll want to call
from_file,from_stringorfrom_messagefor useful instantiation, the main constructor is basically “I should be usingattrsfor this.”
-
__init__(type_, blob, comment=None)¶ Create a new public blob of given type and contents.
Parameters:
-
__weakref__¶ list of weak references to the object (if defined)
-
classmethod
from_file(filename)¶ Create a public blob from a
-cert.pub-style file on disk.
-
classmethod
from_message(message)¶ Create a public blob from a network
Message.Specifically, a cert-bearing pubkey auth packet, because by definition OpenSSH-style certificates ‘are’ their own network representation.”
-
classmethod
from_string(string)¶ Create a public blob from a
-cert.pub-style string.
DSA (DSS)¶
DSS keys.
-
class
paramiko.dsskey.DSSKey(msg=None, data=None, filename=None, password=None, vals=None, file_obj=None)¶ Representation of a DSS key which can be used to sign an verify SSH2 data.
RSA¶
RSA keys.
-
class
paramiko.rsakey.RSAKey(msg=None, data=None, filename=None, password=None, key=None, file_obj=None)¶ Representation of an RSA key which can be used to sign and verify SSH2 data.
ECDSA¶
ECDSA keys
-
class
paramiko.ecdsakey.ECDSAKey(msg=None, data=None, filename=None, password=None, vals=None, file_obj=None, validate_point=True)¶ Representation of an ECDSA key which can be used to sign and verify SSH2 data.
-
classmethod
generate(curve=<cryptography.hazmat.primitives.asymmetric.ec.SECP256R1 object>, progress_func=None, bits=None)¶ Generate a new private ECDSA key. This factory function can be used to generate a new host key or authentication key.
Parameters: progress_func – Not used for this type of key. Returns: A new private key ( ECDSAKey) object
-
classmethod