OpenSSH PKCS12-based public keys are invalid for LP

[Leonardo Silva Amaral]

This key is considered invalid for Launchpad:

leonardo@betty:/media/leonardo/LELEO/Chaves/SSH/Pessoal_CACert$ openssl pkcs12 -in /media/leonardo/LELEO/Chaves/Leonardo\ Silva\ Amaral.p12 -out id_rsa
Enter Import Password:
MAC verified OK
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
leonardo@betty:/media/leonardo/LELEO/Chaves/SSH/Pessoal_CACert$ ssh-keygen -y
Enter file in which the key is (/home/leonardo/.ssh/id_rsa): ./id_rsa
Enter passphrase:
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDzXnxn8fKAJr34tEBvt1sf7dag7+G0y2QXmyXjV/r4sW1hweYlMhylDKQaHXjiJWE+gqKRyarFGqEDYfcdFBUGjskxkE5VoFIljqz5eTaer/w1jytPTRvRE1It9kAyzltFzHWQnrO69UBmXIW71ibimLxm65mwhvC1KlliuxG4mA25pzwEiQC9I2uuFNy+8m47iZkOJ3wvXGq0XvZACpf6AzO2iZchpQyZVlaeWBN44TOKeO2RaCtlcj/WimxxQdzjiNP/IOvp7rnTngk64OOovOoxvPwu/mjU2INEfP6ah9kMKhHi6c/8S6xB48eyGqxOervXCSq952b/q4fiz395

This procedure is documented http://wiki.cacert.org/Technology/KnowledgeBase/ClientCerts#OpenSSH

[William Grant (wgrant)]

SSH public keys usually have a comment field at the end, but it seems that ssh-keygen -y omits it. Try adding a space and then some key text after the key data.

[Leonardo Silva Amaral (leleobhz)]

William, really worked after a comment, but im thinking if the comment field isnt fully optional. The RFC 4716 refer as SHOULD, but ssh-keygen [1] just returns NULL to comment if it isnt present in command-line.

[1]: http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/ssh-keygen.c?rev=1.218;content-type=text%2Fx-cvsweb-markup

[William Grant (wgrant)]

RFC4716 specifies a different encoding; we use the traditional and almost universal OpenSSH authorized_keys format, in which the comment is a mandatory field. From the authorized_keys section of the OpenSSH manpage:

  Protocol 2 public key consist of: options, keytype, base64-encoded
  key, comment. The options field is optional; its presence is
  determined by whether the line starts with a number or not (the
  options field never starts with a number)."

Despite the field being mandatory, OpenSSH seems to function without a comment. But it's rather uncommon and not something that Launchpad supports today.