`importOpenSshPrivateKey`

Import an unencrypted single-key openssh-key-v1 private key file.

Accepts the -----BEGIN OPENSSH PRIVATE KEY----- PEM that ssh-keygen writes for RSA, Ed25519 and ECDSA P-256/P-384/P-521 keys. The cipher and KDF must both be none with empty KDF options; any other value returns unsupported, as does a file holding several keys. The check integers, the 1, 2, 3, ... padding, the block alignment, and the absence of trailing bytes are verified, and RSA integers must be canonical positive mpints.

The public key embedded in the file must equal the public half of the private section and its key type, or the result is key_mismatch. The private material is then checked cryptographically: for RSA, p·q = n, d·e ≡ 1 modulo both p-1 and q-1, and iqmp·q ≡ 1 (mod p); for every key, a signature made with the private key must verify under the embedded public key. For Ed25519 the 32-byte suffix of the private field must equal the public key.

Both keys are returned extractable. The decoded binary copy of the file is zeroed before returning. JavaScript strings, including the PEM text and the JWK members used for the import, cannot be zeroed, and input is never modified.

function importOpenSshPrivateKey(
	input: string | Uint8Array,
	options: SshImportOptions,
): Promise<SshResult<ImportedOpenSshPrivateKey>>

Parameters

input: string | Uint8Array — The PEM file as text or UTF-8 bytes, at most 32 KiB
options: SshImportOptions — Policy options; see SshImportOptions

See also

importOpenSshPrivateKeyOrThrow for the throwing variant
exportOpenSshPrivateKey for the inverse operation

importOpenSshPrivateKey ​