The number of bits in the key, using -b; the default is 1024 bits:

    $ ssh-keygen -t dsa -b 2048

The name of the private-key file to be generated, using -f. The name is relative to your current directory. Recall that the public-key file is named after the private one with .pub appended.

    $ ssh-keygen -t dsa -f mykey         Creates mykey and mykey.pub

If you omit the -f option, you are prompted for the information:

    $ ssh-keygen -t dsa
    ...
    Enter file in which to save the key (/home/barrett/.ssh/id_dsa): mykey

The default filename for DSA keys is ~/.ssh/id_dsa, and for RSA keys it’s ~/.ssh/id_rsa.

The passphrase to decode the key, using -N:

    $ ssh-keygen -t dsa -N secretword

If you omit this option, you’ll be prompted for the information:

    $ ssh-keygen -t dsa
    ...
    Enter passphrase: [nothing is echoed]
    Enter the same passphrase again: [nothing is echoed]

A textual comment associated with the key, using -C. If you omit this option, the comment is username@host, where username is your username and host is the local hostname:

    $ ssh-keygen ... -C "my favorite key"

Changing the passphrase of an existing key, using - p. You can specify the filename with -f and the old and new passphrases with -P and -N, respectively:

    $ ssh-keygen -t dsa -p -f mykey -P secretword -N newword
    Your identification has been saved with the new passphrase.

But if you omit them, you are prompted:

    $ ssh-keygen -t dsa -p
    Enter file in which the key is (/home/barrett/.ssh/id_rsa): mykey
    Enter old passphrase: [nothing is echoed]
    Key has comment 'my favorite key'
    Enter new passphrase (empty for no passphrase): [nothing is echoed]
    Enter the same passphrase again:
    Your identification has been saved with the new passphrase.

Note that this changes the passphrase but doesn’t change the key, it just re-encrypts the key with the new passphrase. So, the corresponding public-key file on remote machines doesn’t change or need to be replaced.

Printing the fingerprint of a given key file, with -l. See the sidebar "Key Fingerprints" for more information. The fingerprint can be calculated from the public key:

    $ ssh-keygen -l -f stevekey.pub
    1024 5c:f6:e2:15:39:14:1a:8b:4c:93:44:57:6b:c6:f4:17 steve@snailbook.com
    $ ssh-keygen -B -f stevekey.pub
    1024 xitot-larit-gumet-fyfim-sozev-vyned-cigeb-sariv-tekuk-badus-bexax
    Steve@snailbook.com

Printing a DNS resource record with -r, and using DNS resource record format with -g. These options produce key fingerprints in a format suitable for a BIND nameserver, for the purposes of verifying SSH host keys via the DNS. [7.4.3.2]

Converting between SECSH (Tectia) and OpenSSH key-storage formats, with -e, -i, and -y.

An OpenSSH “private” key file actually contains both the public and private keys of a pair, so the -e and -y options simply extract the public key and print it out in the desired format. Use -e to convert an OpenSSH public key for your ~/.ssh2/authorization file on a Tectia server host, and -i to do the opposite. The -y option is useful if you accidentally delete your OpenSSH public-key file and need to restore it. Tectia keys are in a format called SECSH Public Key File Format or SSH2 format, also used by other SSH implementations whose keys you may import and export.

A function that’s missing is converting the private keys as well. This is useful if you have an OpenSSH server host on which you also want to run Tectia, and you want the two SSH servers to share a host key.

The number of bits in the key, using -b; the default is 2048 bits:

    $ ssh-keygen -b 4096

The key type, such as DSA or RSA, using -t:

    $ ssh-keygen -t dsa

A textual comment associated with the key, using -c:

    $ ssh-keygen -c "my favorite Tectia key"

If you omit this option, the generated comment describes how and by whom the key was generated. For example:

    "2048-bit dsa, barrett@server.example.com, Tue Feb 22 2000 02:03:36"

The passphrase to decode the key, using -p. If you omit this option, you are prompted after generation.

    $ ssh-keygen -p secretword

You can also designate an empty password using -P. This shouldn’t be done in general but is appropriate in some special cases: [11.1.2.2]

    $ ssh-keygen -P

Whether or not to overwrite the key file, if it already exists, with --overwrite and the value yes (the default) or no:

    $ ssh-keygen --overwrite no mykeyfile

By changing the passphrase and comment of an existing key, using -e. This option causes ssh-keygen to become interactive, prompting for the new information. This interactive mode is primitive and annoying, requiring nearly 10 user responses to change the passphrase and comment, but it does the job:

    $ ssh-keygen -e mykey
    Passphrase needed for key "my favorite Tectia key"
    Passphrase : [nothing is echoed]
    Do you want to edit key "my favorite Tectia key" (yes or no)? yes
    Your key comment is "my favorite Tectia key".
     Do you want to edit it (yes or no)? yes
    New key comment: this is tedious
    Do you want to edit passphrase (yes or no)? yes
    New passphrase : [nothing is echoed]
    Again          : [nothing is echoed]
    Do you want to continue editing key "this is tedious" (yes or no)? god no
    (yes or no)? no
    Do you want to save key "this is tedious" to file mykey (yes or no)? yes

Changes are applied to the key files but not propagated to any copies currently loaded in an agent. (So, if you run ssh-add -l to list the keys in your agent, for example, you still see the old comment.)

By converting between various key-storage formats, with the following options:

By printing the fingerprint of a given key file, with -F. See the sidebar "Key Fingerprints" for more information. [6.2] The fingerprint is calculated from the public key:

    $ ssh-keygen -F stevekey.pub
    Fingerprint for key:
    xitot-larit-gumet-fyfim-sozev-vyned-cigeb-sariv-tekuk-badus-bexax

By printing cryptographic information about a key, with -i:

    $ ssh-keygen -i stevekey.pub
    DSA Public Key
    [Strength estimation as of July, 2000 considering NFS and Pollard rho: Attack
    requires O(2^80) steps, which is roughly equivalent to 6.7 * 10^7 years of effort
    with 1GHz machine.]
      p = [Large prime, characteristic of the finite field]
    18257155510680634708091813901445079313554557329637337413272033369505053693222548
    32994959179095338002184212706407725165597654255005411958024968996544803955496850.
    ...

You can display this information in different bases with -B; the default is base 10:

    $ ssh-keygen -i -B 16 stevekey.pub      Base 16, hexadecimal
    ...
    0x909fe130f9fa7192dc2a28591a53c0687...

By printing the program version number, with -V:

    $ ssh-keygen -V
    ssh-keygen: SSH Tectia Server 4.2.1 on i686-pc-linux-gnu
    Build: 1
    Crypto library version: SSH Cryptographic Library, version 1.2.4

By printing a help message, with -h or -?; most Unix shells require you to escape the question mark to prevent the shell from interpreting it as a wildcard:

    $ ssh-keygen -h
    $ ssh-keygen -\?      escaping the question mark

By printing debug information, with -d, as for Tectia’s sshd. [5.9]

By suppressing the progress indicator, using -q. The progress indicator is a sequence of O’s and periods that displays while ssh-keygen runs, like this: .oOo.oOo.oOo.oOo:

    $ ssh-keygen
    Generating 2048-bit dsa key pair
    .oOo.oOo.oOo.oOo
    Key generated.

    $ ssh-keygen -q
    Generating 2048-bit dsa key pair
    Key generated.