Supported Key Formats

This page lists the SSH key types and file formats PocketCmd accepts for public-key authentication, what it generates on the device and how its fingerprints compare with ssh-keygen. Keys are managed under Settings › Connection › SSH Keys. See Key Management for the workflow.

Algorithms

Algorithm	Import	Generate in the app
Ed25519	Yes	Yes, the default
ECDSA (P-256, P-384, P-521)	Yes	Yes
RSA	Yes	2048, 3072 (default) or 4096 bits
DSA	No	No

DSA is not supported. The bundled libssh2 is built without DSA, and OpenSSH has disabled DSA by default since release 7.0.

Private key formats

Format	First line	Key types	Encrypted variant
OpenSSH (`ssh-keygen` default since OpenSSH 7.8)	`-----BEGIN OPENSSH PRIVATE KEY-----`	Ed25519, ECDSA, RSA	Yes
PKCS#1 (RSA PEM)	`-----BEGIN RSA PRIVATE KEY-----`	RSA	Yes (`Proc-Type: 4,ENCRYPTED` with a `DEK-Info` header)
SEC1 (EC PEM)	`-----BEGIN EC PRIVATE KEY-----`	ECDSA	Yes
PKCS#8	`-----BEGIN PRIVATE KEY-----`	Ed25519, ECDSA, RSA	n/a
Encrypted PKCS#8	`-----BEGIN ENCRYPTED PRIVATE KEY-----`	Ed25519, ECDSA, RSA	Yes

Ed25519 has no traditional PEM encoding. Store Ed25519 keys as OpenSSH or PKCS#8.

Encrypted OpenSSH keys

Passphrase-protected OpenSSH keys use bcrypt for key derivation and one of these ciphers:

aes256-ctr (the ssh-keygen default)
aes192-ctr, aes128-ctr
aes256-cbc, aes192-cbc, aes128-cbc

To re-encrypt a key with the default cipher, or to convert a PEM key to the OpenSSH format, change its passphrase with ssh-keygen (you can keep the same one):

ssh-keygen -p -f ~/.ssh/id_ed25519

Importing a key

In SSH Keys, tap Add SSH Key, then Import existing key. Name the key, load the private key with File or Paste and enter the passphrase if the key is encrypted. The app detects the format from the first line and rejects text that is not a private key.

Paste the private key, not the .pub file. A public key is a single line starting with ssh-ed25519, ssh-rsa or ecdsa-sha2-; a private key starts with -----BEGIN.

Generating a key

In SSH Keys, tap Add SSH Key, then Generate new key and choose:

Field	Options
Key type	Ed25519 (recommended), ECDSA P-256, ECDSA P-384, ECDSA P-521, RSA
Key size (bits)	RSA only: 2048, 3072 or 4096
Comment (optional)	Stored in the public key, for example `you@phone`
Passphrase (optional)	Encrypts the private key with `aes256-ctr`

Generated keys are written in the OpenSSH format. After generation the app shows the public key with Copy public key so you can add it to ~/.ssh/authorized_keys on your servers.

Private keys are stored encrypted in the app’s key library, sealed with your vault key. They leave the device only when you sync them, share them to a team vault or include them in an encrypted export.

Generating a key on a computer

ssh-keygen -t ed25519 -C "[email protected]"     # Ed25519
ssh-keygen -t ecdsa -b 521 -C "[email protected]" # ECDSA P-521
ssh-keygen -t rsa -b 4096 -C "[email protected]"  # RSA 4096

Fingerprints

PocketCmd shows SHA-256 fingerprints in the same format as OpenSSH:

SHA256:o0SXyAtyB1cJ7G1lBcl2B8vB3sEgDnHK2T8BtYbTq8A

Compare with:

ssh-keygen -lf ~/.ssh/id_ed25519.pub

Tap a key in SSH Keys to see its Fingerprint (with Copy fingerprint), Protection (whether it has a passphrase), Comment, the Added and Last used dates and its public key.