{"record":{"id":"b0ff1749a36218fe","repo":"kubernetes/kops","slug":"error-computing-fingerprint-for-ssh-public-key-v","errorCode":null,"errorMessage":"error computing fingerprint for SSH public key: %v","messagePattern":"error computing fingerprint for SSH public key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/pki/sshkey.go","lineNumber":80,"sourceCode":"\t\t}\n\t\tcolonSeparated.WriteByte(sshKeyFingerprint[i])\n\t}\n\n\treturn colonSeparated.String()\n}\n\n// ComputeAWSKeyFingerprint computes the AWS-specific fingerprint of the SSH public key\nfunc ComputeAWSKeyFingerprint(publicKey string) (string, error) {\n\tsshPublicKey, err := parseSSHPublicKey(publicKey)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tswitch sshPublicKey.Type() {\n\tcase ssh.KeyAlgoRSA:\n\t\tder, err := rsaToDER(sshPublicKey)\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"error computing fingerprint for SSH public key: %v\", err)\n\t\t}\n\t\th := md5.Sum(der)\n\t\treturn colonSeparatedHex(h[:]), nil\n\tcase ssh.KeyAlgoED25519:\n\t\treturn ssh.FingerprintSHA256(sshPublicKey), nil\n\t}\n\n\treturn \"\", fmt.Errorf(\"unexpected type of SSH key (%T); AWS can only import RSA and ed25519 keys\", sshPublicKey)\n}\n\n// ComputeOpenSSHKeyFingerprint computes the OpenSSH fingerprint of the SSH public key\nfunc ComputeOpenSSHKeyFingerprint(publicKey string) (string, error) {\n\tsshPublicKey, err := parseSSHPublicKey(publicKey)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\th := md5.Sum(sshPublicKey.Marshal())","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/pki/sshkey.go#L62-L98","documentation":"ComputeAWSKeyFingerprint only supports RSA (MD5 of the DER-encoded PKIX public key, AWS-style) and ed25519 (SHA256 fingerprint). When rsaToDER fails to convert/normalize the parsed SSH key into an *rsa.PublicKey it wraps the cause with this message.","triggerScenarios":"An RSA SSH key whose underlying public key cannot be type-asserted/converted to rsa.PublicKey inside rsaToDER — e.g. an unexpected crypto.PublicKey concrete type returned by ssh.ParsePublicKey for a key typed 'ssh-rsa'.","commonSituations":"Rare; usually hit with hand-crafted or corrupted key blobs claiming ssh-rsa type but carrying non-RSA key material, or exotic key encodings.","solutions":["Verify the key is a genuine RSA public key: `ssh-keygen -l -f id_rsa.pub` should report RSA size","Regenerate the key pair if the blob is corrupted","If you don't need AWS MD5 fingerprints, use ed25519 keys, which take the FingerprintSHA256 path"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"func keyTypeIsRSA(pubKey string) bool {\n\tf := strings.Fields(pubKey)\n\treturn len(f) > 0 && f[0] == \"ssh-rsa\"\n}\nif keyTypeIsRSA(pubKey) {\n\tif _, err := pki.ComputeAWSKeyFingerprint(pubKey); err != nil {\n\t\treturn fmt.Errorf(\"RSA key unusable for AWS fingerprint: %w\", err)\n\t}\n}","typeGuard":null,"tryCatchPattern":"fp, err := pki.ComputeAWSKeyFingerprint(pubKey)\nif err != nil {\n\tif strings.Contains(err.Error(), \"error computing fingerprint\") {\n\t\t// fall back to SHA256 fingerprint of raw key\n\t\tfp = genPublicKeyFingerprint(publicKey)\n\t\treturn fp, nil\n\t}\n\treturn \"\", err\n}","preventionTips":["Use standard ssh-keygen RSA keys; avoid hand-modified blobs","Prefer ed25519 keys to skip the RSA conversion path entirely","Re-export suspect keys rather than repairing them"],"tags":["ssh","rsa","fingerprint","aws"],"backgroundTag":"ssh-key-fingerprint-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}