How do you test a public/private DSA keypair?

I found a way that seems to work better for me:

ssh-keygen -y -f <private key file>

That command will output the public key for the given private key, so then just compare the output to each *.pub file.

I always compare an MD5 hash of the modulus using these commands:

Certificate: openssl x509 -noout -modulus -in server.crt | openssl md5
Private Key: openssl rsa -noout -modulus -in server.key | openssl md5
CSR: openssl req -noout -modulus -in server.csr | openssl md5

If the hashes match, then those two files go together.

For DSA keys, use

 openssl dsa -pubin -in dsa.pub -modulus -noout

to print the public keys, then

 openssl dsa -in dsa.key -modulus -noout

to display the public keys corresponding to a private key, then compare them.

Assuming you have the public keys inside X.509 certificates, and assuming they are RSA keys, then for each public key, do

    openssl x509 -in certfile -modulus -noout

For each private key, do

    openssl rsa -in keyfile -modulus -noout

Then match the keys by modulus.

Delete the public keys and generate new ones from the private keys. Keep them in separate directories, or use a naming convention to keep them straight.

If you are in Windows and want use a GUI, with puttygen you can import your private key into it:

Once imported, you can save its public key and compare it to yours.

The easiest is to compare fingerprints as the public and private keys have the same. Visual comparison is pretty easy by putting the two commands on same line:

ssh-keygen -l -f PRIVATE_KEY; ssh-keygen -l -f PUBLIC_KEY

Programmatically, you'll want to ignore the comment portion so

diff -s <(ssh-keygen -l -f PRIVATE_KEY | cut -d' ' -f2) <(ssh-keygen -l -f PUBLIC_KEY | cut -d' ' -f2)

Encrypt something with the public key, and see which private key decrypts it.

This Code Project article by none other than Jeff Atwood implements a simplified wrapper around the .NET cryptography classes. Assuming these keys were created for use with RSA, use the asymmetric class with your public key to encrypt, and the same with your private key to decrypt.

If it returns nothing, then they match:

cat $HOME/.ssh/id_rsa.pub >> $HOME/.ssh/authorized_keys
ssh -i $HOME/.ssh/id_rsa localhost

This answer should contain a warning: https://stackoverflow.com/a/67423640/1312559

WARNING! If the public and private key are in the same directory, the fingerprint is calculated for the public key even though the private key is given as a parameter.

-l' Show fingerprint of specified public key file. Private RSA1 keys are also supported. For RSA and DSA keys ssh-keygen tries to find the matching public key file and prints its fingerprint.

Unfortunately I don't have the reputation to comment.

A simple script to check matching of the keys with 3 options:

 #!/bin/bash

 PRKEY=mysshkey
 PUKEY=mysshkey.pub

 echo "1. OUTPUT"
 diff <( ssh-keygen -y -e -f "${PRKEY}" ) <( ssh-keygen -y -e -f "${PUKEY}")
 echo -e "\n"

 echo "2. OUTPUT"
 diff <( cut -d' ' -f 2 ${PUKEY} ) <( ssh-keygen -y -f "${PRKEY}" | cut -d' ' -f 2)
 echo -e "\n"

 echo "3. OUTPUT"
 DIFF=$(diff <( cut -d' ' -f 2 ${PUKEY} ) <( ssh-keygen -y -f "${PRKEY}" | cut -d' ' -f 2) )
 if [ "$DIFF" != "" ]; then
  echo "ERROR KEY"
 else
  echo "TRUE KEY"
 fi

If they keys not match you will get an output for output 1 and 2.

If they keys match you get no output.

Output 3 show's a message if keys fit or not.

Just use puttygen and load your private key into it. It offers different options, e.g. exporting the corresponding public key.