DSA Key Pair Verification: Using ssh-keygen to Match Public and Private Keys

Technical Principles of DSA Key Pair Verification

In public-key cryptography, the Digital Signature Algorithm (DSA) is widely used for digital signatures. Public and private keys have a specific mathematical relationship: the public key can be derived from the private key, but the reverse computation is computationally infeasible. This asymmetric property enables key pair verification without exposing sensitive private key information.

Rapid Verification Using ssh-keygen

The ssh-keygen command from the OpenSSH toolkit offers a concise and efficient verification method. The -y option is specifically designed to generate the corresponding public key from a private key:

ssh-keygen -y -f <private_key_file>

Executing this command outputs the public key corresponding to the specified private key. Users can compare this output with existing *.pub files. If the contents match exactly, it confirms that the private key and public key file form a valid key pair.

Detailed Operational Steps

Assuming multiple id_dsa.key (private) and id_dsa.pub (public) files exist in the current directory, the verification process can be broken down as follows:

1. Execute the generation command for each private key file: ssh-keygen -y -f id_dsa.key > generated.pub
2. Use text comparison tools (such as diff or cmp) to compare the generated public key file with existing public key files
3. If perfectly matching file pairs are found, the key pair correspondence is confirmed

This method is particularly suitable for batch processing scenarios and can be automated with simple shell scripts:

#!/bin/bash
for priv_key in *.key; do
    pub_content=$(ssh-keygen -y -f "$priv_key")
    for pub_key in *.pub; do
        if [ "$pub_content" = "$(cat "$pub_key")" ]; then
            echo "Match found: $priv_key -> $pub_key"
        fi
    done
done

Supplementary Method: OpenSSL Modulus Hash Comparison

In addition to the ssh-keygen approach, OpenSSL tools can be used for verification by computing modulus hash values. This method focuses on comparing the mathematical modulus of the keys:

# Calculate MD5 hash of private key modulus
openssl dsa -noout -modulus -in private.key | openssl md5

# Calculate MD5 hash of public key modulus
openssl dsa -pubin -noout -modulus -in public.pub | openssl md5

If both hash values are identical, it indicates that the public and private keys share the same modulus, confirming their match. Note that the original answer provided commands for RSA keys; for DSA keys, the dsa subcommand should be used instead of rsa.

Method Comparison and Selection Guidelines

Advantages of the ssh-keygen method:

• Directly generates complete public key content for intuitive comparison
• Eliminates additional hash computation steps
• High availability as OpenSSH tools are commonly pre-installed

Scenarios for the OpenSSL method:

• Verifying matches between certificates (.crt) or certificate signing requests (.csr) and keys
• Environments with OpenSSL installed but not OpenSSH
• Unified processing requiring verification of multiple key types (RSA, DSA, ECC, etc.)

Security Considerations

When performing key verification operations, the following security practices should be observed:

• Set appropriate permissions for private key files (e.g., 600) to prevent unauthorized access
• Avoid handling private keys in public or insecure environments
• Promptly clean up generated temporary files after verification
• For production environments, conduct verification in isolated, secure settings

Practical Application Extensions

Based on the core verification principles, more advanced key management tools can be developed:

• Automated key pair discovery and archiving systems
• Key expiration monitoring and renewal alerts
• Key synchronization verification in multi-server environments
• Integration with configuration management tools (e.g., Ansible, Puppet)

By mastering these verification techniques, system administrators can manage public key infrastructure more effectively, ensuring the security and reliability of encrypted communications.