---
product: Chilkat
product_version: 11.7.0
language: pascal
language_label: Lazarus Pascal
class: SshKey
license: bundle
deprecated: false
reference_html: https://www.chilkatsoft.com/refdoc/pascal_SshKeyRef.html
---
# Chilkat SshKey — Lazarus Pascal — v11.7.0

> Chilkat 11.7.0 · language=pascal · class=SshKey
> Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0/<lang>/classes/SshKey.md`.
> Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/guide.md`.

## Purpose

**Import, export, generate, inspect, convert, and use SSH public or private keys.**

`Chilkat.SshKey` represents an SSH public or private key used for SSH authentication and key-management workflows. It can import, export, generate, inspect, and convert SSH keys in common formats such as OpenSSH, PuTTY, RFC 4716, and XML. It also supports encrypted private keys, key comments, fingerprints, RSA, DSA, ECDSA, and Ed25519 key types, PKCS#11-backed keys, and SSH user certificates for public-key authentication.

**Import SSH keys**

Load public or private SSH keys from OpenSSH, PuTTY, RFC 4716, XML, and other supported SSH key representations.

**Export and convert**

Convert SSH keys between supported formats for use with SSH servers, clients, key files, configuration tools, or other systems.

**Generate key pairs**

Generate SSH key pairs when an application needs new authentication key material.

**Inspect key details**

Determine whether a key is public or private, identify the key type, read comments, and compute fingerprints for verification or display.

**Encrypted private keys**

Load or export password-protected private keys when SSH key material must be stored securely.

**PKCS#11 and certificates**

Use PKCS#11-backed keys and SSH user certificates for authentication workflows where the private key may be token-backed or certificate-based.

**Common pattern:** Use `SshKey` to load, generate, inspect, or convert SSH key material, then pass the key to `Chilkat.Ssh`, `Chilkat.SFtp`, or another SSH-based Chilkat class for public-key authentication. Use `Password` when importing or exporting encrypted private keys, and use `UsePkcs11` or `UseSshCertificate` when the authentication workflow depends on a token-backed key or SSH user certificate.

For an extended overview, see [SshKey Class Overview](https://www.chilkatsoft.com/sshkey_class_overview.asp).

## Object creation, unlocking and error handling

**Create / Free**

```pascal
uses
  Chilkat.SshKey;

var
  obj: TSshKey;
begin
  obj := TSshKey.Create;
  try
    if not obj.IsValid then
      raise Exception.Create('Failed to create a TSshKey instance.');

    // ... use obj ...

  finally
    obj.Free;
  end;
end;
```

`constructor Create;`

Allocates the underlying CkSshKey object and returns a new TSshKey instance. Simply adding **Chilkat.SshKey** to the unit's `uses` clause is enough to locate and bind to the Chilkat shared library (DLL / .so / .dylib) at runtime — no separate load step is required. Check `obj.IsValid` after calling `Create`; it is `False` if the underlying library could not be found/loaded or the object could not be allocated (for example, when unlicensed).

`destructor Destroy; override;`

Every TSshKey created by calling `Create` should eventually be released by calling `.Free` (inherited from `TObject`). The destructor automatically disposes the underlying CkSshKey handle. A native (unmanaged) memory leak occurs if the object is never freed.

Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Lazarus Pascal.

## Members common to every Chilkat class

Documented once per language in `common-members.md`; listed here so this page is self-contained.

| Property | Signature | Access | Meaning |
|---|---|---|---|
| `DebugLogFilePath` | `property DebugLogFilePath: string read GetDebugLogFilePath write SetDebugLogFilePath;` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. |
| `LastErrorHtml` | `property LastErrorHtml: string read GetLastErrorHtml;` | read-only | Provides HTML-formatted information about the last called method or property. |
| `LastErrorText` | `property LastErrorText: string read GetLastErrorText;` | read-only | Provides plain text information about the last called method or property. |
| `LastErrorXml` | `property LastErrorXml: string read GetLastErrorXml;` | read-only | Provides XML-formatted information about the last called method or property. |
| `LastMethodSuccess` | `property LastMethodSuccess: Boolean read GetLastMethodSuccess write SetLastMethodSuccess;` | read/write | Indicates the success or failure of the most recent method call: `True` means success, `False` means failure. |
| `VerboseLogging` | `property VerboseLogging: Boolean read GetVerboseLogging write SetVerboseLogging;` | read/write | If set to `True`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. |
| `Version` | `property Version: string read GetVersion;` | read-only | Version of the component/library, such as "10.1.0" |

## Member index

| Member | Kind | Signature |
|---|---|---|
| `Comment` | property, read/write | `property Comment: string read GetComment write SetComment;` |
| `IsDsaKey` | property, read-only | `property IsDsaKey: Boolean read GetIsDsaKey;` |
| `IsPrivateKey` | property, read-only | `property IsPrivateKey: Boolean read GetIsPrivateKey;` |
| `IsRsaKey` | property, read-only | `property IsRsaKey: Boolean read GetIsRsaKey;` |
| `KeyType` | property, read-only | `property KeyType: string read GetKeyType;` |
| `Password` | property, read/write | `property Password: string read GetPassword write SetPassword;` |
| `UncommonOptions` | property, read/write | `property UncommonOptions: string read GetUncommonOptions write SetUncommonOptions;` |
| `FromOpenSshPrivateKey` | method | `function FromOpenSshPrivateKey(const keyStr: string): Boolean;` |
| `FromOpenSshPublicKey` | method | `function FromOpenSshPublicKey(const keyStr: string): Boolean;` |
| `FromPuttyPrivateKey` | method | `function FromPuttyPrivateKey(const keyStr: string): Boolean;` |
| `FromRfc4716PublicKey` | method | `function FromRfc4716PublicKey(const keyStr: string): Boolean;` |
| `FromXml` | method | `function FromXml(const xmlKey: string): Boolean;` |
| `GenerateDsaKey` | method | `function GenerateDsaKey(numBits: Integer): Boolean;` |
| `GenerateEcdsaKey` | method | `function GenerateEcdsaKey(const curveName: string): Boolean;` |
| `GenerateEd25519Key` | method | `function GenerateEd25519Key: Boolean;` |
| `GenerateRsaKey` | method | `function GenerateRsaKey(numBits: Integer;     exponent: Integer): Boolean;` |
| `GenFingerprint` | method | `function GenFingerprint: string;` |
| `LoadText` | method | `function LoadText(const filename: string): string;` |
| `SaveText` | method | `function SaveText(const strToSave: string;     const filename: string): Boolean;` |
| `ToOpenSshPrivateKey` | method | `function ToOpenSshPrivateKey(bEncrypt: Boolean): string;` |
| `ToOpenSshPublicKey` | method | `function ToOpenSshPublicKey: string;` |
| `ToPuttyPrivateKey` | method | `function ToPuttyPrivateKey(bEncrypt: Boolean): string;` |
| `ToRfc4716PublicKey` | method | `function ToRfc4716PublicKey: string;` |
| `ToXml` | method | `function ToXml: string;` |
| `UsePkcs11` | method | `// session is a TPkcs11 object. function UsePkcs11(session: TChilkatBase;     privKeyHandle: LongWord;     pubKeyHandle: LongWord;     const keyType: string): Boolean;` |
| `UseSshCertificate` | method | `function UseSshCertificate(const sshCert: string): Boolean;` |

## Properties

### SshKey.Comment

`Chilkat 11.7.0 · pascal · SshKey · Comment · property · read/write`

```pascal
property Comment: string read GetComment write SetComment;
```

Gets or sets the optional comment associated with the key.

- OpenSSH public keys, RFC 4716 public keys, and PuTTY PPK files can contain a comment. Importing one of these formats sets this property from the imported text.
- Importing an OpenSSH or RFC 4716 public key that has no comment sets this property to an empty string.
- Changing the comment does not change the key or the value returned by `GenFingerprint`.
- Exports that support comments use this value. Do not include carriage-return or line-feed characters because they are written into the exported text and can make the key file invalid.

**OpenSSH import note:** For a one-line OpenSSH public key, the first whitespace-delimited word following the Base64 key data is stored as the comment.

### SshKey.IsDsaKey

`Chilkat 11.7.0 · pascal · SshKey · IsDsaKey · property · read-only`

```pascal
property IsDsaKey: Boolean read GetIsDsaKey;
```

Indicates whether the object currently contains a DSA key.

Returns `True` for either a DSA public key or a DSA private key. Returns `False` for RSA, ECDSA, Ed25519, or when no key is loaded. Use `KeyType` to distinguish among all supported key types.

### SshKey.IsPrivateKey

`Chilkat 11.7.0 · pascal · SshKey · IsPrivateKey · property · read-only`

```pascal
property IsPrivateKey: Boolean read GetIsPrivateKey;
```

Indicates whether the current key includes a private key.

Returns `True` after importing or generating a private key. Returns `False` for a public-only key and for a newly constructed object that does not yet contain a key.

This property describes whether private-key operations are available; it does not reveal or return the private-key material.

### SshKey.IsRsaKey

`Chilkat 11.7.0 · pascal · SshKey · IsRsaKey · property · read-only`

```pascal
property IsRsaKey: Boolean read GetIsRsaKey;
```

Indicates whether the object currently contains an RSA key.

Returns `True` for either an RSA public key or an RSA private key. Returns `False` for DSA, ECDSA, Ed25519, or when no key is loaded. Use `KeyType` to distinguish among all supported key types.

### SshKey.KeyType

`Chilkat 11.7.0 · pascal · SshKey · KeyType · property · read-only · since 9.5.0.83`

```pascal
property KeyType: string read GetKeyType;
```

Returns the type of key currently held by this object. A newly constructed object returns `none`.

| Value | Meaning |
| :--- | :--- |
| `rsa` | RSA public or private key |
| `dsa` | DSA public or private key |
| `ecdsa` | ECDSA public or private key |
| `ed25519` | Ed25519 public or private key |
| `none` | No usable key is loaded |

### SshKey.Password

`Chilkat 11.7.0 · pascal · SshKey · Password · property · read/write`

```pascal
property Password: string read GetPassword write SetPassword;
```

Gets or sets the password used when importing or exporting an encrypted private key. The default is an empty string.

- Set this property before importing an encrypted OpenSSH, PKCS #8, or PuTTY private key.
- An empty or incorrect password causes an encrypted-key import to fail.
- The property remains set until the application changes it; Chilkat does not automatically clear it after an import or export.
- When `ToOpenSshPrivateKey` is called with `bEncrypt` equal to `True`, an empty password produces a private key encrypted with an empty passphrase. Applications should normally require a nonempty password.
- When `ToPuttyPrivateKey` is called with `bEncrypt` equal to `True`, this property must be nonempty.

### SshKey.UncommonOptions

`Chilkat 11.7.0 · pascal · SshKey · UncommonOptions · property · read/write`

```pascal
property UncommonOptions: string read GetUncommonOptions write SetUncommonOptions;
```

Provides optional settings for uncommon compatibility requirements. The default is an empty string.

The value is a comma-separated list of keywords. Keyword matching is case-insensitive, surrounding whitespace is ignored, and unknown keywords are ignored.

- `DES-EDE3-CBC` — When `ToOpenSshPrivateKey` exports an encrypted traditional RSA, DSA, or ECDSA private key, use Triple-DES instead of the default AES-128-CBC encryption.

This option does not change Ed25519 output, which uses the modern `OPENSSH PRIVATE KEY` container. Use legacy encryption only when required by older software.

## Methods

### SshKey.FromOpenSshPrivateKey

`Chilkat 11.7.0 · pascal · SshKey · FromOpenSshPrivateKey · method`

```pascal
function  FromOpenSshPrivateKey(const keyStr: string): Boolean;
```

Loads a private key from an OpenSSH-compatible, PEM, PKCS #8, or PuTTY private-key string.

**Supported key types:** RSA, DSA, ECDSA, and Ed25519.

| Input representation | Typical boundary or header |
| :--- | :--- |
| Modern OpenSSH | `BEGIN OPENSSH PRIVATE KEY` |
| Traditional RSA, DSA, or ECDSA PEM | `BEGIN RSA PRIVATE KEY`, `BEGIN DSA PRIVATE KEY`, or `BEGIN ECDSA PRIVATE KEY` |
| PKCS #8 | `BEGIN PRIVATE KEY` or `BEGIN ENCRYPTED PRIVATE KEY` |
| PuTTY PPK version 2 or 3 | `PuTTY-User-Key-File-2` or `PuTTY-User-Key-File-3` |

`keyStr` contains the key text, not a filesystem path. If the key is encrypted, set `Password` before calling this method. To read the text from a file, call `LoadText` first.

Chilkat tolerates a UTF-8 BOM, leading or trailing whitespace, and unrelated text surrounding a PEM/OpenSSH key. If `keyStr` contains more than one recognized private key, the first key is loaded.

```
-----BEGIN OPENSSH PRIVATE KEY-----
...
-----END OPENSSH PRIVATE KEY-----
```

**Object-state note:** A successful call replaces the current key. If the call fails after parsing has begun—for example, because the password is wrong or the key data is damaged—the previous key is not guaranteed to remain available. Use a fresh `SshKey` object when an application must preserve an existing key.

Returns True for success, False for failure.

### SshKey.FromOpenSshPublicKey

`Chilkat 11.7.0 · pascal · SshKey · FromOpenSshPublicKey · method`

```pascal
function  FromOpenSshPublicKey(const keyStr: string): Boolean;
```

Loads an SSH public key from a string.

The method accepts:

- A one-line OpenSSH public key for RSA, DSA, ECDSA, or Ed25519.
- An RFC 4716 / PuTTY SSH2 public key, which is detected automatically.

`keyStr` contains the public-key text, not a filesystem path. For a one-line key, the first field is the algorithm name, the second field is the Base64 key data, and the first whitespace-delimited word after the key data is stored in `Comment`.

```
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... user@example
```

A UTF-8 BOM, surrounding whitespace, CRLF, and LF line endings are accepted. If multiple public-key lines are supplied, the first key is loaded.

**`authorized_keys` note:** `keyStr` must begin with the key algorithm. A complete `authorized_keys` entry having options such as `restrict` or `from="..."` before the algorithm is not accepted. Remove those options before calling this method.

**Object-state note:** A successful call replaces the current key. After a failed import, do not assume the previous key and properties are unchanged.

Returns True for success, False for failure.

### SshKey.FromPuttyPrivateKey

`Chilkat 11.7.0 · pascal · SshKey · FromPuttyPrivateKey · method`

```pascal
function  FromPuttyPrivateKey(const keyStr: string): Boolean;
```

Loads a private key from PuTTY PPK format. PPK versions 2 and 3 are supported.

If `keyStr` contains an OpenSSH, traditional PEM, or PKCS #8 private key instead, Chilkat automatically detects and imports that format.

- `keyStr` contains the complete key text, not a filesystem path.
- If the private key is encrypted, set `Password` before calling this method.
- The PPK integrity MAC is verified.
- A UTF-8 BOM is accepted. For a PPK input, the PPK header must otherwise be at the beginning of `keyStr`; leading whitespace or unrelated text is not accepted.
- Trailing text after a single PPK is tolerated, but concatenated PPK files are not accepted.

```
PuTTY-User-Key-File-3: ssh-ed25519
Encryption: aes256-cbc
Comment: example-key
Public-Lines: ...
```

**Object-state note:** A successful call replaces the current key. If the call fails, the previous key is not guaranteed to remain available.

Returns True for success, False for failure.

### SshKey.FromRfc4716PublicKey

`Chilkat 11.7.0 · pascal · SshKey · FromRfc4716PublicKey · method`

```pascal
function  FromRfc4716PublicKey(const keyStr: string): Boolean;
```

Loads a public key from RFC 4716 SSH2 public-key format.

`keyStr` contains the key text, not a filesystem path. RSA, DSA, ECDSA, and Ed25519 public keys are supported.

```
---- BEGIN SSH2 PUBLIC KEY ----
Comment: "optional comment"
AAAAB3NzaC1yc2EAAAADAQABAAABAQ...
---- END SSH2 PUBLIC KEY ----
```

The parser accepts a UTF-8 BOM, surrounding whitespace, long or continued comments, and additional RFC 4716 header fields. It also tolerates unrelated text before or after the key. If multiple RFC 4716 keys are supplied, the first key is loaded.

The `Comment:` header, when present, is stored in `Comment`. If it is absent, the comment is empty.

**Object-state note:** A successful call replaces the current key. After a failed import, do not assume the previous key and properties are unchanged.

Returns True for success, False for failure.

### SshKey.FromXml

`Chilkat 11.7.0 · pascal · SshKey · FromXml · method`

```pascal
function  FromXml(const xmlKey: string): Boolean;
```

Loads an SSH public or private key from an XML string.

`xmlKey` contains the XML itself, not a filesystem path. The key is public-only when the XML contains only public components and is private when private components are present.

| Key type | Private-key form | Public-key form |
| :--- | :--- | :--- |
| RSA | `RSAKeyValue` | `RSAPublicKey` |
| DSA | `DSAKeyValue` | `DSAPublicKey` |
| ECDSA | `ECCKeyValue` | `ECCPublicKey` |
| Ed25519 | `Ed25519KeyValue` | `Ed25519PublicKey` |

```
<RSAKeyValue>
  <Modulus>...</Modulus>
  <Exponent>AQAB</Exponent>
  ...
</RSAKeyValue>
```

A UTF-8 BOM, surrounding whitespace, and an XML declaration are accepted. Root-element name matching is case-insensitive. These XML representations do not contain the SSH comment; set `Comment` separately when needed.

**Object-state note:** A successful call replaces the current key. After a failed import, do not assume the previous key and properties are unchanged.

Returns True for success, False for failure.

### SshKey.GenerateDsaKey

`Chilkat 11.7.0 · pascal · SshKey · GenerateDsaKey · method`

```pascal
function  GenerateDsaKey(numBits: Integer): Boolean;
```

Generates a new DSA public/private key pair.

`numBits` specifies the requested key size in bits. For maximum interoperability with SSH implementations that still allow DSA, use `1024`.

Nonstandard sizes may be accepted, and the resulting key size may differ from the value requested. DSA is a legacy algorithm and should generally be avoided for new systems.

On success, the generated private key replaces the previous key. Existing values of `Comment`, `Password`, and `UncommonOptions` are not used as key-generation parameters.

Returns True for success, False for failure.

### SshKey.GenerateEcdsaKey

`Chilkat 11.7.0 · pascal · SshKey · GenerateEcdsaKey · method · since 9.5.0.83`

```pascal
function  GenerateEcdsaKey(const curveName: string): Boolean;
```

Generates a new ECDSA public/private key pair.

`curveName` selects the curve. Matching is case-insensitive. Accepted names include:

- `secp256r1`, `P-256`, or `prime256v1`
- `secp384r1` or `P-384`
- `secp521r1` or `P-521`

An empty or unrecognized curve name causes the method to fail. If generation fails, the previous key is not guaranteed to remain available.

On success, the generated private key replaces the previous key while the writable properties remain set. P-521 is shown as `528` bits by `GenFingerprint`.

Returns True for success, False for failure.

### SshKey.GenerateEd25519Key

`Chilkat 11.7.0 · pascal · SshKey · GenerateEd25519Key · method · since 9.5.0.83`

```pascal
function  GenerateEd25519Key: Boolean;
```

Generates a new Ed25519 public/private key pair.

On success, the generated private key replaces the previous key. Existing values of `Comment`, `Password`, and `UncommonOptions` remain set.

Ed25519 private keys are exported by `ToOpenSshPrivateKey` using the modern `OPENSSH PRIVATE KEY` container.

Returns True for success, False for failure.

### SshKey.GenerateRsaKey

`Chilkat 11.7.0 · pascal · SshKey · GenerateRsaKey · method`

```pascal
function  GenerateRsaKey(numBits: Integer;
    exponent: Integer): Boolean;
```

Generates a new RSA public/private key pair.

- `numBits` specifies the requested key size in bits. Tested supported sizes range from `512` through `4096`. For new applications, use at least `2048`.
- The `exponent` argument is ignored. Chilkat always generates RSA keys using the public exponent `65537`. The argument is retained for backward compatibility.

On success, the generated private key replaces the previous key. The writable properties `Comment`, `Password`, and `UncommonOptions` remain set to their existing values.

If generation fails, the previous key is not guaranteed to remain available. Use a fresh object when preserving an existing key is important.

Returns True for success, False for failure.

### SshKey.GenFingerprint

`Chilkat 11.7.0 · pascal · SshKey · GenFingerprint · method`

```pascal
function  GenFingerprint: string;
```

Returns a printable fingerprint for the key currently held by this object.

The fingerprint is calculated from the public portion of the key. Therefore:

- The public and private representations of the same key return the same fingerprint.
- OpenSSH, PuTTY, RFC 4716, and XML representations of the same key return the same fingerprint.
- Changing `Comment` does not change the fingerprint.

The returned string contains the SSH algorithm name, the reported key size when applicable, and a colon-separated 16-byte hexadecimal digest:

```
ssh-rsa 2048 4c:98:46:ba:46:33:ba:9e:39:11:5c:a5:a3:9c:6b:ee
ssh-ed25519  b7:71:3f:81:d6:fd:1d:b1:ff:87:18:63:f6:32:3f:67
```

Ed25519 has no numeric size field. A P-521 ECDSA key is reported as `528` bits because of its SSH point encoding. If no usable key is loaded, an empty string is returned.

Returns True for success, False for failure.

### SshKey.LoadText

`Chilkat 11.7.0 · pascal · SshKey · LoadText · method`

```pascal
function  LoadText(const filename: string): string;
```

Reads an entire text file and returns its contents as a string.

`filename` is the path of the file to read. This method is convenient for loading ASCII-armored SSH key text before calling an import method.

- If the file does not exist or cannot be read, the method returns null.
- This is a text operation, not a byte-preserving binary read. Non-ASCII data may be converted according to the platform and Chilkat string-encoding settings.
- For exact binary bytes, use a binary-oriented class such as `BinData` or `FileAccess` instead.

Returns True for success, False for failure.

### SshKey.SaveText

`Chilkat 11.7.0 · pascal · SshKey · SaveText · method`

```pascal
function  SaveText(const strToSave: string;
    const filename: string): Boolean;
```

Writes a string to a text file.

- `strToSave` contains the text to write.
- `filename` is the destination path.
- An existing file is overwritten.
- Missing parent directories are not created automatically.
- This is a text operation. ASCII key text is written as expected, but arbitrary non-ASCII bytes should be written with a binary-oriented API.

This method is commonly used to save the strings returned by the key-export methods.

Returns True for success, False for failure.

### SshKey.ToOpenSshPrivateKey

`Chilkat 11.7.0 · pascal · SshKey · ToOpenSshPrivateKey · method`

```pascal
function  ToOpenSshPrivateKey(bEncrypt: Boolean): string;
```

Exports the current private key as an OpenSSH-compatible private-key string.

- `bEncrypt` equal to `False` returns an unencrypted private key.
- `bEncrypt` equal to `True` returns an encrypted private key using `Password`.
- If the object contains only a public key, the method fails.

| Key type | Output container |
| :--- | :--- |
| RSA | `BEGIN RSA PRIVATE KEY` |
| DSA | `BEGIN DSA PRIVATE KEY` |
| ECDSA | `BEGIN ECDSA PRIVATE KEY` |
| Ed25519 | `BEGIN OPENSSH PRIVATE KEY` |

Encrypted traditional RSA, DSA, and ECDSA output uses AES-128-CBC by default. See `UncommonOptions` for the legacy Triple-DES option.

**Empty-password warning:** When `bEncrypt` is `True` and `Password` is empty, the method still returns a key encrypted with an empty passphrase.

The output uses CRLF line endings and ends with CRLF.

```
-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----
```

Returns True for success, False for failure.

### SshKey.ToOpenSshPublicKey

`Chilkat 11.7.0 · pascal · SshKey · ToOpenSshPublicKey · method`

```pascal
function  ToOpenSshPublicKey: string;
```

Exports the public portion of the current key in one-line OpenSSH public-key format.

The method works when the object contains either a private key or a public-only key. The returned string contains the algorithm name, Base64 key data, and the current `Comment` when it is nonempty:

```
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ... user@example
```

The returned string does not include a final CRLF or LF. It contains a bare key entry and does not add `authorized_keys` options such as `restrict` or `from="..."`.

Do not place CR or LF characters in `Comment`, because the comment is appended without newline sanitization.

Returns True for success, False for failure.

### SshKey.ToPuttyPrivateKey

`Chilkat 11.7.0 · pascal · SshKey · ToPuttyPrivateKey · method`

```pascal
function  ToPuttyPrivateKey(bEncrypt: Boolean): string;
```

Exports the current private key as a PuTTY PPK string.

- `bEncrypt` equal to `False` returns an unencrypted PPK.
- `bEncrypt` equal to `True` returns an encrypted PPK using AES-256-CBC and requires a nonempty `Password`.
- If the object contains only a public key, the method fails.

The emitted format is PuTTY PPK version 2. `FromPuttyPrivateKey` can import both PPK version 2 and version 3.

The returned text includes the public and private sections, `Comment`, and the integrity MAC. It uses CRLF line endings and ends with CRLF.

```
PuTTY-User-Key-File-2: ssh-rsa
Encryption: aes256-cbc
Comment: example-key
Public-Lines: ...
```

Do not place CR or LF characters in `Comment`.

Returns True for success, False for failure.

### SshKey.ToRfc4716PublicKey

`Chilkat 11.7.0 · pascal · SshKey · ToRfc4716PublicKey · method`

```pascal
function  ToRfc4716PublicKey: string;
```

Exports the public portion of the current key in RFC 4716 SSH2 public-key format.

The method works when the object contains either a private key or a public-only key. The returned text contains boundary lines, wrapped Base64 key data, and a `Comment:` header. When `Comment` is empty, the header is emitted as `Comment: ""`.

```
---- BEGIN SSH2 PUBLIC KEY ----
Comment: "optional comment"
AAAAB3NzaC1yc2EAAAADAQABAAABAQ...
---- END SSH2 PUBLIC KEY ----
```

The output uses CRLF line endings and ends with CRLF. Do not place CR or LF characters in `Comment`.

Returns True for success, False for failure.

### SshKey.ToXml

`Chilkat 11.7.0 · pascal · SshKey · ToXml · method`

```pascal
function  ToXml: string;
```

Exports the current key as XML.

A public-only key produces a public-key XML representation. A private key produces XML containing private-key components and must therefore be protected as sensitive key material.

| Key type | Private-key root | Public-key root |
| :--- | :--- | :--- |
| RSA | `RSAKeyValue` | `RSAPublicKey` |
| DSA | `DSAKeyValue` | `DSAPublicKey` |
| ECDSA | `ECCKeyValue` | `ECCPublicKey` |
| Ed25519 | `Ed25519KeyValue` | `Ed25519PublicKey` |

```
<RSAKeyValue>
  <Modulus>...</Modulus>
  <Exponent>AQAB</Exponent>
  ... private components ...
</RSAKeyValue>
```

The XML does not include `Comment`. The returned string does not have a final newline and can be loaded by `FromXml`.

Returns True for success, False for failure.

### SshKey.UsePkcs11

`Chilkat 11.7.0 · pascal · SshKey · UsePkcs11 · method · since 9.5.0.96`

```pascal
// session is a TPkcs11 object.

function  UsePkcs11(session: TChilkatBase;
    privKeyHandle: LongWord;
    pubKeyHandle: LongWord;
    const keyType: string): Boolean;
```

Configures this object to use a private key held in a PKCS#11 token, smart card, or HSM for SSH public-key authentication.

- `session` is the `Pkcs11` session containing the key objects.
- `privKeyHandle` is the PKCS#11 handle of the private key.
- `pubKeyHandle` is the PKCS#11 handle of the corresponding public key.
- `keyType` identifies the key type and must be `RSA` or `EC`.

The private-key operation is performed by the PKCS#11 device, allowing the private key to remain on the token.

Returns True for success, False for failure.

### SshKey.UseSshCertificate

`Chilkat 11.7.0 · pascal · SshKey · UseSshCertificate · method · since 11.0.0`

```pascal
function  UseSshCertificate(const sshCert: string): Boolean;
```

**Full documentation for this method (same in every language):** [Understanding SSH Certificates](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/understanding_ssh_certificates.md)

Associates an OpenSSH user certificate with this object for SSH or SFTP public-key authentication.

`sshCert` contains the complete certificate text, not a filesystem path. An SSH user certificate has the same one-line text structure as an OpenSSH public key, but its algorithm name ends in `-cert-v01@openssh.com`:

```
ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EAAAADAQAB... user@host
```

The certificate is used together with its corresponding private key during authentication.

Returns True for success, False for failure.

## Related classes

[`Pkcs11`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/Pkcs11.md)