Securityflags: g

SSH Public Key

Match SSH public keys in OpenSSH `authorized_keys` format, including the optional comment field.

Available in

JavaScript / ECMAScript code

jsJavaScript

const re = new RegExp("ssh-(?:rsa|dss|ed25519|ecdsa-sha2-nistp(?:256|384|521))\\s+[A-Za-z0-9+\\/=]+(?:\\s+\\S+)?", "g");
const input = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBVxr alice@laptop";
const matches = [...input.matchAll(re)];
console.log(matches.map(m => m[0]));

Uses `String.prototype.matchAll` for global iteration (Node 12+ / all modern browsers).

Python (re) code

pyPython

import re

pattern = re.compile(r"ssh-(?:rsa|dss|ed25519|ecdsa-sha2-nistp(?:256|384|521))\s+[A-Za-z0-9+\/=]+(?:\s+\S+)?")
input_text = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBVxr alice@laptop"
for m in pattern.finditer(input_text):
    print(m.group(0))

Stdlib `re` module — no third-party dependency. Works on Python 3.6+.

Go (RE2) code

goGo

package main

import (
	"fmt"
	"regexp"
)

func main() {
	re := regexp.MustCompile(`ssh-(?:rsa|dss|ed25519|ecdsa-sha2-nistp(?:256|384|521))\s+[A-Za-z0-9+\/=]+(?:\s+\S+)?`)
	input := `ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBVxr alice@laptop`
	for _, match := range re.FindAllString(input, -1) {
		fmt.Println(match)
	}
}

Uses `regexp.MustCompile` (panics on bad patterns at startup) and `FindAllString` for all matches.

Pattern

regexengine-agnostic

ssh-(?:rsa|dss|ed25519|ecdsa-sha2-nistp(?:256|384|521))\s+[A-Za-z0-9+\/=]+(?:\s+\S+)?   (flags: g)

Raw source: ssh-(?:rsa|dss|ed25519|ecdsa-sha2-nistp(?:256|384|521))\s+[A-Za-z0-9+\/=]+(?:\s+\S+)?

How it works

ssh-(?:rsa|dss|ed25519|ecdsa-sha2-nistp(?:256|384|521)) matches the key-type prefix for the four common algorithms. \s+ requires whitespace before the base64 body. [A-Za-z0-9+\/=]+ matches the base64-encoded key material. (?:\s+\S+)? optionally matches a trailing comment (typically `user@host`).