ipfs key export pubkey only option

[ross-spencer]

Checklist

• My issue is specific & actionable.
• I am not suggesting a protocol enhancement.
• I have searched on the issue tracker for my issue.

Description

As a user I want to be able to access my public key so that I can send it to people. Further, I want to have it in ed25519 format, which I only see in three places;

$ ./ipfs key gen gh

# Output
# k51qzi5uqu5dkp219vs64qzyyif5yyh2dwo12zrlc7slwxkckpisg01k48x2yj

./ipfs name publish /ipfs/bafkreifmyb5wf4r7iwesg434jtkkm26qluphd22phbaahovpfxghmdldje --key gh

# Output
# Published to k51qzi5uqu5dkp219vs64qzyyif5yyh2dwo12zrlc7slwxkckpisg01k48x2yj: /ipfs/bafkreifmyb5wf4r7iwesg434jtkkm26qluphd22phbaahovpfxghmdldje

echo "data" | ./ipfs key sign --key my-new-key

# Output
# {"Key":{"Name":"my-new-key","Id":"k51qzi5uqu5dkyu7b6rdcayq3tvmfwqh90hjea80n5p9ih4p3amxar98c1r0wp"},"Signature":"ubefFmYU0dNJfF7r_pR02ulm74gCmuis3xUnbyx7JcKcZXDUBt6xj0KGIeWrNnW7-viYXAXnr5EBiXUzs2FxeDw"}

It should be easier to access, and then it would make the key-signing/verify procedure easier for those sharing signed data via IPFS and verifying it via IPFS.

[ross-spencer]

Additionally, I am not sure the exact base of k51qzi5uqu5dkp219vs64qzyyif5yyh2dwo12zrlc7slwxkckpisg01k48x2yj but being able to choose different versions for output for the pubkey would also be helpful.

[lidel]

The k51qzi5uqu5dkp219vs64qzyyif5yyh2dwo12zrlc7slwxkckpisg01k48x2yj value returned by ipfs key gen already contains your ed25519 public key :)

You can inspect its structure with ipfs cid format:

$ ipfs cid format -f "%P" k51qzi5uqu5dkp219vs64qzyyif5yyh2dwo12zrlc7slwxkckpisg01k48x2yj
cidv1-libp2p-key-identity-36

That tells us: CIDv1, libp2p-key codec, identity multihash, 36-byte digest. The k prefix is the multibase identifier for base36 (the default encoding for IPNS names, fits in DNS label which has length limit of 63 chars).

You can also paste it into the CID Inspector for a visual breakdown:

https://cid.ipfs.tech/#k51qzi5uqu5dkp219vs64qzyyif5yyh2dwo12zrlc7slwxkckpisg01k48x2yj

What this means:

• identity multihash -- the identity hash function (code 0x00) means the data is not actually hashed. It is small enough to be inlined directly inside the multihash itself. The multihash digest is the data, verbatim.
• libp2p-key codec -- tells us the inlined data is a libp2p public key serialized as a PublicKey protobuf.

For ed25519 keys, the public key is only 32 bytes (+ 4 bytes of protobuf framing = 36 bytes total), which is small enough to inline. This means the IPNS name is self-certifying: anyone who has the name can extract the public key from it directly, without any lookup.

Extracting the public key bytes

You can extract the raw multihash digest (the libp2p protobuf-encoded public key) using ipfs cid format:

$ ipfs cid format -f "%D" -b base16 k51qzi5uqu5dkp219vs64qzyyif5yyh2dwo12zrlc7slwxkckpisg01k48x2yj
08011220b511f38128afb29ed4fc237d060295305bb516d727f7e831d90fb406fa9aa53b

The hex breaks down as:

• 0801 -- protobuf: key type = 1 (Ed25519)
• 1220 -- protobuf: 32 bytes of key data follow
• b511f381...a53b -- the raw 32-byte ed25519 public key

Getting a PEM public key

If you need an interoperable PEM format, you can use the existing export command and openssl (as documented in ipfs key export --help):

$ ipfs key export mykey --format=pem-pkcs8-cleartext -o privkey.pem
$ openssl pkey -in privkey.pem -pubout > pubkey.pem

Note: this requires exporting the private key first, then deriving the public key with openssl.

---

@ross-spencer is the above helpful?

I guess a --public-only option for ipfs key export could make this --format=pem-pkcs8-cleartext export simpler, but is that all what you were asking about?
does the above answers your needs and can this be closed, or do you feel we should add --public-only for convenience?

[ross-spencer]

hi @lidel just walking back a little -- you're of course right about ipfs key gen then I don't want to call that again if I just want the existing key. I'm not sure if it's the right sub-command, but yes, export --public-only gets at what I am asking for here. It is a convenience function, I appreciate that, although I think it's super convenient, and I think without it you have to go through a couple of other commands to get back to just the public key.

The CID inspection functions you mention look really helpful, thank you!