RSA Private Key Bytes

Sooner or later someone wants proof that an image came out of their graph, or wants a puzzle only the person holding the right file can read. Both start with a key, and ComfyUI has no text box that holds a 1700-character PEM blob without you wanting to cry. This node is the factory that makes one.

It's the entry point to the asymmetric side of ComfyUI ARG Toolkit, a pack built for cryptography, steganography and puzzle-building inside ComfyUI rather than in a terminal next to it. The node generates a real RSA keypair with pyca/cryptography and hands you three views of the private half; everything downstream - signing, decrypting - wants one of them.

How it works

Under the hood it's two library calls and no cleverness: rsa.generate_private_key(public_exponent=..., key_size=...), then private_bytes(encoding, format, encryption_algorithm). Note that nothing can be wired into it - it's a source node, minting data rather than consuming any.

The three outputs are the same key in three shapes, and picking the right one is the whole game:

• key_object (KEYOBJ) - the live Python key object. This is what the signer and decryptor nodes want.
• private_key (BYTESLIKE) - the serialized bytes: PEM text or DER binary, as configured. This is the thing you save, print, paste into a puzzle, or hand to openssl.
• private_numbers (NUMOBJ) - the actual integers (n, e, d, p, q) rather than bytes. Only matters if you're feeding the numbers nodes, e.g. rebuilding a key from a modulus someone gave you in a CTF.

Custom types like KEYOBJ are the plumbing layer in miniature: the wire carries a Python object, and it only connects to nodes declaring the same type, so KEYOBJ out of here plugs into RSA Signature Signer and nothing in core ComfyUI.

The inputs worth setting

Leave public_exponent at 65537. There is a number-one reason it's the default everywhere on earth, and 1 or 3 will get you a technically-valid key that some verifiers refuse.

key_size defaults to 2048 and that's the sane choice. 4096 costs a second of generation and buys nothing for watermarking an image; 512 and 1024 are toy sizes modern tooling will reject or shrug at. The step is 128, so you can't ask for something weird.

Then there's serialization. encoding is PEM or DER - PEM if you're pasting it anywhere, DER if you're feeding raw bytes to something. formatting is PKCS8 (the modern default), TraditionalOpenSSL (the legacy BEGIN RSA PRIVATE KEY block old tools expect) or OpenSSH. That last one has a hard constraint the author notes in the source: OpenSSH requires PEM encoding. Pick OpenSSH + DER and you get an error, not a warning.

Where people get burned

The default encryption setting is a landmine. encryption defaults to "Best Available", and encryption_password is empty by default. cryptography refuses empty passwords with "Password must be 1 or more bytes." - so the first time you drop this node in and hit Queue, you get a red node. Either type a password or switch encryption to None. Neither is wrong; just know which one you did.

The key isn't re-rolled every run. No IS_CHANGED is defined on these nodes, so ComfyUI's cache applies: your key stays identical across queue presses until you touch a widget. Good news - you can sign the same message ten times with a consistent key_object. Bad news - restart ComfyUI or open a fresh workflow and you have a brand new key with no memory of the old one. If the signature must outlive the session, export the bytes: pipe private_key into Bytes-like Object Decode (UTF-8, or Base64 for DER) and save the text somewhere. Don't use the graph as storage.

Installing the pack

Manager is the easy road - search ComfyUI ARG Toolkit and restart. Manually:

cd ComfyUI/custom_nodes
git clone https://github.com/AzelusLightvale/ComfyUI-ARG-Toolkit

But don't run pip install -r requirements.txt here. That file is a uv-compiled lockfile pinning torch==2.14.1 and torchaudio==2.11.0 - feed it to a working ComfyUI env and pip will try to swap your torch out and take CUDA with it. These RSA nodes only need cryptography:

pip install cryptography

The project declares Python >=3.12, so an old environment can fail before you see a node. And because the pack's __init__.py walks src/ and imports every module, a missing steganography dependency (stegano, invisible-watermark) blows up the whole import - you won't get the crypto nodes either. Empty ARG Toolkit category? Read the traceback; it names the missing library.

One expectation-setter: one author, zero reddit footprint, and a README that admits the modern-crypto section is WIP tested by hand. Hit something odd and you're likely the first.