OpenSSH Serialized Private Key Loader

You'll find it in the node search as OpenSSH Serialized Private Key Loader, under ARG Toolkit/Cryptography/Modern/Asymmetric. It takes the contents of an OpenSSH private key - the thing in ~/.ssh/id_ed25519, header and all - and turns it into a live key object your graph can sign with, on a KEYOBJ wire. No file access, no ssh-agent, no shelling out to ssh-keygen: it's a thin wrapper around one function from Python's cryptography library, which is either the point or a dealbreaker depending on what you wanted.

Why you'd actually want this

For 99% of ComfyUI work you won't. ComfyUI ARG Toolkit is a cryptography-and-steganography pack aimed at people building or solving alternate reality games, and this node exists so the graph can prove something with a key it didn't generate. Sign a payload with a key that's already been published, so a stranger can verify it with the matching .pub. Check that an artifact in front of you was signed by the key an earlier clue pointed at.

The pack is niche enough that the community barely discusses it, so if you're here you probably arrived with a specific puzzle rather than from a tutorial.

How it works

execute() hands keyfile straight to serialization.load_ssh_private_key(), passing password and unsafe_skip_rsa_key_validation through. That function parses one specific container - the -----BEGIN OPENSSH PRIVATE KEY----- base64 blob modern ssh-keygen writes - and nothing else. A PEM/PKCS#8 key, an old PKCS#1 RSA key, or a PuTTY .ppk fails with ValueError: Not OpenSSH private key format; its sibling PEM Serialized Private Key Loader handles the PEM side, so that's a partitioned design rather than a bug.

Encrypted OpenSSH keys use bcrypt-PBKDF, which matters in a minute.

The inputs that matter

keyfile (BYTESLIKE, required) is the only one you must set, and it's a socket, not a widget - no box to paste into, no path field. The pack ships no file-reading node either, so the route is a multiline STRING → Bytes-like Object Encode with encoding UTF-8 for a pasted OpenSSH block (Hexadecimal or Base64 if the key arrived as a blob in a challenge) → keyfile.

password (BYTESLIKE, optional) is the passphrase - also bytes, so it comes through the same encoder. Leave it disconnected for an unencrypted key.

skip_rsa_key_validation (BOOLEAN, default off) - the author's own tooltip says it best: "Unless you know what you're doing, do not change this. Disabling RSA key validation speeds up key loading, but is unsafe and may cause OpenSSL to misbehave or crash, potentially dragging ComfyUI down with it." Leave it off.

loaded_key (KEYOBJ) is your output. Wire it into EdDSASignature (key source From Loaded Key) for an ed25519 key, or ECSign's private_key for an ecdsa-sha2-nistp256 key. RSA keys load fine, but this pack's signers are curve-specific, so an RSA private key mostly sits there looking loaded.

Install

Manager is the sane path: search ComfyUI ARG Toolkit. Manually:

cd ComfyUI/custom_nodes
git clone https://github.com/AzelusLightvale/ComfyUI-ARG-Toolkit
# then install deps into the python that runs ComfyUI

One warning about that step: requirements.txt is uv-compiled with the whole tree pinned, torch==2.14.0 included. Running pip install -r requirements.txt inside a working ComfyUI environment can reinstall torch and take your CUDA build with it. For these key nodes the only dependency that matters is a reasonably recent cryptography; secretpy, stegano, reedsolo and invisible-watermark are for the other half of the pack. pyproject.toml declares Python >=3.12.

Where people get burned

UnsupportedAlgorithm: Need bcrypt module. The likeliest surprise with this node. cryptography needs the bcrypt package to decrypt passphrase-protected keys, and the pack's requirements don't include it:

python -m pip install bcrypt

Password was given but private key is not encrypted. You wired a passphrase into a key that has none. Disconnect password.

TypeError, or a passphrase that "should" work and doesn't. Passphrases are bytes - run them through Bytes-like Object Encode, and pick the right mode: a malformed hex or base64 string there doesn't error loudly, it logs a warning and silently falls back to raw string bytes.

A key that loads but won't sign. Check the algorithm matches the signer: ed25519 → EdDSA nodes, ECDSA → EC nodes.

Your key leaking into a shared workflow. The most important one, and it isn't a bug: anything you paste into a widget lives in the workflow JSON, so a private key and its passphrase go along with the workflow if you share it. No node in this pack saves you from that one.