OpenSSH Serialized Public Key Loader

Display name OpenSSH Serialized Public Key Loader, category ARG Toolkit/Cryptography/Modern/Asymmetric. It parses the single line you'd find in authorized_keys or in id_ed25519.pub - ssh-ed25519 AAAAC3Nza... you@host - and hands you back a real key object on a KEYOBJ wire.

One input, one output, and of the three SSH nodes in this pack it's the least likely to surprise you, which is a compliment.

Why you'd reach for it

Verification, not signing. A public key on its own proves nothing: it's public, anyone can paste it. What it's for is the other half of a signature check - you were handed a .pub (from a puzzle, a challenge, a partner's workflow notes) and you have a signature and a message that claim to come from it. Load the key, wire it into the pack's verify node, and get a boolean out the other end. Inside ComfyUI, in the same graph as the image the whole thing is about.

That's the pack's own stated purpose: cryptography and hidden-message work that never leaves the graph. It's a niche corner of the ecosystem - this pack barely shows up in community discussion - so the reason to use this node over ssh-keygen on the command line is that you want the answer inside a workflow.

How it works

execute() is one line: serialization.load_ssh_public_key(keyfile). That function parses the OpenSSH one-line format - key type string, base64 blob, optional trailing comment - and builds the matching key object. RSA, ed25519, DSA (deprecated by cryptography itself), the NIST ECDSA curves, and hardware-backed sk- public keys all go through the same door.

One nice extra in current cryptography versions: if the line you feed it is actually an SSH certificate, the loader unwraps it and returns the certificate's inner public key rather than choking. Handy, and not obvious from the node name.

Inputs and output

keyfile (BYTESLIKE, required) is the whole interface. Paste the .pub contents into a multiline string and pipe it through the pack's Bytes-like Object Encode node with encoding UTF-8 - the field is a socket with no widget, so there's genuinely no box to paste into. Same pattern as every other key input in the pack.

loaded_key (KEYOBJ) is the output. It only wires into this pack's own consumers - KEYOBJ is a custom type, so preview nodes, save nodes and anything core will refuse the connection. In practice:

EdDSAVerify - set its key source to From Loaded Key and wire this into public_key, along with the message and signature bytes. Output is a BOOLEAN, and the pack's Boolean Outputter node turns that into readable text so you can actually see the result.
ECVerify - takes public_key as a required KEYOBJ input, for ecdsa-sha2-* keys.
EdDSAPublicKeyFormat with source From Loaded Key if you want the key re-serialized back into bytes in a different encoding - occasionally useful for normalizing a key you pasted.

Install

ComfyUI Manager, search ComfyUI ARG Toolkit, or:

cd ComfyUI/custom_nodes
git clone https://github.com/AzelusLightvale/ComfyUI-ARG-Toolkit

Then install the requirements into the same Python that runs ComfyUI. Read requirements.txt before you pipe it into pip: it's a uv-compiled lockfile that pins torch==2.14.0 and friends, and a blind -r requirements.txt install is a fine way to break a working CUDA setup. For the SSH nodes specifically, cryptography is the dependency that matters - and it needs to be a modern one, since the fingerprint helper these siblings rely on doesn't exist in old releases. Python 3.12+ per pyproject.toml.

Common issues

"It says the key is invalid." It wants exactly one line, first two fields required. A .pub file whose base64 got hard-wrapped by an email client, or a paste with a line break in the middle, won't parse. Re-copy it as one uninterrupted line.

You pasted a private key. That's the other node. -----BEGIN OPENSSH PRIVATE KEY----- goes to OpenSSH Serialized Private Key Loader; this one only reads public halves and SSH certificates.

You only have the private key. Derive the public half instead of guessing:

ssh-keygen -y -f ~/.ssh/id_ed25519 > id_ed25519.pub

Paste that file's single line in.

Type errors on load. The input is bytes, so run text through Bytes-like Object Encode first - and remember that node quietly falls back to raw string bytes when a hex or base64 conversion fails.

It loads, but verification returns false. That's not the loader - check you're using the verifier that matches the key: EdDSA nodes for ed25519, ECVerify for ECDSA. Feeding an ed25519 key to an EC verifier gets you nothing useful, and ECVerify can't sign, only check.