Skip to main content
Rosie.run Docs

SSH Keys in Rosie SSH

Generate, import, export, and use SSH keys with Rosie SSH on iPhone and iPad.

Coming soon

Rosie SSH is not on the App Store yet and is not in public beta. This page describes the planned behavior.

Supported key types

Rosie SSH supports the following key types:

  • Ed25519
  • ECDSA P-256
  • ECDSA P-384
  • Secure Enclave P-256 (requires a physical device)

You can generate keys in the app, import supported OpenSSH private keys, export public keys for server setup, and use saved keys when connecting to hosts.

Private key material is stored in the iOS Keychain on your device. Secure Enclave private keys never leave the hardware.

Generate a key

  1. Open Keys.
  2. Tap the add button.
  3. Choose the key type: Ed25519, ECDSA P-256, ECDSA P-384, or Secure Enclave P-256.
  4. Swipe the key and choose Export Public Key.
  5. Add the exported public key to the server account’s ~/.ssh/authorized_keys.

After the public key is installed on the server, edit or create a saved host and choose private key authentication.

Secure Enclave P-256 keys require a physical device with a Secure Enclave. The private key is hardware-bound and cannot be exported.

Import an OpenSSH private key

  1. Open Keys.
  2. Tap the add button.
  3. Choose Import OpenSSH Key.
  4. Paste the key text or choose a key file.
  5. Enter the passphrase if the key is encrypted.
  6. Tap Import.

Rosie SSH supports OpenSSH private key formats for Ed25519, ECDSA P-256, and ECDSA P-384. Unsupported key types or ciphers may be rejected.

Encrypted private keys

If an imported key is encrypted, Rosie SSH asks for the passphrase during import. The passphrase decrypts the key for import and is not retained as a saved login password.

The imported private key material is stored in the iOS Keychain.

Server setup

The server account usually needs the public key in:

bash
~/.ssh/authorized_keys

OpenSSH servers can be strict about file permissions. Common settings are:

bash
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Check your server’s SSH documentation if key auth still fails.

Secure Enclave keys

Rosie SSH supports Secure Enclave P-256 SSH authentication on physical devices. The private key is created and stored entirely within the Secure Enclave hardware and cannot be exported or extracted.

To create a Secure Enclave key, choose Secure Enclave P-256 during key generation. Export the public key and add it to your server’s authorized_keys file as you would any other key.

Secure Enclave keys are not available on simulators or devices without a Secure Enclave.