diff --git a/ssh/client_auth.go b/ssh/client_auth.go
index 3a7e9fb..721a21f 100644
--- a/ssh/client_auth.go
+++ b/ssh/client_auth.go
@@ -135,7 +135,7 @@ func ClientAuthPassword(impl ClientPassword) ClientAuth {
 
 // ClientKeyring implements access to a client key ring.
 type ClientKeyring interface {
-	// Key returns the i'th rsa.Publickey or dsa.Publickey, or nil if
+	// Key returns the i'th *rsa.Publickey or *dsa.Publickey, or nil if
 	// no key exists at i.
 	Key(i int) (key interface{}, err error)
 
@@ -163,7 +163,6 @@ type publickeyAuthMsg struct {
 }
 
 func (p *publickeyAuth) auth(session []byte, user string, t *transport, rand io.Reader) (bool, []string, error) {
-
 	// Authentication is performed in two stages. The first stage sends an
 	// enquiry to test if each key is acceptable to the remote. The second
 	// stage attempts to authenticate with the valid keys obtained in the
diff --git a/ssh/client_auth_test.go b/ssh/client_auth_test.go
index a55d8f4..e51bdc3 100644
--- a/ssh/client_auth_test.go
+++ b/ssh/client_auth_test.go
@@ -69,9 +69,9 @@ func (k *keychain) Key(i int) (interface{}, error) {
 	}
 	switch key := k.keys[i].(type) {
 	case *rsa.PrivateKey:
-		return key.PublicKey, nil
+		return &key.PublicKey, nil
 	case *dsa.PrivateKey:
-		return key.PublicKey, nil
+		return &key.PublicKey, nil
 	}
 	panic("unknown key type")
 }
@@ -123,7 +123,7 @@ var (
 			return user == "testuser" && pass == string(clientPassword)
 		},
 		PublicKeyCallback: func(conn *ServerConn, user, algo string, pubkey []byte) bool {
-			key := clientKeychain.keys[0].(*rsa.PrivateKey).PublicKey
+			key := &clientKeychain.keys[0].(*rsa.PrivateKey).PublicKey
 			expected := []byte(serializePublickey(key))
 			algoname := algoName(key)
 			return user == "testuser" && algo == algoname && bytes.Equal(pubkey, expected)
diff --git a/ssh/common.go b/ssh/common.go
index 6844fb8..8850382 100644
--- a/ssh/common.go
+++ b/ssh/common.go
@@ -154,11 +154,11 @@ func serializeSignature(algoname string, sig []byte) []byte {
 	return ret
 }
 
-// serialize an rsa.PublicKey or dsa.PublicKey according to RFC 4253 6.6.
+// serialize a *rsa.PublicKey or *dsa.PublicKey according to RFC 4253 6.6.
 func serializePublickey(key interface{}) []byte {
 	algoname := algoName(key)
 	switch key := key.(type) {
-	case rsa.PublicKey:
+	case *rsa.PublicKey:
 		e := new(big.Int).SetInt64(int64(key.E))
 		length := stringLength([]byte(algoname))
 		length += intLength(e)
@@ -168,7 +168,7 @@ func serializePublickey(key interface{}) []byte {
 		r = marshalInt(r, e)
 		marshalInt(r, key.N)
 		return ret
-	case dsa.PublicKey:
+	case *dsa.PublicKey:
 		length := stringLength([]byte(algoname))
 		length += intLength(key.P)
 		length += intLength(key.Q)
@@ -187,9 +187,9 @@ func serializePublickey(key interface{}) []byte {
 
 func algoName(key interface{}) string {
 	switch key.(type) {
-	case rsa.PublicKey:
+	case *rsa.PublicKey:
 		return "ssh-rsa"
-	case dsa.PublicKey:
+	case *dsa.PublicKey:
 		return "ssh-dss"
 	}
 	panic("unexpected key type")