diff --git a/ssh.h b/ssh.h
index 88987fbc..ec5bbb4a 100644
--- a/ssh.h
+++ b/ssh.h
@@ -506,9 +506,7 @@ void BinarySource_get_rsa_ssh1_priv(
 bool rsa_ssh1_encrypt(unsigned char *data, int length, struct RSAKey *key);
 Bignum rsa_ssh1_decrypt(Bignum input, struct RSAKey *key);
 bool rsa_ssh1_decrypt_pkcs1(Bignum input, struct RSAKey *key, strbuf *outbuf);
-void rsasanitise(struct RSAKey *key);
-int rsastr_len(struct RSAKey *key);
-void rsastr_fmt(char *str, struct RSAKey *key);
+char *rsastr_fmt(struct RSAKey *key);
 char *rsa_ssh1_fingerprint(struct RSAKey *key);
 bool rsa_verify(struct RSAKey *key);
 void rsa_ssh1_public_blob(BinarySink *bs, struct RSAKey *key,
diff --git a/ssh1login.c b/ssh1login.c
index 6e9aafc6..e5308d0b 100644
--- a/ssh1login.c
+++ b/ssh1login.c
@@ -222,10 +222,8 @@ static void ssh1_login_process_queue(PacketProtocolLayer *ppl)
         /*
          * First format the key into a string.
          */
-        int len = rsastr_len(&s->hostkey);
         char *fingerprint;
-        char *keystr = snewn(len, char);
-        rsastr_fmt(keystr, &s->hostkey);
+        char *keystr = rsastr_fmt(&s->hostkey);
         fingerprint = rsa_ssh1_fingerprint(&s->hostkey);
 
         /* First check against manually configured host keys. */
diff --git a/sshdss.c b/sshdss.c
index ce3853b9..cac40af7 100644
--- a/sshdss.c
+++ b/sshdss.c
@@ -54,54 +54,33 @@ static void dss_freekey(ssh_key *key)
     sfree(dss);
 }
 
+static void append_hex_to_strbuf(strbuf *sb, Bignum *x)
+{
+    if (sb->len > 0)
+        put_byte(sb, ',');
+    put_data(sb, "0x", 2);
+    int nibbles = (3 + bignum_bitcount(x)) / 4;
+    if (nibbles < 1)
+	nibbles = 1;
+    static const char hex[] = "0123456789abcdef";
+    for (int i = nibbles; i--;)
+	put_byte(sb, hex[(bignum_byte(x, i / 2) >> (4 * (i % 2))) & 0xF]);
+}
+
 static char *dss_cache_str(ssh_key *key)
 {
     struct dss_key *dss = container_of(key, struct dss_key, sshk);
-    char *p;
-    int len, i, pos, nibbles;
-    static const char hex[] = "0123456789abcdef";
+    strbuf *sb = strbuf_new();
+
     if (!dss->p)
 	return NULL;
-    len = 8 + 4 + 1;		       /* 4 x "0x", punctuation, \0 */
-    len += 4 * (bignum_bitcount(dss->p) + 15) / 16;
-    len += 4 * (bignum_bitcount(dss->q) + 15) / 16;
-    len += 4 * (bignum_bitcount(dss->g) + 15) / 16;
-    len += 4 * (bignum_bitcount(dss->y) + 15) / 16;
-    p = snewn(len, char);
-    if (!p)
-	return NULL;
 
-    pos = 0;
-    pos += sprintf(p + pos, "0x");
-    nibbles = (3 + bignum_bitcount(dss->p)) / 4;
-    if (nibbles < 1)
-	nibbles = 1;
-    for (i = nibbles; i--;)
-	p[pos++] =
-	    hex[(bignum_byte(dss->p, i / 2) >> (4 * (i % 2))) & 0xF];
-    pos += sprintf(p + pos, ",0x");
-    nibbles = (3 + bignum_bitcount(dss->q)) / 4;
-    if (nibbles < 1)
-	nibbles = 1;
-    for (i = nibbles; i--;)
-	p[pos++] =
-	    hex[(bignum_byte(dss->q, i / 2) >> (4 * (i % 2))) & 0xF];
-    pos += sprintf(p + pos, ",0x");
-    nibbles = (3 + bignum_bitcount(dss->g)) / 4;
-    if (nibbles < 1)
-	nibbles = 1;
-    for (i = nibbles; i--;)
-	p[pos++] =
-	    hex[(bignum_byte(dss->g, i / 2) >> (4 * (i % 2))) & 0xF];
-    pos += sprintf(p + pos, ",0x");
-    nibbles = (3 + bignum_bitcount(dss->y)) / 4;
-    if (nibbles < 1)
-	nibbles = 1;
-    for (i = nibbles; i--;)
-	p[pos++] =
-	    hex[(bignum_byte(dss->y, i / 2) >> (4 * (i % 2))) & 0xF];
-    p[pos] = '\0';
-    return p;
+    append_hex_to_strbuf(sb, dss->p);
+    append_hex_to_strbuf(sb, dss->q);
+    append_hex_to_strbuf(sb, dss->g);
+    append_hex_to_strbuf(sb, dss->y);
+
+    return strbuf_to_str(sb);
 }
 
 static bool dss_verify(ssh_key *key, ptrlen sig, ptrlen data)
diff --git a/sshrsa.c b/sshrsa.c
index 043cdd3c..afddbb7d 100644
--- a/sshrsa.c
+++ b/sshrsa.c
@@ -321,44 +321,27 @@ bool rsa_ssh1_decrypt_pkcs1(Bignum input, struct RSAKey *key, strbuf *outbuf)
     return success;
 }
 
-int rsastr_len(struct RSAKey *key)
+static void append_hex_to_strbuf(strbuf *sb, Bignum *x)
 {
-    Bignum md, ex;
-    int mdlen, exlen;
-
-    md = key->modulus;
-    ex = key->exponent;
-    mdlen = (bignum_bitcount(md) + 15) / 16;
-    exlen = (bignum_bitcount(ex) + 15) / 16;
-    return 4 * (mdlen + exlen) + 20;
+    if (sb->len > 0)
+        put_byte(sb, ',');
+    put_data(sb, "0x", 2);
+    int nibbles = (3 + bignum_bitcount(x)) / 4;
+    if (nibbles < 1)
+	nibbles = 1;
+    static const char hex[] = "0123456789abcdef";
+    for (int i = nibbles; i--;)
+	put_byte(sb, hex[(bignum_byte(x, i / 2) >> (4 * (i % 2))) & 0xF]);
 }
 
-void rsastr_fmt(char *str, struct RSAKey *key)
+char *rsastr_fmt(struct RSAKey *key)
 {
-    Bignum md, ex;
-    int len = 0, i, nibbles;
-    static const char hex[] = "0123456789abcdef";
+    strbuf *sb = strbuf_new();
 
-    md = key->modulus;
-    ex = key->exponent;
+    append_hex_to_strbuf(sb, key->exponent);
+    append_hex_to_strbuf(sb, key->modulus);
 
-    len += sprintf(str + len, "0x");
-
-    nibbles = (3 + bignum_bitcount(ex)) / 4;
-    if (nibbles < 1)
-	nibbles = 1;
-    for (i = nibbles; i--;)
-	str[len++] = hex[(bignum_byte(ex, i / 2) >> (4 * (i % 2))) & 0xF];
-
-    len += sprintf(str + len, ",0x");
-
-    nibbles = (3 + bignum_bitcount(md)) / 4;
-    if (nibbles < 1)
-	nibbles = 1;
-    for (i = nibbles; i--;)
-	str[len++] = hex[(bignum_byte(md, i / 2) >> (4 * (i % 2))) & 0xF];
-
-    str[len] = '\0';
+    return strbuf_to_str(sb);
 }
 
 /*
@@ -564,13 +547,7 @@ static void rsa2_freekey(ssh_key *key)
 static char *rsa2_cache_str(ssh_key *key)
 {
     struct RSAKey *rsa = container_of(key, struct RSAKey, sshk);
-    char *p;
-    int len;
-
-    len = rsastr_len(rsa);
-    p = snewn(len, char);
-    rsastr_fmt(p, rsa);
-    return p;
+    return rsastr_fmt(rsa);
 }
 
 static void rsa2_public_blob(ssh_key *key, BinarySink *bs)