x/crypto/ssh: `ParseRawPrivateKey` should return `PassphraseMissingError` for `ENCRYPTED PRIVATE KEY`

[rgmz]

Go version

go1.23.4

Output of go env in your module/workspace:

N/A

What did you do?

I was validating a Box-generated private key using ssh.ParseRawPrivateKey and encountered an unexpected error.

Reproducer: https://go.dev/play/p/mX6cEyGa7FO

( The private key is inert and was generated with: openssl genpkey -algorithm RSA -aes256 -out encrypted_private_key.pem)

What did you see happen?

The function fails due to "ENCRYPTED PRIVATE KEY" not being a supported key type.

panic: ssh: unsupported key type "ENCRYPTED PRIVATE KEY"

What did you expect to see?

The function should actually return PassphraseMissingError, per the documentation:

If the private key is encrypted, it will return a PassphraseMissingError.
https://github.com/golang/crypto/blob/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909/ssh/keys.go#L1230-L1233

[gabyhelp]

Related Issues

• x/crypto/ssh: ParseRawPrivateKeyWithPassphrase doesn't support PKCS#8 encrypted keys #43387
• x/crypto/ssh: ParsePrivateKeyWithPassphrase returns an opaque error in case of wrong passphrase #20781 (closed)
• x/crypto/ssh: ParsePrivateKey gives unintuitive error message for encrypted keys #6650 (closed)
• x/crypto/ssh: doesn't always return x509.IncorrectPasswordError when it should #62265 (closed)
• x/crypto/ssh: support encrypted private keys #18692 (closed)
• crypto/x509: IsEncryptedPEMBlock returns false on valid encrypted keys. ParseRawPrivateKeyWithPassphrase fails on PKCS8 format encrypted key. #41949 (closed)
• x/crypto/ssh: unable to parse certificates #45010 (closed)
• x/crypto/ssh: support OpenSSH encoded ECDSA keys in ParsePrivateKey #36722 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[rgmz]

#41949 could related.

If it's a deliberate choice to not support these types, it would be beneficial to update the ssh.ParseRawPrivateKey and ssh.ParseRawPrivateKeyWithPassphrase docs to avoid confusion.

[dmitshur]

CC @drakkan, @golang/security.