-
Notifications
You must be signed in to change notification settings - Fork 37
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
can't load keys with passphrase #7
Comments
Would it be possible to provide the ssh-keygen command you are using? I tried the following to generate a key, and I could successfully load it into the extension:
|
@ralimi : I think I have more clues on that.
I made some tests. Indeed your command work well But sometimes I have space in my passphrases, so I do :
And in these cases I always have the error message (when I load the key)
Hope this will help. |
I tried this locally, but I'm not able to reproduce. Here's what I've done:
Then, I created a new key in the agent and pasted in the contents of mykey_rsa. I was then able to successfully load the key by typing in "pass phrase". Would it perhaps be possible to generate a test key that fails to load on your computer and paste it here, along with the passphrase? |
Proc-Type: 4,ENCRYPTED
We must be using different releases of ssh-keygen, as none of the keys I've
ever generated (with passphrase or not) include this header.
I'm away from my computer now, but I can generate pair (and give you the
ssh-keygen release I'm using) in my morning.
…On Fri, Nov 16, 2018, 10:12 PM ralimi ***@***.*** wrote:
I tried this locally, but I'm not able to reproduce. Here's what I've done:
`
$ ssh-keygen -N "pass phrase" -f mykey_rsa
Generating public/private rsa key pair.
Your identification has been saved in mykey_rsa.
Your public key has been saved in mykey_rsa.pub.
The key fingerprint is:
SHA256:Kx57CNnTEJW+opjMMLXNL9joiz2TXGKXResxSDhcvRM ***@***.***
The key's randomart image is:
+---[RSA 2048]----+
| . o.. ... |
| + . E . |
| o o * |
| . . O . |
| . + * *S. |
|o + O = o. |
| B @ +o+. |
| o% +.o+. |
|..++ .o. |
+----[SHA256]-----+
$ cat mykey_rsa
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,330984463FF3487964A4C041098CE49C
0OTg9CLoYkFGFU54H4d548GIvGTEJ8Gtup7ss7TQKov0fd3tCSFCeBs8Ui1JyWrK
7Rz313Xh0lMKlUECjaloEzmE8Hqp3f5xNXOniPYCg6Qj01kur9D3Jxn7io6oVhrx
spo+JgC2Vqtgn+S96fPxhZ754XfiNk4VVgAlUvorZ1mAg7q8yxSmu+7w8E0KHh/0
SiEsIgsO7wypSvZYAuCqv+jLqON5nP3BN9pOq5Z8+oElsfRr+dVHcVRFSJgAGYNK
eApSVr4cX/x70mCpvaFzjrNzoYAbtpIxQd087fdamZE/AvQ6859wJsJg7rCUSKw2
tfxENIV2aXSOYrDTMxdxZe2pOPn/lOLw9uaZr2Yx8qb8uSz/YzrYEEMc8Jj2ZAYC
VC747/Uk3LoqaaunVXWqVadZem9/3QXKLhiY/l6AAwVbGhzyMnwOuK0iOQ389/BF
WzvvKNaglsAOizZHpXYQRZfmaCB+z1ypC0e7vv48YuttoO4BviTiQa4magPnQBKp
fbf5JT7S2HmV2LbdyyUgpWyJUxlfoTKNoxAN6kobn6VwNn6elyW2ZBQyupRduWyh
GC9PdHlmgncKIN2srBD27Dn1QuER9ucd0ZxTKu1YwGT3htQEm27pmBPYruIHeZos
eCxxRIC1M5EOHVHxYDDOsxggrQPOW2FAOLN37qWdhvS5N6Yvg/OXkWwytjw5l9U8
v2jq6RO5uiXDdEp0QJBfL212Zkw/RG2NnEJTiIaAvganekAKWvAXfIF1P64roLCM
xFMYmwp1q1iQyS+NeZKO+5JEUJZti/vHWHUXllubaGFAO5pgD1lOW7eUezIgeXg4
l16dknkGLTrMKbLpTclj3MPvbLAUAn2wmLfgH3LbCnizIvWtYCSD1WjuD7gpRFbc
/TCGNfjNn1jFciC6RyJqgVAuaGNzHMSZPxRCBlsexAkwLfl0FndBHa9yZeDCJ4DP
Booh8a2IwGYcT0hnlEgMDdKu/bAZNYgaAniP+JNs5Z0bvHqa3dQ9E+G5JCv5VRLg
umqYtTdXSF+l83uy/DOjz+mlQj5SFNWHroDDxo5txciB27SA4BSrASIO9kjZEIa9
HCRiIEJ4S+xtilWzZpysXoAtgHjL2JrEkSA9Cqta1xC9kqddsjabTAUJ8k1RyOgk
S1GpKjxDYu5jy8IaRJ8eimJzXP3irlsf1SNnQgAG6COSXzSHuWmnEVPDz5taLrcu
j2yVP2KiXYJlN6W0w/GMfuQav8KLklreXGT6i+ZuyW2+deM5F4J18iRxMk8/RnRH
AYDmE4MtbVApU/j+iqTm/D3F0uQWRzgoSTPd/2u7VizmyFKXPWNMIvYtFyJNeQXJ
6R5pjaYXqzBF97D2/4YCddToCFtTfok1PF247VyyOmzeswlAJ0QcYLtPKKqY8Cdt
N3mYrG9m/wCHWPYn9XVjP6XyyfPjtujTBCzAk3zYItsO1ItezwovkWl2otlmLhsI
ttXb/YG6VtjasZm0ePk8sfpAwzrNET8xdQjDdTbG9h9wnJDQiC5cFyWBHoLa/tVO
Dop2lb0sp7IKV6hrVG2V1vlaT2knoLB5bF0Y7yhYyhUEZS0X8oewoWBJ2IFP7sLB
-----END RSA PRIVATE KEY-----
$ cat mykey_rsa.pub
ssh-rsa
AAAAB3NzaC1yc2EAAAADAQABAAABAQDFnflk08cgrUK/4O7V5FbIHlaqfdVJzvEnkP7HtJ/IGYralJtHik+YMgblHnGNh2KJoCNMcdDlsZyrKjLf7BTC/GXu5T8z7bVRBgSvPSXDKscwpxceaRcl75pMSyK6An0/ZH1UfC8qusmjzvudYP9WqwB78rKQGL36XuRK2mksL3P5i+QnGi+Clcp5ajV7Z65IpZmw6bXccwzQUcRTfl8phafsEL+C39XRBeBXq8ml8Im6TjdK9M1ALi6vNVMgywKkjweU82jhboQxCmDSAsE10a4dTkmpos/EK2k6QnFrM1qC6+id4Bwa7eTzkfUWUdw5A/2kxHi4wTaf15LlqErj
***@***.***
`
Then, I created a new key in the agent and pasted in the contents of
mykey_rsa. I was then able to successfully load the key by typing in "pass
phrase".
Would it perhaps be possible to generate a test key that fails to load on
your computer and paste it here, along with the passphrase?
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
<#7 (comment)>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/AAQsZdnqXfOoihaF8wJL2QDunPEbkdMoks5uv6jWgaJpZM4WT4wG>
.
|
I think you are right with the ssh-keygen version (or its dependencies) as I mainly use ArchLinux. Version used to make test : openssh 7.9p1-1 I am also far away from any computer today. I will be able to paste a key tomorrow. |
Here a key, I can't load in chrome-ssh-agent
Some informations about OpenSsh version :
|
Hum ! As noticed by @terinjokes our private keys don't have header
So I have look man page of
I tried to generate keys with the three key_format :
As @ralimi : will you plan to add PKCS8 and RFC4716 formats ? |
This default value appeared in OpenSSH 7.8/7.8p1.
|
@iamhsa Thanks for taking a look at this. I had some things come up, and was just now getting back to this. I use ed25519 for my key pair, which is not possible to store in PEM format. [terin@rack01 ~]$ ssh-keygen -f test_ed25519 -N passphrase -t ed25519 -a 100 -m pem
Generating public/private ed25519 key pair.
Your identification has been saved in test_ed25519.
Your public key has been saved in test_ed25519.pub.
The key fingerprint is:
SHA256:IQovehGrepYLlhFKQIqUasvPfm+nnupujm1PvmfGVMk terin@rack01
The key's randomart image is:
+--[ED25519 256]--+
|oo. |
|=. |
|+oo . . . . |
|+..= . . . E |
|+.= o S . |
| =oo . |
|+o+. .o |
|oo+oo+o..* |
|.oo+B**OB |
+----[SHA256]-----+
[terin@rack01 ~]$ cat test_ed25519
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABAlPXmf3u
Q488SRElaUqAe+AAAAZAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAINq7Z6K8o+2uNeSx
ojwfJPzpXrpW357N6VCV2W+/xBRBAAAAkPSLyVQ78YRiA3Pfy76tzCAm7fBQEK7VdNDWeD
qHGTB7yX5nmpM4aIWjiWIBZkmbg1446IxYgepKaJurT/2NIQo9xgeDTc4nSo+QfuFsv90s
FMNQDGYUU+c3SsCtDty+CCsl8j7JZG3LBg9oJoFs3f7EyvyKF1E/yvR3smlkaMNbBSlfV4
eV4FbJ+ANDv9G+4w==
-----END OPENSSH PRIVATE KEY-----
[terin@rack01 ~]$ cat test_ed25519.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINq7Z6K8o+2uNeSxojwfJPzpXrpW357N6VCV2W+/xBRB terin@rack01 |
This change was described back in 2013: new openssh key format and bcrypt pbkdf. |
It looks like there is good news and bad news. Good news: keys with the newer format appear to be supported by Go's crypto package. I've added a test in #8 to validate that they are supported. Bad news: there doesn't appear to be support in Go's crypto package currently for loading encrypted ones. golang/go#8860 looks like the issue tracking that request. |
There's pkcs#8 parsers for Go that look compatible with GopherJS. Would
there be any objections to integrating with them since the stdlib
implementation doesn't seem to be happening right now?
…On Thu, Nov 22, 2018, 9:05 PM ralimi ***@***.*** wrote:
It looks like there is good news and bad news.
Good news: keys with the newer format appear to be supported by Go's
crypto package. I've added a test in #8
<#8> to validate that they
are supported.
Bad news: there doesn't appear to be support in Go's crypto package
currently for loading encrypted ones. golang/go#8860
<golang/go#8860> looks like the issue tracking
that request.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#7 (comment)>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/AAQsZfkqoOqTEHiVA7uM317Ugapl4nMHks5ux4IrgaJpZM4WT4wG>
.
|
I'm playing around with https://github.com/youmark/pkcs8 as we speak :) |
I've got this working with PKCS#8 keys, both with and without passphrases. Unfortunately, I found out through this experimentation that PKCS#8 is not the same "OpenSSH format" produced by ssh-keygen. PKCS#8 are signified by OpenSSH Format begins a block with I wasn't able to replicate the results from @iamhsa above. On my machine, (OpenSSH_7.6p1), the |
I was wondering if there was an easy way to convert an OpenSSH-formatted private key into either PEM or PKCS#8. The ssh-keygen man page seems to say it can be done:
https://unix.stackexchange.com/questions/84060/convert-openssh-private-key-into-ssh2-private-key seems to confirm that the manpage lies, and it will just produce the public key. |
golang/go#18692 looks like the feature request for supporting encrypted OpenSSH formatted keys. |
After finding golang/go#18692, it was pretty easy to adjust the code to use the same underlying library they were disussing. I'll be happy when those two feature requests in the crypto libraries are resolved so this code can be made simpler again. |
I built a new release including these changes. It should be release as 0.0.18. |
Oops. Not quite fixed - keys still don't load. Reopening. |
Fixed, and release 0.0.19. @terinjokes - I can now load the ed25519 key you provided above. |
And now keys genetated by |
@ralimi ... I have encrypted private key in the form of I am not able to decrypt using youmark/pkcs8 package.... Was your files in the similar format ? |
I believe they were, yes. Consider trying to play around with openssl itself to decrypt and verify it is actually in PKCS#8 format? |
This extension can't load keys protected with a passphrase as generated by
ssh-keygen
, which contain no block headers.The text was updated successfully, but these errors were encountered: