TruffleHog cannot scan private keys with passwords

[Firebasky]

Please review the Community Note before submitting

TruffleHog Version

all

describe

TruffleHog cannot scan private keys with passwords

For example, openssl generates a private key with a password

openssl genrsa -aes256 -out private_key_encrypted.pem 2048
input password:123456

use trufflehog scan,can not scan private key

[shahzadhaider1]

Hi @Firebasky!

Thank you for taking the time to open this issue, we really appreciate your contribution to the project!
We’ll take a look and get back to you as soon as we can. If we need any clarification, we’ll follow up here.

Thanks again for helping make this project better!

[shahzadhaider1]

Hey, thanks for raising this and providing the example command. I looked into it, and it appears you’re generating encrypted private keys with a passphrase. Currently, TruffleHog does not detect encrypted private keys. This is intentional because encrypted keys are not immediately usable without the passphrase, so the risk of accidental compromise is much lower compared to unencrypted keys.

TruffleHog is designed to focus primarily on credentials and secrets that can be directly exploited if exposed. So, unencrypted private keys are detected as expected.

Appreciate you bringing this up. Feel free to reach out if you have any other questions or ideas. Always happy to discuss improvements!