Giters

hierynomus / sshj

ssh, scp and sftp for java

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Support new OpenSSH private key format (Used by default with Ed25519 keys)

dkocher opened this issue · comments

commented

When I create a key with OpenSSH running ssh-keygen -t ed25519 the file header is
-----BEGIN OPENSSH PRIVATE KEY----- which is no where handled in any of the FileKeyProvider.

commented

Ok, I'll have a look next week :)

2016-10-14 13:04 GMT+02:00 David Kocher notifications@github.com:

When I create a key with OpenSSH running ssh-keygen -t ed25519 the file
header is
-----BEGIN OPENSSH PRIVATE KEY----- which is no where handled in any of
the FileKeyProvider.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
#276 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AAHLo-F5Mscy0xFzSHIMn5B4wsOqIy5vks5qz2HRgaJpZM4KW1Dd
.

commented 
 -o      Causes ssh-keygen to save private keys using the new OpenSSH format rather than the more compatible PEM format.  The new format has increased resistance to brute-force pass-
         word cracking but is not supported by versions of OpenSSH prior to 6.5.  Ed25519 keys always use the new private key format.
commented

Thanks, though we can read files with that header, see: https://github.com/hierynomus/sshj/blob/master/src/test/java/net/schmizz/sshj/keyprovider/OpenSSHKeyFileTest.java#L144

And I do remember testing with a host with only an ed25519 key. I'll need to re-verify

commented

Calling #getPrivate() on the key file will result in unrecognised object: OPENSSH PRIVATE KEY.

commented

Ok, will fix :)

2016-10-14 13:47 GMT+02:00 David Kocher notifications@github.com:

Calling #getPrivate() on the key file will result in unrecognised object:
OPENSSH PRIVATE KEY.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
#276 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AAHLo2V9RLslze6AIexnfALpfW8-Zjl7ks5qz2vZgaJpZM4KW1Dd
.

commented

@hierynomus Do you already have an ETA for this?

commented

Will try to get it done this week...

commented

Just had a quick look into this... We typically rely on BouncyCastle to read the keys, and guess what, it does not support this format (yet)...

commented

@hierynomus Have you found any spec on the file format?

commented

I think I can work it out using these links:

The commit responsible for the new change is http://marc.info/?l=openbsd-cvs&m=138633690918227&w=2.
PROTOCOL description https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.key.
General information http://www.tedunangst.com/flak/post/new-openssh-key-format-and-bcrypt-pbkdf

If you find more info, feel free to add!

commented

I would like to have this issue reopend. Reading SSH keys of type RSA and ecdsa in the new format does not work.

The failure is a message like Bad item length: -1512035316 which is caused from reading the key in OpenSSHKeyV1KeyFile.

This is as of OpenSSH 7.8 the default.

  • ssh-keygen(1): write OpenSSH format private keys by default
    instead of using OpenSSL's PEM format. The OpenSSH format,
    supported in OpenSSH releases since 2014 and described in the
    PROTOCOL.key file in the source distribution, offers substantially
    better protection against offline password guessing and supports
    key comments in private keys. If necessary, it is possible to write
    old PEM-style keys by adding "-m PEM" to ssh-keygen's arguments
    when generating or updating a key.

Workaround is to use ssh-keygen -m PEM.

commented

Reopened... Let's fix that :)