I recently re-encrypted my SSH private key to use the new OpenSSH format with lots of KDF rounds (-o -a 200) (takes about 2 seconds to run on my CPU). Unfortunately, I mistyped my passphrase in exactly the same way on both prompts. I assumed it was a single swap of two adjacent characters, and wrote a simple python script that output a list of all different single-adjacent-character-swaps. I then copy-pasted each guess into the ssh-keygen password prompt until it unlocked the key and allowed me to reset the password. This took several minutes, but succeeded.
If the error had been any more complex (2 swaps, keyboard slippage, etc) this would have gotten very tedious. Is there a simple way to test my guesses automatically? This wouldn't need a full-fledged optimized password-cracking tool since I'm generating the candidate passwords myself, and would only test a few thousand possibilities at most. I found piping the password candidate into ssh-keygen -y -f .ssh/id_rsa, but this didn't work as it expected input from a terminal. I also tried John The Ripper, but it only works with old-style PEM-encoded SSH private key files.
I will also accept answers that allow me to test the passphrase from within Python, provided it's compatible with the new OpenSSH format.
(for the curious, here's the script I used):
#!/usr/bin/python3
import getpass
source=getpass.getpass()
def swap(s, i, j):
l=list(s)
l[i], l[j] = l[j], l[i]
return "".join(l)
for (i,c) in enumerate(source):
if i < len(source)-1:
print(swap(source, i, i+1))
.ssh/id_rsa