I discovered the newer OpenSSH format for storing SSH private keys (
ssh-keygen -o) uses bcrypt to generate the symmetric key to encrypt the private key. I understand that the
-a option is used to adjust the bcrypt work factor. However, I don't understand the exact relationship between the work factor and the given value.
-a 200 takes about 5 seconds on my CPU, while this benchmark maxes out with a work factor of 20 taking over a minute. The work factor is a logarithmic scale, and I doubt my laptop is really >2^10 times faster than this person's laptop.
-a does not directly translate to the bcrypt work factor. So what is the relationship?
The reason I want to know is to extrapolate a "worst-case" cracking rate for my chosen
-a value based on this benchmark of a top-end (for 2017) cracking rig (which guesses ~100k hashes/sec across 8 GPUs, using a bcrypt work factor of 5 for the tests).
ssh-keygen -a 200, my i7 3600 2.2Ghz CPU show "Sieve next 67043328 plus 2047-bit", "Sieved with 203277289 small primes in 184 seconds"
ssh-keygen. The relevant options are
-oto specify using the OpenSSH format instead of the older PEM format, and
-a <number>to specify work factor. Here is an example to generate a test key though:
ssh-keygen -o -a 200 -f ./testkey -N password123