5

I have generated an RSA key-pair on a computer, and I want to check if the RSA private key is encrypted (protected) with a passphrase.

Note that the problem is not that I forgot the passphrase, but rather that I want to generate the key-pair again with a passphrase if I did not previously. I am curious about the command (or process) to check that information (not the passphrase itself, but the fact whether that the private key is encrypted with a passphrase).

Improve this question
2
  • 2
    I am pretty sure it would ask for the passphrase once you try to use the key. Other than that, I am not sure.
    – Peter Harmann
    Commented Aug 16, 2018 at 12:58
  • @PeterHarmann not if the key is automatically added to ssh-agent or something similar on login.
    – AndrolGenhald
    Commented Aug 16, 2018 at 14:11

1 Answer 1

Reset to default
14

Just open it, if it's encrypted it will begin with

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,0F5C7993DCFA4C0962CE249CFD854B91

if it is not it will begin directly by the (base64 encoded) key :

-----BEGIN RSA PRIVATE KEY-----
MIICWwIBAAKBgQDNhe+F6Ww2Q9XLLDFJ2s+yp/K/rQn2QMCqT3y0sqS6j+a2T
Improve this answer
5
  • From the command line, you can view the RSA private key header with the head command: $ head ~/etc/ssh/ssh_host_rsa_key
    – safesploit
    Commented Aug 16, 2018 at 20:34
  • @safesploit I'm pretty sure it's not the host key he's worried about, and is that ~ accidental or do you actually have etc/ssh/ssh_host_rsa_key in your home directory?
    – AndrolGenhald
    Commented Aug 16, 2018 at 21:51
  • The tilde is accidental, and I used the host key as an example. I was uncertain how to name the key-pair as Linux based OSs and OS X ("id_25519" and "id_25519.pub") both name the key-pair differently.
    – safesploit
    Commented Aug 16, 2018 at 22:04
  • But if it starts with "BEGIN OPENSSH PRIVATE KEY" it's not as easy. Some versions of ssh-keygen seem to use that string when converting a foreign key. I think that if the key starts with "MII" then it's not encrypted in that case.
    – Brian Huntley
    Commented Mar 28, 2019 at 15:43
  • @BrianPHuntley: foreign is irrelevant. OpenSSH 6.5 up uses 'new format' if you specify -o or automatically for ed25519; 7.8 up uses it for all types unless (for non-ed25519) you specify -m pem. The OpenSSH format always begins b3BlbnNzaC1rZXktdjEAAAAA and then diverges depending on encryption, and type. The 'legacy' (OpenSSL) unencrypted format does start with MII (which is 30 82, the first two octets of all reasonable-sized ASN.1 DER SEQUENCEs, and encrypted does not, but they are also distinguished by the Proc-type and DEK-info lines which are much more obvious.
    – dave_thompson_085
    Commented Mar 29, 2019 at 1:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .