0

For an ordinary user, how would I verify that a private key file was generated using reasonably secure algorithms? In response to things like allegedly insecure ssh-keygen defaults.

  • On *nix systems, grep BEGIN ~/.ssh/id_* ... If it doesn't have OPENSSH PRIVATE KEY ... then you have the old format keys. .... I typically use my PGP keys through ssh-agent and let GPG handle the key management. – RubberStamp Jan 7 at 3:05
  • @RubberStamp Assuming that an ordinary user has no idea what "old format" means, how would they know what that means and whether it's secure or not? – l0b0 Jan 7 at 3:06
  • Related... and possible dup ... try openssl asn1parse -in - ... – RubberStamp Jan 7 at 3:24
  • @RubberStamp @TomLeek is able to read that output, but I'm not. The man page just says "Some knowledge of the ASN.1 structure is needed to interpret the output." I wouldn't know where to begin to establish within a reasonable amount of time what the KDF is, for example. – l0b0 Jan 7 at 4:21
  • @RubberStamp+ asn1parse doesn't work at all on either kind of encrypted privatekey file ssh-keygen can create, neither the OpenSSL 'traditional' format with PEM-level encryption nor the OpenSSH 'new' format with body-level encryption but non-ASN.1 encoding (instead XDR-like) – dave_thompson_085 Jan 7 at 5:05
2

As RubberStamp points out, this is covered in detail in stronger encryption for SSH keys but to summarize:

Look at the words in the first line, and the next one or two.

 -----BEGIN RSA PRIVATE KEY-----
 Proc-Type: 4,ENCRYPTED
 DEK-Info: DES-EDE3-CBC,(hex)

 (several lines of base64)
 -----END RSA PRIVATE KEY-----

(or similarly with DSA PRIVATE KEY or EC PRIVATE KEY) is the old, bad-PBKDF format.

 -----BEGIN RSA PRIVATE KEY----- # or DSA,EC
 (base64 immediately)
 -----END RSA PRIVATE KEY----- # ditto 

is the old unencrypted format, which is even worse.

 -----BEGIN OPENSSH PRIVATE KEY-----
 (several lines of base64)
 -----END OPENSSH PRIVATE KEY-----

is the new OpenSSH-specific format, which is why it says OPENSSH right there.

Done.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.