For an ordinary user, how would I verify that a private key file was generated using reasonably secure algorithms? In response to things like allegedly insecure ssh-keygen defaults.
As RubberStamp points out, this is covered in detail in stronger encryption for SSH keys but to summarize:
Look at the words in the first line, and the next one or two.
-----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,(hex) (several lines of base64) -----END RSA PRIVATE KEY-----
(or similarly with
DSA PRIVATE KEY or
EC PRIVATE KEY) is the old, bad-PBKDF format.
-----BEGIN RSA PRIVATE KEY----- # or DSA,EC (base64 immediately) -----END RSA PRIVATE KEY----- # ditto
is the old unencrypted format, which is even worse.
-----BEGIN OPENSSH PRIVATE KEY----- (several lines of base64) -----END OPENSSH PRIVATE KEY-----
is the new OpenSSH-specific format, which is why it says
OPENSSH right there.