2

Assuming I have found several OpenSSH private keys on my client's system, how can I detect (at scale) which of them are:

  • completely unprotected (i.e. no passphrase)
  • using an old hashing algorithm for the passphrase (I read somewhere that it used to be MD5)

Is there a way to get this information using standard tools? One way might be to download the keys and check them with ssh2john, but I'd rather not have them on my machine and hence my conscience.

Improve this question
5
  • The answers to your question(s) are going to vary from client to client. There is no standard way of storing SSH keys, so each client may store keys using its own unique format. See superuser.com/questions/1720991/… for more info.
    – mti2935
    Apr 20 at 13:24
  • Okay. Let's narrow it down to OpenSSH then (question updated)
    – John Nemo
    Apr 20 at 14:35
  • In that case, see coolaj86.com/articles/the-openssh-private-key-format. It looks like openssh uses a proprietary format that is then base64-encoded. So, you would have to decode the base64 between -----BEGIN OPENSSH PRIVATE KEY----- and -----END OPENSSH PRIVATE KEY-----, then examine the bytes in the fields for ciphername, kdfname, kdf, etc. Being that it's a proprietary format, there may not be an 'off-the-shelf' tool that can do this, but it's probably something that could be cooked up fairly easily using python or similar.
    – mti2935
    Apr 20 at 15:35
  • Sometime after --BEGIN OPENSSH PRIVATE KEY----- there are Proc-Type: and DEK-Info: headers that are for sure a sign of key encryption. Not sure their absence is % proof of non encryption.
    – Bruno Rohée
    Apr 20 at 15:47
  • Okay so long story short: seems like you cannot do it with pre-existing tools, but would have to write your own. In that case downloading the keys and using things like ssh2john might be the more efficient route to go.
    – John Nemo
    Apr 21 at 8:24

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .