diff --git a/README.md b/README.md index b38a683..17c1d3f 100644 --- a/README.md +++ b/README.md @@ -48,6 +48,9 @@ with much stronger implementations from typical/upstream defaults. It takes the recommendations from _[Secure Secure Shell](https://stribika.github.io/2015/01/04/secure-secure-shell.html)_ (and perhaps other sources) and automatically applies them. +Additionally, it anonymizes your key. It uses a comment string by default that provides +no identifying information other than the fact that you are using SSHSecure. + It will create backups of any file(s) it replaces and automatically rolls back `sshd` configuration changes if it does not pass the syntax check (`sshd -t`) to avoid accidentally locking you out. @@ -63,7 +66,21 @@ running already). ## FAQ ### Why a binary? -I originally wrote this as a python script. However, some machines don't have the python interpreter installed and due to the lack of low-level access, I ended up making a lot - of calls to the shell anyways. +I originally wrote this as a python script. However, some machines don't have the python +interpreter installed and due to the lack of low-level access, I ended up making a lot +of calls to the shell anyways. -I wrote it in Golang so the source would be easily read for audit purposes. \ No newline at end of file +I wrote it in Golang so the source would be easily read for auditing purposes. + +### How can I contact you? +You can either [file a bug](https://bugs.square-r00t.net/index.php?do=newtask&project=15) +or email me at `bts [at] square-r00t (dot) net`. + +### Is there anything from the _Secure Secure Shell_ document that you don't implement? +Yep. No TOR hidden service ("Traffic analysis resistance"). The system should be +sufficiently hardened to prevent you from scans yielding anything useful except noisy +logs, and there's much better options for handling those than running SSH over TOR. It +[isn't the silver bullet you may think it is](https://restoreprivacy.com/tor/). You are, +of course, welcome to turn it up yourself but it is advisable to not run SSHSecure in an +automated fashion in this case as it may revert the changes your `sshd_config`. It'll +try not to, but it may. \ No newline at end of file diff --git a/go.mod b/go.mod index 2adc21d..6da26fe 100644 --- a/go.mod +++ b/go.mod @@ -4,5 +4,6 @@ go 1.15 require ( github.com/dchest/bcrypt_pbkdf v0.0.0-20150205184540-83f37f9c154a + github.com/go-restruct/restruct v1.2.0-alpha golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a // indirect ) diff --git a/go.sum b/go.sum index d026318..d0fa314 100644 --- a/go.sum +++ b/go.sum @@ -1,5 +1,16 @@ +github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8= +github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/dchest/bcrypt_pbkdf v0.0.0-20150205184540-83f37f9c154a h1:saTgr5tMLFnmy/yg3qDTft4rE5DY2uJ/cCxCe3q0XTU= github.com/dchest/bcrypt_pbkdf v0.0.0-20150205184540-83f37f9c154a/go.mod h1:Bw9BbhOJVNR+t0jCqx2GC6zv0TGBsShs56Y3gfSCvl0= +github.com/go-restruct/restruct v1.2.0-alpha h1:2Lp474S/9660+SJjpVxoKuWX09JsXHSrdV7Nv3/gkvc= +github.com/go-restruct/restruct v1.2.0-alpha/go.mod h1:KqrpKpn4M8OLznErihXTGLlsXFGeLxHUrLRRI/1YjGk= +github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I= +github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= +github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= +github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk= +github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a h1:vclmkQCjlDX5OydZ9wv8rBCcS0QyQY66Mpf/7BZbInM= golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= @@ -7,3 +18,7 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw= +gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= diff --git a/sshkeys/bufutils.go b/sshkeys/bufutils.go index 8457017..c2a8973 100644 --- a/sshkeys/bufutils.go +++ b/sshkeys/bufutils.go @@ -18,9 +18,15 @@ package sshkeys +import ( + `encoding/binary` + + `github.com/go-restruct/restruct` +) + // These are just here to save some typing. func getBytelenStr(s string) []byte { - return getByteInt(len(s)) + return getBytelenByteArr([]byte(s)) } func getBytelenByteArr(b []byte) []byte { @@ -28,5 +34,15 @@ func getBytelenByteArr(b []byte) []byte { } func getByteInt(i int) []byte { - return []byte{byte(i)} + // This does not work. Despite being a uint32, golang always only writes it as 1 byte instead of 4. + // ...Despite it occupying 4 bytes in RAM. + // Luckily we can reuse this quick one-liner in getSingleByteInt(). + // return []byte{byte(i)} + b := make([]byte, 4) + b, _ = restruct.Pack(binary.BigEndian, uint32(i)) + return b } + +func getSingleByteInt(i int) []byte { + return []byte{byte(uint32(i))} +} \ No newline at end of file diff --git a/sshkeys/crypt.go b/sshkeys/crypt.go new file mode 100644 index 0000000..5ba9af6 --- /dev/null +++ b/sshkeys/crypt.go @@ -0,0 +1,57 @@ +package sshkeys + +import ( + `crypto/aes` + `crypto/cipher` + `errors` + + // `golang.org/x/crypto/ssh/internal/bcrypt_pbkdf` Golang doesn't let you import "internal" libs. Fine. Lame language. + `github.com/dchest/bcrypt_pbkdf` +) + +func (k *EncryptedSSHKeyV1) setCrypt() error { + // First we need the KDF (Key Derivation Function). + if err := k.setKDF(); err != nil { + return err + } + // And then we set the actual cipher (the thing that does the encrypting). + if err := k.setCipher(); err != nil { + return err + } + return nil +} + +func (k *EncryptedSSHKeyV1) setCipher() error { + switch k.CipherName { + case CipherAes256Ctr: + if k.Crypt.Cipher, err = aes.NewCipher(k.Crypt.PrivateKey); err != nil { + return err + } else { + k.Crypt.Stream = cipher.NewCTR(k.Crypt.Cipher, k.Crypt.CryptSalt) + // Can then be used as k.Crypt.Stream.XORKeyStream(dst []byte, src []byte) + } + default: + return errors.New("could not find Cipher") + } + return nil +} + +func (k *EncryptedSSHKeyV1) setKDF() error { + // Upstream only currently supports bcrypt_pbkdf ("bcrypt"). + // This should always eval to true, but is here for future planning in case other KDF are implemented. + switch k.KDFName { + case KdfBcrypt: + if k.Crypt.CryptKey, err = bcrypt_pbkdf.Key(k.Passphrase, + k.KDFOpts.Salt, + int(k.KDFOpts.Rounds), + kdfKeyLen + len(k.KDFOpts.Salt), + ); err != nil { + return err + } else { + k.Crypt.PrivateKey = k.Crypt.CryptKey[0:kdfSplit] + k.Crypt.CryptSalt = k.Crypt.CryptKey[kdfSplit:] + } + default: + return errors.New("could not find KDF") + } +} \ No newline at end of file diff --git a/sshkeys/func.go b/sshkeys/func.go index ddabfb5..8ef71ca 100644 --- a/sshkeys/func.go +++ b/sshkeys/func.go @@ -19,14 +19,10 @@ package sshkeys import ( - "crypto/aes" - "crypto/cipher" + `bytes` "crypto/rand" "errors" "fmt" - - // `golang.org/x/crypto/ssh/internal/bcrypt_pbkdf` Golang doesn't let you import "internal" libs. Fine. Lame language. - "github.com/dchest/bcrypt_pbkdf" ) func (k *EncryptedSSHKeyV1) validate() error { @@ -86,7 +82,6 @@ func (k *EncryptedSSHKeyV1) Generate(force bool) error { } if k.DefKeyType == KeyEd25519 { k.KeySize = keyEd25519 - k.BlockSize = blockEd25519 } // Currently, OpenSSH has an option for multiple private keys. However, it is hardcoded to 1. // If multiple key support is added in the future, will need to re-tool how I do this, perhaps, in the future. TODO. @@ -111,31 +106,13 @@ func (k *EncryptedSSHKeyV1) Generate(force bool) error { } k.Keys = append(k.Keys, pk) // We also need an encrypter/decrypter since this is an encrypted key. - // Upstream only currently supports bcrypt_pbkdf ("bcrypt"). - // This should always eval to true, but is here for future planning in case other KDF are implemented. - switch k.KDFName { - case KdfBcrypt: - if k.Crypt.CryptKey, err = bcrypt_pbkdf.Key(k.Passphrase, k.KDFOpts.Salt, int(k.KDFOpts.Rounds), kdfKeyLen+len(k.KDFOpts.Salt)); err != nil { - return err - } else { - k.Crypt.PrivateKey = k.Crypt.CryptKey[0:kdfSplit] - k.Crypt.CryptSalt = k.Crypt.CryptKey[kdfSplit:] - } - default: - return errors.New("could not find KDF") + if err := k.setCrypt(); err != nil { + return err } - switch k.CipherName { - case CipherAes256Ctr: - if k.Crypt.Cipher, err = aes.NewCipher(k.Crypt.PrivateKey); err != nil { - return err - } else { - k.Crypt.Stream = cipher.NewCTR(k.Crypt.Cipher, k.Crypt.CryptSalt) - // Can then be used as k.Crypt.Stream.XORKeyStream(dst []byte, src []byte) - } - default: - return errors.New("could not find Cipher") + // And then we need to build the key buffer. + if err := k.buildKeybuf(); err != nil { + return err } - k.build() return nil } @@ -158,7 +135,6 @@ func (k *SSHKeyV1) Generate(force bool) error { } if k.DefKeyType == KeyEd25519 { k.KeySize = keyEd25519 - k.BlockSize = blockEd25519 } k.CipherName = CipherNull k.KDFName = KdfNull @@ -184,34 +160,232 @@ func (k *SSHKeyV1) Generate(force bool) error { return errors.New("unknown key type; could not generate private/public keypair") } k.Keys = append(k.Keys, pk) - k.build() + if err := k.buildKeybuf(); err != nil { + return err + } return nil } -func (k *SSHKeyV1) build() error { - // We actually assemble the key buffer here. Translation to bytes where needed, case switches (ED25519 vs. RSA), etc. - k.Buffer.Truncate(0) - // First we need to do some prep for the common header. - kdfOptsBytes := []byte{} - switch k.(type) { - case EncryptedSSHKeyV1: - kdfOptsBytes = append(kdfOptsBytes, byte(len(k.KDFOpts.Salt))) +// buildKeybuf is where an EncryptedSSHKeyV1 key buffer is actually assembled. +// Entries are commented with their annotated reference. +// (see ref/(encrypted|plain)/(public|private).(rsa|ed25519) and ref/format.(ed25519|rsa) for details) +func (k *EncryptedSSHKeyV1) buildKeybuf() error { + // TODO: error handling for each .Write()? + // Before anything, we want a clean buffer. Just in case. + k.Buffer.Reset() + // Add the common header. + if err := k.addHeader(); err != nil { + return err } - // For this, we can use a generic list and sequentially write. - cipher := []byte(k.CipherName) - kdf := []byte(k.KDFName) + // Add the keypairs. + // Since this is encrypted, the private key blobs are encrypted. + // OpenSSH keys currently only support 1 keypair but support more *in theory*. This *seems* to be how they plan on doing it. + // But boy, is it a pain. So much wasted RAM and CPU cycles. They should use terminating byte sequences IMHO but whatever. + for _, i := range k.Keys { // 4.0.0 and 4.0.1 + switch k.CipherName { + case CipherAes256Ctr: + i.BlockSize = k.Crypt.Cipher.BlockSize() + } + kbPtr, err := i.keyBlob(&k.Crypt, true) + if err != nil { + return err + } + k.Buffer.Write(*kbPtr) + } + return nil +} + +// buildKeybuf is where an SSHKeyV1 key buffer is actually assembled. +// Entries are commented with their annotated reference. +// (see ref/(encrypted|plain)/(public|private).(rsa|ed25519) and ref/format.(ed25519|rsa) for details) +func (k *SSHKeyV1) buildKeybuf() error { + // TODO: error handling for each .Write()? + // Before anything, we want a clean buffer. Just in case. + k.Buffer.Reset() + // Add the common header. + if err := k.addHeader(); err != nil { + return err + } + // Add the keypairs. + // OpenSSH keys currently only support 1 keypair but support more *in theory*. This *seems* to be how they plan on doing it. + // But boy, is it a pain. So much wasted RAM and CPU cycles. They should use terminating byte sequences IMHO but whatever. + for _, i := range k.Keys { // 4.0.0 and 4.0.1 + i.BlockSize = 8 + kbPtr, err := i.keyBlob(nil, false) + if err != nil { + return err + } + k.Buffer.Write(*kbPtr) + } + return nil +} + +func (k *SSHKeyV1) addHeader() error { + // TODO: error handling for each .Write()? + // First we need to do some prep for the plaintext header. + var kdfOptsBytes []byte + kdfOptsBytes = k.getKdfOptBytes() // 3.0.0 + cipherBytes := []byte(k.CipherName) // 1.0 + kdf := []byte(k.KDFName) // 2.0.0 + // This is just cast to an array for visual readability. commonHeader := [][]byte{ - []byte(KeyV1Magic + "\x00"), - {byte(len(cipher))}, - cipher, - {byte(len(kdf))}, - kdf, + []byte(KeyV1Magic + "\x00"), // 0 + getBytelenByteArr(cipherBytes), // 1.0 + cipherBytes, // 1.0.0 + getBytelenByteArr(kdf), // 2.0 + kdf, // 2.0.0 + getBytelenByteArr(kdfOptsBytes), // 3.0 + kdfOptsBytes, // 3.0.0 + getByteInt(len(k.Keys)), // 4.0 } for _, v := range commonHeader { if _, err := k.Buffer.Write(v); err != nil { - k.Buffer.Truncate(0) return err } } - + return nil } + +func (k *EncryptedSSHKeyV1) getKdfOptBytes() []byte { + var kdfOptsBytes []byte // 3.0.0 + // This is *probably* more efficient than using a buffer just for these bytes. + kdfOptsBytes = append(kdfOptsBytes, byte(len(k.KDFOpts.Salt))) // 3.0.0.0 + kdfOptsBytes = append(kdfOptsBytes, k.KDFOpts.Salt...) // 3.0.0.0.0 + kdfOptsBytes = append(kdfOptsBytes, byte(k.KDFOpts.Rounds)) // 3.0.0.1 + return kdfOptsBytes +} + +func (k *SSHKeyV1) getKdfOptBytes() []byte { + var kdfOptsBytes []byte // 3.0.0 + // No-op; unencrypted keys' KDFOpts are encapsulated by a single null byte (which the caller implements). + return kdfOptsBytes +} + +func (pk *SSHPrivKey) keyBlob(c *SSHCrypt, encrypt bool) (*[]byte, error) { + // TODO: error handling for each .Write()? + var keypairBytes bytes.Buffer // (4.0's children) + var pubkeyBytes bytes.Buffer // 4.0.0 children (4.0.0 itself is handled before writing to keypairBytes) + var privkeyBytes bytes.Buffer // 4.0.1 (and children) + pubkeyName := []byte(pk.PublicKey.KeyType) // (4.0.0.0.0, cast to var because I'm lazy) + pubkeyBytes.Write(getBytelenByteArr(pubkeyName)) // 4.0.0.0 + pubkeyBytes.Write(pubkeyName) // 4.0.0.0.0 + // TODO: Optimize? + /* + THE PUBLIC KEY + This is unencrypted, even if it's an encrypted key. + */ + switch pk.PublicKey.KeyType { + case KeyEd25519: + pubkeyBytes.Write(getBytelenByteArr(pk.PublicKey.Key.([]byte))) // 4.0.0.1 + pubkeyBytes.Write(pk.PublicKey.Key.([]byte)) // 4.0.0.1.0 + case KeyRsa: + // How messy. + var en bytes.Buffer // 4.0.0.1 and 4.0.0.2 + // TODO: does e need getByteInt()? + e := pk.PublicKey.Key.E.Bytes() // 4.0.0.1.0 + // TODO: does n need nullbyte prefix? + n := pk.PublicKey.Key.N.Bytes() // 4.0.0.2.0 + en.Write(getBytelenByteArr(e)) // 4.0.0.1 + en.Write(e) // 4.0.0.1.0 + en.Write(getBytelenByteArr(n)) // 4.0.0.2 + en.Write(n) // 4.0.0.2.0 + pubkeyBytes.Write(getBytelenByteArr(en.Bytes())) // 4.0.0 + if _, err := en.WriteTo(&pubkeyBytes); err != nil { // (4.0.0 children) + return nil, err + } + } + /* + THE PRIVATE KEY + This is encrypted if it's an encrypted key, otherwise it's just plain readable bytes. + */ + // First we need two checksums. + for i := 1; i <= 2; i++ { + privkeyBytes.Write(pk.Checksum) // 4.0.1.0 and 4.0.1.1 + } + // And then add the public keys. Yes, the public keys are included in the private keys. + privkeyBytes.Write(getBytelenByteArr(pubkeyName)) // 4.0.1.2.0 + privkeyBytes.Write(pubkeyName) // 4.0.1.2.0.0 + switch pk.PublicKey.KeyType { + case KeyEd25519: + // This is easy. + privkeyBytes.Write(pubkeyBytes.Bytes()) // 4.0.1.2.1 + if _, err := pubkeyBytes.WriteTo(&privkeyBytes); err != nil { // 4.0.1.2.1.0 + return nil, err + } + case KeyRsa: + // This is not. We more or less have to do the same thing as the public key, BUT with e and n flipped. Gorram it. + var ne bytes.Buffer // (4.0.1.2 children) + // TODO: does n need nullbyte prefix? + n := pk.PublicKey.Key.N.Bytes() // 4.0.1.2.1.0 + // TODO: does e need getByteInt()? + e := pk.PublicKey.Key.E.Bytes() // 4.0.1.2.2.0 + ne.Write(getBytelenByteArr(n)) // 4.0.1.2.1 + ne.Write(n) // 4.0.1.2.1.0 + ne.Write(getBytelenByteArr(e)) // 4.0.1.2.2 + ne.Write(e) // 4.0.1.2.2.0 + if _, err := ne.WriteTo(&privkeyBytes); err != nil { // (4.0.1.2 children) + return nil, err + } + } + // And then we add the *actual* private keys. + switch pk.PublicKey.KeyType { + case KeyEd25519: + privkeyBytes.Write(getBytelenByteArr(pk.KeyAlt)) // 4.0.1.3 + privkeyBytes.Write(pk.KeyAlt) // 4.0.1.3.0 + case KeyRsa: + var dcpq bytes.Buffer // 4.0.1.3 to 4.0.1.6 + d := pk.Key.D.Bytes() // 4.0.1.3.0 + crt := pk.Key.Precomputed.Qinv.Bytes() // 4.0.1.4.0 + // TODO: does p need nullbyte prefix? + p := pk.Key.Primes[0].Bytes() // 4.0.1.5.0 + // TODO: does q need nullbyte prefix? + q := pk.Key.Primes[1].Bytes() // 4.0.1.6.0 + dcpq.Write(getBytelenByteArr(d)) // 4.0.1.3 + dcpq.Write(d) // 4.0.1.3.0 + dcpq.Write(getBytelenByteArr(crt)) // 4.0.1.4 + dcpq.Write(crt) // 4.0.1.4.0 + dcpq.Write(getBytelenByteArr(p)) // 4.0.1.5 + dcpq.Write(p) // 4.0.1.5.0 + dcpq.Write(getBytelenByteArr(q)) // 4.0.1.6 + dcpq.Write(q) // 4.0.1.6.0 + if _, err := dcpq.WriteTo(&privkeyBytes); err != nil { // 4.0.1.3 to 4.0.1.6 + return nil, err + } + } + // Add the comment. + privkeyBytes.Write(getBytelenByteArr([]byte(pk.Comment))) // 4.0.1.4 (ED25519), 4.0.1.7 (RSA) + privkeyBytes.Write([]byte(pk.Comment)) // 4.0.1.4.0 (ED25519), 4.0.1.7.0 (RSA) + // Add padding + pad := 0 + n := 0 + for len(privkeyBytes.Bytes()) % pk.BlockSize != 0 { // 4.0.1.5 (ED25519), 4.0.1.8 (RSA) + n++ + pad = n & pk.BlockSize + privkeyBytes.Write(getSingleByteInt(pad)) + } + // Check if the private key should be encrypted or not. + if encrypt { + // We encrypt here to a "new" buffer. + // We actually just clear the buffer and then write the new encrypted data to it, and then clear the intermediate byte slice. + if c == nil || c.Stream == nil { + return nil, errors.New("if encrypting, you must specify a populated SSHCrypt in c") + } + var encBytes []byte + c.Stream.XORKeyStream(encBytes, privkeyBytes.Bytes()) + privkeyBytes.Reset() + privkeyBytes.Write(encBytes) + encBytes = []byte{} + } + // Get the respective lengths and add child buffers to buffer. + keypairBytes.Write(getByteInt(len(pubkeyBytes.Bytes()))) // 4.0.0 + if _, err := pubkeyBytes.WriteTo(&keypairBytes); err != nil { // (4.0.0 children) + return nil, err + } + keypairBytes.Write(getByteInt(len(privkeyBytes.Bytes()))) // 4.0.1 + if _, err := privkeyBytes.WriteTo(&keypairBytes); err != nil { // (4.0.1 children) + return nil, err + } + // Done! + kpSlice := keypairBytes.Bytes() + return &kpSlice, nil +} \ No newline at end of file diff --git a/sshkeys/ref/encrypted/parse_poc_ed25519.go b/sshkeys/ref/encrypted/parse_poc_ed25519.go index 5d05d36..e5c46a8 100644 --- a/sshkeys/ref/encrypted/parse_poc_ed25519.go +++ b/sshkeys/ref/encrypted/parse_poc_ed25519.go @@ -19,90 +19,18 @@ package main import ( - "crypto" - "crypto/aes" - "crypto/cipher" - "crypto/ed25519" - "encoding/hex" - "fmt" + `crypto` + `crypto/aes` + `crypto/cipher` + `crypto/ed25519` + `encoding/hex` + `fmt` - "github.com/dchest/bcrypt_pbkdf" + `github.com/dchest/bcrypt_pbkdf` ) -// ssh-keygen -f /tmp/tmp2xzvpjhn -q -o -t ed25519 -N test -a 100 -// private -/* on-disk format ------BEGIN OPENSSH PRIVATE KEY----- -b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABAZQzNZ6B -eWtpsLgQvGbcuMAAAAZAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIFjgZ791hHftK4GY -uhnIN/1JdZqA17hIlNdKr+ljJ9bfAAAAoN0XZgxeA2SLXGZXqZi9TqeQHU7PERiJA9F0+p -2NtNP4Y1Rey8C1EnF5mhzy8AZs6YJsE+xnQUSI/+Kbmi6MACQALaPO7CgtKwnfbFHuxzrD -1EG83K08w2NE2txlQPqflQcFoVBIzcXNVFv+3A5DM7BBz0jLFi5CCwl2PEhMhcpElvV+LW -PGXBV9IVdOeHm/hesRfuWTHcUalrqar1CmLWo= ------END OPENSSH PRIVATE KEY----- -*/ -/* actual bytes (hex repr) -00000000: 6f 70 65 6e 73 73 68 2d 6b 65 79 2d 76 31 00 00 openssh-key-v1.. -00000010: 00 00 0a 61 65 73 32 35 36 2d 63 74 72 00 00 00 ...aes256-ctr... -00000020: 06 62 63 72 79 70 74 00 00 00 18 00 00 00 10 19 .bcrypt......... -00000030: 43 33 59 e8 17 96 b6 9b 0b 81 0b c6 6d cb 8c 00 C3Y.........m... -00000040: 00 00 64 00 00 00 01 00 00 00 33 00 00 00 0b 73 ..d.......3....s -00000050: 73 68 2d 65 64 32 35 35 31 39 00 00 00 20 58 e0 sh-ed25519... X. -00000060: 67 bf 75 84 77 ed 2b 81 98 ba 19 c8 37 fd 49 75 g.u.w.+.....7.Iu -00000070: 9a 80 d7 b8 48 94 d7 4a af e9 63 27 d6 df 00 00 ....H..J..c'.... -00000080: 00 a0 dd 17 66 0c 5e 03 64 8b 5c 66 57 a9 98 bd ....f.^.d.\fW... -00000090: 4e a7 90 1d 4e cf 11 18 89 03 d1 74 fa 9d 8d b4 N...N......t.... -000000a0: d3 f8 63 54 5e cb c0 b5 12 71 79 9a 1c f2 f0 06 ..cT^....qy..... -000000b0: 6c e9 82 6c 13 ec 67 41 44 88 ff e2 9b 9a 2e 8c l..l..gAD....... -000000c0: 00 24 00 2d a3 ce ec 28 2d 2b 09 df 6c 51 ee c7 .$.-...(-+..lQ.. -000000d0: 3a c3 d4 41 bc dc ad 3c c3 63 44 da dc 65 40 fa :..A...<.cD..e@. -000000e0: 9f 95 07 05 a1 50 48 cd c5 cd 54 5b fe dc 0e 43 .....PH...T[...C -000000f0: 33 b0 41 cf 48 cb 16 2e 42 0b 09 76 3c 48 4c 85 3.A.H...B..v'..x$..... -00000120: c5 07 14 c9 63 66 50 a7 20 81 e7 fa 5d 47 2c 14 ....cfP. ...]G,. -00000130: 28 b0 7e ae 5d 15 b6 4e a1 e2 a7 50 85 12 fe 9a (.~.]..N...P.... -00000140: b6 55 f8 6a 31 34 86 d3 cc a1 dd 8e 90 ac c5 c9 .U.j14.......... -00000150: fb a4 d6 e7 67 50 7f ba b9 f3 a7 f6 8c 74 81 42 ....gP.......t.B -00000160: af 2a 37 01 d3 1a 8a 9b 75 11 95 8a a7 71 87 ba .*7.....u....q.. -00000170: 70 2e d9 34 d3 85 af ce e4 23 80 e9 5e 0e 7e 9b p..4.....#..^.~. -00000180: c0 f4 d2 33 67 fc 77 03 74 16 7b 7f 09 26 fb 6f ...3g.w.t.{..&.o -00000190: db 6d 05 aa d1 cf d1 91 82 48 45 b0 14 e1 81 53 .m.......HE....S -000001a0: bf 0d 1d 3c 3b 1f ad bb 25 a3 f1 d1 51 f9 b6 84 ...<;...%...Q... -000001b0: 63 3d 8c 16 90 fc d8 ca d0 5a ac 2a eb 23 db f1 c=.......Z.*.#.. -000001c0: 9a 37 e4 80 a0 08 91 03 19 c1 16 d4 7b d9 24 b3 .7..........{.$. -000001d0: 99 42 54 3b 88 a0 f6 12 79 52 b2 d8 e1 29 0f 30 .BT;....yR...).0 -000001e0: 29 f5 42 ae be 9c 0c 8e 36 cf 32 96 86 5c d6 64 ).B.....6.2..\.d -000001f0: 3c 89 24 d5 66 eb f4 97 18 09 39 9a 1a c0 96 fe <.$.f.....9..... -00000200: 1e dc 3b 5f 87 1b f5 ef 0b 4d 44 e0 ea 27 62 0d ..;_.....MD..'b. -00000210: 20 51 42 e0 bf cf 67 7b 4d b0 25 53 21 21 a3 f0 QB...g{M.%S!!.. -00000220: 74 5a a4 d0 58 63 31 73 32 57 85 5a 5c ec be 3a tZ..Xc1s2W.Z\..: -00000230: c4 40 3d 04 ff 0c c0 c5 8b 7c 04 90 4b 40 21 25 .@=......|..K@!% -00000240: c2 bc 2a 63 a2 0e bb 30 9c c6 f3 e6 5d b3 01 a0 ..*c...0....]... -00000250: 58 b8 da ce 07 e7 1b 38 f3 f3 59 54 33 f6 9b 19 X......8..YT3... -00000260: 8f 07 00 00 07 50 96 6e 2c e4 35 24 2f ef 09 78 .....P.n,.5$/..x -00000270: 7f 6e 8d 93 a5 63 09 2e 3f 3b c9 86 b4 41 98 c8 .n...c..?;...A.. -00000280: 1e 80 49 c5 c9 44 41 9e ff c0 52 14 01 dc 1e f5 ..I..DA...R..... -00000290: bc 0e 4d 6a ed eb 7d 05 88 0b c3 f7 31 69 8b 9b ..Mj..}.....1i.. -000002a0: ce ec ea e0 8e 5e 05 f7 9f 4d 22 de 95 3c 89 9c .....^...M"..<.. -000002b0: 32 71 85 0e 80 e8 04 f9 b1 a7 9b ce c3 1b ba 11 2q.............. -000002c0: c0 8d b6 0f 9b d2 20 6b c3 d7 bf ef 74 89 5e 4f ...... k....t.^O -000002d0: 4e 37 20 64 9f 92 45 44 f4 a2 ce a5 b9 df b9 cc N7 d..ED........ -000002e0: 0a 2b d8 f3 ba 70 f4 ba 2e 7f 42 96 04 65 c9 ea .+...p....B..e.. -000002f0: de 11 86 30 f9 c8 32 fe 84 ef 54 85 29 97 9d 0d ...0..2...T.)... -00000300: 6e a0 79 f9 d5 c4 0e 39 6b 09 8f c5 09 44 8d 26 n.y....9k....D.& -00000310: de 3c b4 84 b0 33 4a fa ca ba 37 1b 52 c3 7c 12 .<...3J...7.R.|. -00000320: 0a 56 23 17 0c 1d 0a 39 34 8a 15 1c 9f b8 aa b1 .V#....94....... -00000330: 04 9f 52 cf 0c 08 c7 71 44 af 31 42 59 a9 08 48 ..R....qD.1BY..H -00000340: f3 dc 62 e5 83 1f ac 08 72 0b 1c 81 35 06 f1 db ..b.....r...5... -00000350: 1e 79 40 de f5 2d c4 6c 97 d6 36 3c da 0f f7 e2 .y@..-.l..6<.... -00000360: 25 8e 26 37 d2 e0 9f 26 09 9b bf ea c7 88 19 19 %.&7...&........ -00000370: 8b 78 37 4d 24 24 53 7f e5 49 a2 ab 3d dd af 5f .x7M$$S..I..=.._ -00000380: 7f db 73 9c 39 21 06 4b 04 f6 ff cf eb 55 44 db ..s.9!.K.....UD. -00000390: 53 31 79 03 8e 11 d0 cc 62 29 92 bc 6d 06 00 58 S1y.....b)..m..X -000003a0: 4d 40 68 a2 89 1d c7 48 c9 c1 6b e3 2c 2a 08 e9 M@h....H..k.,*.. -000003b0: 6c aa 2d de c4 dd d1 a2 ab 3b 01 8a 0b 0f 16 6a l.-......;.....j -000003c0: 15 ac 87 0a 30 c8 0c c8 97 db f1 5a f7 e8 c2 91 ....0......Z.... -000003d0: 5b 36 16 f2 37 a6 64 6e 43 c6 65 f7 56 9a 5e d1 [6..7.dnC.e.V.^. -000003e0: 85 0a d8 cd 05 40 06 d3 89 56 8d b5 53 93 e7 80 .....@...V..S... -000003f0: e7 52 ac e8 f0 6b 70 f1 e9 9d 86 b9 44 5d 9c 1a .R...kp.....D].. -00000400: 7a 64 76 bc bf 48 44 00 a5 8e 5a 5a 73 d2 c2 0d zdv..HD...ZZs... -00000410: 63 0a 99 85 bb f4 c6 91 ab b6 1e e4 51 5a a6 4a c...........QZ.J -00000420: 72 7e 7b ac 4a 5e d7 bb 5f 76 7c 7d cf 00 35 90 r~{.J^.._v|}..5. -00000430: 42 31 28 3d 92 44 58 63 70 2a 99 5e 79 2b de 1d B1(=.DXcp*.^y+.. -00000440: 5a c7 dd 62 48 98 7b 9f e4 b0 a6 f1 83 7c e4 fb Z..bH.{......|.. -00000450: aa 03 2f f4 67 1a 86 be 8c 7e 4f 9b e3 71 82 12 ../.g....~O..q.. -00000460: ea d0 a6 f1 b4 29 88 86 3b f8 0a f1 7a 98 14 f1 .....)..;...z... -00000470: ff be d6 c8 1e 7f 59 de 5b 8c 71 b9 f5 71 fc 55 ......Y.[.q..q.U -00000480: 6c c5 6a ee 22 be 1b 57 d4 8f 8c a7 6a 37 98 47 l.j."..W....j7.G -00000490: c6 7d 0c eb 43 ea d1 01 35 5e 54 1a 57 c2 54 ae .}..C...5^T.W.T. -000004a0: 81 4f 05 8a 03 61 92 f4 9d 96 23 6c 88 42 8e 5f .O...a....#l.B._ -000004b0: 54 da fe fd 1a 5b 8c a1 2d 85 cf 38 33 d3 8d 81 T....[..-..83... -000004c0: 6c 6e 0e 20 51 43 f3 3e 35 3c 47 1a bc 97 8d 28 ln. QC.>5? -000005a0: 82 8e 42 53 a7 ec 6d 98 7a d6 1b d2 17 9c 22 9a ..BS..m.z.....". -000005b0: 20 e8 d9 7e 61 58 cb 0b e7 34 22 76 98 b4 69 5c ..~aX...4"v..i\ -000005c0: 78 4c 46 3c ac 3e a7 d5 38 05 6d 50 62 a8 95 f8 xLF<.>..8.mPb... -000005d0: ae 64 54 9b d5 84 84 a6 03 63 ab 81 bc 43 e6 fd .dT......c...C.. -000005e0: e0 ee 12 47 70 51 b5 3c 97 0f 06 3d f2 f0 ff 2f ...GpQ.<...=.../ -000005f0: d6 55 b7 f8 10 29 be 54 5c c8 41 f7 32 1d 31 30 .U...).T\.A.2.10 -00000600: 4e eb a2 10 fd f8 fd ad 7e 1b c8 ac cd 4d 99 0c N.......~....M.. -00000610: 05 8b 30 81 7e 85 e2 c5 69 5a b9 2c 1e 12 9a c7 ..0.~...iZ.,.... -00000620: 47 1f 33 8f dd 39 4e de 16 07 14 50 c1 90 61 e0 G.3..9N....P..a. -00000630: 7c 13 5c be 87 f0 12 60 b3 62 06 cb c1 69 c8 5b |.\....`.b...i.[ -00000640: 9d da 26 fb 3d ff 5e 7d 68 fd 51 a5 73 40 2d bc ..&.=.^}h.Q.s@-. -00000650: c1 dc 7f 49 a1 cb 9c 34 10 0b 9b 3d 0b b8 b8 63 ...I...4...=...c -00000660: 9c 69 c7 d4 74 90 ab 83 c8 91 8a d0 3a e6 2e ee .i..t.......:... -00000670: 43 16 5e 45 2f 85 4d 8d 41 32 18 6c 21 f7 42 ee C.^E/.M.A2.l!.B. -00000680: 4a 3c c6 14 51 5a dc 7c 08 94 08 38 53 85 03 f5 J<..QZ.|...8S... -00000690: c4 d5 78 1e 98 4c ad 93 cf 7a 8d 17 a6 8d 67 8b ..x..L...z....g. -000006a0: 34 66 af ba e3 62 05 5d 5b 6e db 00 07 b5 92 31 4f...b.][n.....1 -000006b0: d3 04 0d bf ec 8b 97 82 b3 9c 39 11 16 f2 03 7e ..........9....~ -000006c0: 21 8b fa ba 46 c5 2c 56 18 0a ee f2 41 d9 18 f2 !...F.,V....A... -000006d0: 14 b0 b6 48 0b 73 82 87 5a d9 da ce 44 96 c3 68 ...H.s..Z...D..h -000006e0: 2e a2 a6 97 b5 fe 43 b1 07 d9 3e 19 76 b2 54 0d ......C...>.v.T. -000006f0: bf da 2a e2 23 bc 1a 84 d6 5e 0d 67 02 51 3b 8c ..*.#....^.g.Q;. -00000700: c4 42 a2 5f b9 83 aa df a4 92 d0 9e 3d fd 99 1f .B._........=... -00000710: 9f 47 47 0b b7 33 69 f6 34 dd 50 da b2 6d 12 9c .GG..3i.4.P..m.. -00000720: 3b a0 96 ad 79 71 1f 0e e4 41 9c 12 26 eb 8d a4 ;...yq...A..&... -00000730: 26 74 b2 cf 77 e8 f4 a3 f7 6c e9 e9 e2 49 b4 d1 &t..w....l...I.. -00000740: fc c7 78 ef 31 8d bd 67 78 55 6c 0f 98 78 eb e6 ..x.1..gxUl..x.. -00000750: e8 32 49 16 d7 82 80 f2 3f 7e 39 21 b2 9b 42 bb .2I.....?~9!..B. -00000760: a6 ca 2d 78 03 99 ca 4e d3 cb 2d 03 6c 9b ed 80 ..-x...N..-.l... -00000770: b2 35 80 91 98 42 21 35 e2 d8 42 c8 f5 3a 4d d5 .5...B!5..B..:M. -00000780: 9f e0 be d8 89 d4 78 40 16 40 24 b1 f6 68 cc 56 ......x@.@$..h.V -00000790: 69 78 d4 31 eb 2a 07 a2 0e d0 6e 57 55 51 e1 b0 ix.1.*....nWUQ.. -000007a0: 30 db 13 50 e9 4c 92 9a 02 8a 5d c2 53 40 e3 43 0..P.L....].S@.C -000007b0: 4f 22 50 e3 f4 9d e1 71 bb 85 08 75 d2 80 05 0e O"P....q...u.... -000007c0: 49 55 44 ba 71 b7 1e a3 6c 29 37 ad 65 93 e2 b5 IUD.q...l)7.e... -000007d0: bc a2 8b c3 8e 59 ce a9 1f 26 cd 1c a8 aa 4b d9 .....Y...&....K. -000007e0: fb c1 c6 05 ae 46 ae 3f 55 9b 3a 6e bf 89 ff 56 .....F.?U.:n...V -000007f0: 9f f3 65 c3 cb a4 b4 b9 1f 66 5f fd a3 97 18 8f ..e......f_..... -00000800: e2 3e a4 56 c8 02 c4 7a 80 62 84 4d 40 4f ab 41 .>.V...z.b.M@O.A -00000810: a0 fa 83 fd 0d d6 6e 4d b5 11 15 f0 26 19 7f 4c ......nM....&..L -00000820: 89 a1 bf 28 24 6b a9 96 6c a2 97 3b 0f 3a fa 43 ...($k..l..;.:.C -00000830: 15 48 96 a5 6b fe 21 53 df aa a3 cc d2 ab 01 1b .H..k.!S........ -00000840: 7f 91 47 0c bd c0 4a f7 cf e1 70 3d e7 04 0f 4d ..G...J...p=...M -00000850: 77 77 b0 68 76 9d 40 35 37 7c c7 66 4f 40 6b 5d ww.hv.@57|.fO@k] -00000860: 69 35 6a a3 30 45 c4 33 4a 1e 2c e6 02 ea 2b 1e i5j.0E.3J.,...+. -00000870: c6 66 35 2d 14 b5 99 6d ad 45 1a 4c b8 86 c6 61 .f5-...m.E.L...a -00000880: 43 dc 25 f8 f1 bc f0 ed 25 3f eb c9 73 34 32 ea C.%.....%?..s42. -00000890: da 35 a6 af c9 82 74 9f a0 ec 68 0a 88 1d b0 61 .5....t...h....a -000008a0: 71 ea 37 fa 83 38 1e c9 0a 6a fa 2f 26 9d 9d a0 q.7..8...j./&... -000008b0: 7c 8f 30 21 61 e2 6c 9a 4c 21 c2 56 0c ed 81 1b |.0!a.l.L!.V.... -000008c0: df 6b e4 02 d3 6a e2 f1 1f 88 43 51 24 1e 77 9a .k...j....CQ$.w. -000008d0: 22 f8 b6 9a 8e 3e ea a6 76 e7 15 01 43 a6 6b 3a "....>..v...C.k: -000008e0: 92 d4 da ce 9f 4f 9b 61 e3 f7 e0 aa 76 56 c8 18 .....O.a....vV.. -000008f0: ec fb 53 30 34 57 d5 1e 74 e7 ec 89 cf 03 8c 9a ..S04W..t....... -00000900: 73 f3 83 43 83 e8 22 d2 f5 0c 3a 77 75 aa 0e 63 s..C.."...:wu..c -00000910: b1 27 a2 14 db 74 90 e4 88 f7 ee 91 78 2a 90 de .'...t......x*.. -00000920: 32 f4 ab 22 60 1a f7 b1 90 fc c6 a2 92 e4 2e 2f 2.."`........../ -00000930: 8b 69 ca ac e9 94 b1 27 e9 f9 15 32 b6 d8 c3 b7 .i.....'...2.... -00000940: ce 08 f9 91 d2 69 22 0b ce ee d7 d4 e6 15 15 23 .....i"........# -00000950: e6 3e 41 bc d2 71 54 fd 3a 7f 73 70 c0 4b 12 58 .>A..qT.:.sp.K.X -00000960: 71 54 13 ec 5f 17 f5 1b aa 99 e8 e5 cd 59 ac 7a qT.._........Y.z -00000970: f1 7d ae cd 0e 89 26 00 24 03 ab 87 a4 22 e4 22 .}....&.$...."." -00000980: a6 fb 11 86 b5 bb 7d b2 5f af fe da d2 47 fd 74 ......}._....G.t -00000990: 1b 24 61 aa 3b 96 12 34 21 42 af 10 de ce fe 00 .$a.;..4!B...... -000009a0: c0 0b 37 a6 67 ad 76 65 fb c4 08 5b 53 12 bd a6 ..7.g.ve...[S... -000009b0: 90 16 62 45 a9 3b ..bE.; -// -6f70656e7373682d6b65792d763100 authmagic -0000000a 10 -6165733235362d637472 "aes256-ctr" -00000006 6 -626372797074 "bcrypt" -00000018 24 -00000010 16 -07d4b07c0b128348916488008d6e130b salt -00000064 100 -00000001 1 -00000217 535 -00000007 7 -7373682d727361 "ssh-rsa" -00000003 3 -010001 65537 public exponent -00000201 513 -00b7cec04601ce2a12f0c924cb9a30eb990066812cb14369193f30b2b9fdd4af ((32*16) + 1) bytes (513 bytes) modulus (ASN.1 format) -cb300c918f2a77d64410f3617ae7c8ca318c257d3c4df4e2c4108bbbe93a8689 -4ba14b3575f2f72150bc381dcbfb742c7a196866fd3184ace96761adda0fc299 -2f6c866d7569919fc22d9c4bf0de405a8c76d519aa2a5329dc6825777229a5d0 -b753a7825a89b95275f9c025e215343c6c88cd6690a221f8ae9ef675ee464dc7 -d118da410507ea5d6b6489dd60afd8a6646492db3e279f1a78240db8abbda6c5 -0714c9636650a72081e7fa5d472c1428b07eae5d15b64ea1e2a7508512fe9ab6 -55f86a313486d3cca1dd8e90acc5c9fba4d6e767507fbab9f3a7f68c748142af -2a3701d31a8a9b7511958aa77187ba702ed934d385afcee42380e95e0e7e9bc0 -f4d23367fc770374167b7f0926fb6fdb6d05aad1cfd191824845b014e18153bf -0d1d3c3b1fadbb25a3f1d151f9b684633d8c1690fcd8cad05aac2aeb23dbf19a -37e480a008910319c116d47bd924b39942543b88a0f6127952b2d8e1290f3029 -f542aebe9c0c8e36cf3296865cd6643c8924d566ebf4971809399a1ac096fe1e -dc3b5f871bf5ef0b4d44e0ea27620d205142e0bfcf677b4db025532121a3f074 -5aa4d0586331733257855a5cecbe3ac4403d04ff0cc0c58b7c04904b402125c2 -bc2a63a20ebb309cc6f3e65db301a058b8dace07e71b38f3f3595433f69b198f -07 -00000750 1872 -966e2ce435242fef09787f6e8d93a563092e3f3bc986b44198c81e8049c5c944 ((32*58) + 16) bytes (1872 bytes) private key -419effc0521401dc1ef5bc0e4d6aedeb7d05880bc3f731698b9bceeceae08e5e -05f79f4d22de953c899c3271850e80e804f9b1a79bcec31bba11c08db60f9bd2 -206bc3d7bfef74895e4f4e3720649f924544f4a2cea5b9dfb9cc0a2bd8f3ba70 -f4ba2e7f42960465c9eade118630f9c832fe84ef548529979d0d6ea079f9d5c4 -0e396b098fc509448d26de3cb484b0334afacaba371b52c37c120a5623170c1d -0a39348a151c9fb8aab1049f52cf0c08c77144af314259a90848f3dc62e5831f -ac08720b1c813506f1db1e7940def52dc46c97d6363cda0ff7e2258e2637d2e0 -9f26099bbfeac78819198b78374d2424537fe549a2ab3dddaf5f7fdb739c3921 -064b04f6ffcfeb5544db533179038e11d0cc622992bc6d0600584d4068a2891d -c748c9c16be32c2a08e96caa2ddec4ddd1a2ab3b018a0b0f166a15ac870a30c8 -0cc897dbf15af7e8c2915b3616f237a6646e43c665f7569a5ed1850ad8cd0540 -06d389568db55393e780e752ace8f06b70f1e99d86b9445d9c1a7a6476bcbf48 -4400a58e5a5a73d2c20d630a9985bbf4c691abb61ee4515aa64a727e7bac4a5e -d7bb5f767c7dcf0035904231283d92445863702a995e792bde1d5ac7dd624898 -7b9fe4b0a6f1837ce4fbaa032ff4671a86be8c7e4f9be3718212ead0a6f1b429 -88863bf80af17a9814f1ffbed6c81e7f59de5b8c71b9f571fc556cc56aee22be -1b57d48f8ca76a379847c67d0ceb43ead101355e541a57c254ae814f058a0361 -92f49d96236c88428e5f54dafefd1a5b8ca12d85cf3833d38d816c6e0e205143 -f33e353c471abc978d28d1ac89a724d5aab3e7c48015c5cd3a6f31c258cef131 -2574e692c6e495a2a8efbee785a9fe1c727379ea1fdc5b492a83a4aff7b3945a -ef503a95dc52b21474172bb54054b106342f2bde6bc38ad166c1a5c6d88685b8 -067f529741b36991352d5df1291b9e3c746a71e2bda796fdddac29d0e2f3fadf -d1f0fd33da75bc6151d3ee27f6199e76c3b9e872fb63b54ad78b0fbe2be84f10 -d7e48339c6e63364507074addc5a2bd8c4be5848c291bdb2740d3aa325c35039 -6ce28e086eecdd6256f48fb7947b84e85759b1c7e6dd91223e3f828e4253a7ec -6d987ad61bd2179c229a20e8d97e6158cb0be734227698b4695c784c463cac3e -a7d538056d5062a895f8ae64549bd58484a60363ab81bc43e6fde0ee12477051 -b53c970f063df2f0ff2fd655b7f81029be545cc841f7321d31304eeba210fdf8 -fdad7e1bc8accd4d990c058b30817e85e2c5695ab92c1e129ac7471f338fdd39 -4ede16071450c19061e07c135cbe87f01260b36206cbc169c85b9dda26fb3dff -5e7d68fd51a573402dbcc1dc7f49a1cb9c34100b9b3d0bb8b8639c69c7d47490 -ab83c8918ad03ae62eee43165e452f854d8d4132186c21f742ee4a3cc614515a -dc7c08940838538503f5c4d5781e984cad93cf7a8d17a68d678b3466afbae362 -055d5b6edb0007b59231d3040dbfec8b9782b39c391116f2037e218bfaba46c5 -2c56180aeef241d918f214b0b6480b7382875ad9dace4496c3682ea2a697b5fe -43b107d93e1976b2540dbfda2ae223bc1a84d65e0d6702513b8cc442a25fb983 -aadfa492d09e3dfd991f9f47470bb73369f634dd50dab26d129c3ba096ad7971 -1f0ee4419c1226eb8da42674b2cf77e8f4a3f76ce9e9e249b4d1fcc778ef318d -bd6778556c0f9878ebe6e8324916d78280f23f7e3921b29b42bba6ca2d780399 -ca4ed3cb2d036c9bed80b235809198422135e2d842c8f53a4dd59fe0bed889d4 -7840164024b1f668cc566978d431eb2a07a20ed06e575551e1b030db1350e94c -929a028a5dc25340e3434f2250e3f49de171bb850875d280050e495544ba71b7 -1ea36c2937ad6593e2b5bca28bc38e59cea91f26cd1ca8aa4bd9fbc1c605ae46 -ae3f559b3a6ebf89ff569ff365c3cba4b4b91f665ffda397188fe23ea456c802 -c47a8062844d404fab41a0fa83fd0dd66e4db51115f026197f4c89a1bf28246b -a9966ca2973b0f3afa43154896a56bfe2153dfaaa3ccd2ab011b7f91470cbdc0 -4af7cfe1703de7040f4d7777b068769d4035377cc7664f406b5d69356aa33045 -c4334a1e2ce602ea2b1ec666352d14b5996dad451a4cb886c66143dc25f8f1bc -f0ed253febc9733432eada35a6afc982749fa0ec680a881db06171ea37fa8338 -1ec90a6afa2f269d9da07c8f302161e26c9a4c21c2560ced811bdf6be402d36a -e2f11f884351241e779a22f8b69a8e3eeaa676e7150143a66b3a92d4dace9f4f -9b61e3f7e0aa7656c818ecfb53303457d51e74e7ec89cf038c9a73f3834383e8 -22d2f50c3a7775aa0e63b127a214db7490e488f7ee91782a90de32f4ab22601a -f7b190fcc6a292e42e2f8b69caace994b127e9f91532b6d8c3b7ce08f991d269 -220bceeed7d4e6151523e63e41bcd27154fd3a7f7370c04b1258715413ec5f17 -f51baa99e8e5cd59ac7af17daecd0e8926002403ab87a422e422a6fb1186b5bb -7db25faffedad247fd741b2461aa3b9612342142af10decefe00c00b37a667ad -7665fbc4085b5312bda690166245a93b -*/ -// public -/* on-disk format -ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC3zsBGAc4qEvDJJMuaMOuZAGaBLLFDaRk/MLK5/dSvyzAMkY8qd9ZEEPNheufIyjGMJX08TfTixBCLu+k6holLoUs1dfL3IVC8OB3L+3QsehloZv0xhKzpZ2Gt2g/CmS9shm11aZGfwi2cS/DeQFqMdtUZqipTKdxoJXdyKaXQt1OnglqJuVJ1+cAl4hU0PGyIzWaQoiH4rp72de5GTcfRGNpBBQfqXWtkid1gr9imZGSS2z4nnxp4JA24q72mxQcUyWNmUKcggef6XUcsFCiwfq5dFbZOoeKnUIUS/pq2VfhqMTSG08yh3Y6QrMXJ+6TW52dQf7q586f2jHSBQq8qNwHTGoqbdRGViqdxh7pwLtk004WvzuQjgOleDn6bwPTSM2f8dwN0Fnt/CSb7b9ttBarRz9GRgkhFsBThgVO/DR08Ox+tuyWj8dFR+baEYz2MFpD82MrQWqwq6yPb8Zo35ICgCJEDGcEW1HvZJLOZQlQ7iKD2EnlSstjhKQ8wKfVCrr6cDI42zzKWhlzWZDyJJNVm6/SXGAk5mhrAlv4e3Dtfhxv17wtNRODqJ2INIFFC4L/PZ3tNsCVTISGj8HRapNBYYzFzMleFWlzsvjrEQD0E/wzAxYt8BJBLQCElwrwqY6IOuzCcxvPmXbMBoFi42s4H5xs48/NZVDP2mxmPBw== This is a comment string -*/ -/* actual bytes (hex repr) -00000000: 00 00 00 07 73 73 68 2d 72 73 61 00 00 00 03 01 ....ssh-rsa..... -00000010: 00 01 00 00 02 01 00 b7 ce c0 46 01 ce 2a 12 f0 ..........F..*.. -00000020: c9 24 cb 9a 30 eb 99 00 66 81 2c b1 43 69 19 3f .$..0...f.,.Ci.? -00000030: 30 b2 b9 fd d4 af cb 30 0c 91 8f 2a 77 d6 44 10 0......0...*w.D. -00000040: f3 61 7a e7 c8 ca 31 8c 25 7d 3c 4d f4 e2 c4 10 .az...1.%}'..x$ -000000d0: 0d b8 ab bd a6 c5 07 14 c9 63 66 50 a7 20 81 e7 .........cfP. .. -000000e0: fa 5d 47 2c 14 28 b0 7e ae 5d 15 b6 4e a1 e2 a7 .]G,.(.~.]..N... -000000f0: 50 85 12 fe 9a b6 55 f8 6a 31 34 86 d3 cc a1 dd P.....U.j14..... -00000100: 8e 90 ac c5 c9 fb a4 d6 e7 67 50 7f ba b9 f3 a7 .........gP..... -00000110: f6 8c 74 81 42 af 2a 37 01 d3 1a 8a 9b 75 11 95 ..t.B.*7.....u.. -00000120: 8a a7 71 87 ba 70 2e d9 34 d3 85 af ce e4 23 80 ..q..p..4.....#. -00000130: e9 5e 0e 7e 9b c0 f4 d2 33 67 fc 77 03 74 16 7b .^.~....3g.w.t.{ -00000140: 7f 09 26 fb 6f db 6d 05 aa d1 cf d1 91 82 48 45 ..&.o.m.......HE -00000150: b0 14 e1 81 53 bf 0d 1d 3c 3b 1f ad bb 25 a3 f1 ....S...<;...%.. -00000160: d1 51 f9 b6 84 63 3d 8c 16 90 fc d8 ca d0 5a ac .Q...c=.......Z. -00000170: 2a eb 23 db f1 9a 37 e4 80 a0 08 91 03 19 c1 16 *.#...7......... -00000180: d4 7b d9 24 b3 99 42 54 3b 88 a0 f6 12 79 52 b2 .{.$..BT;....yR. -00000190: d8 e1 29 0f 30 29 f5 42 ae be 9c 0c 8e 36 cf 32 ..).0).B.....6.2 -000001a0: 96 86 5c d6 64 3c 89 24 d5 66 eb f4 97 18 09 39 ..\.d<.$.f.....9 -000001b0: 9a 1a c0 96 fe 1e dc 3b 5f 87 1b f5 ef 0b 4d 44 .......;_.....MD -000001c0: e0 ea 27 62 0d 20 51 42 e0 bf cf 67 7b 4d b0 25 ..'b. QB...g{M.% -000001d0: 53 21 21 a3 f0 74 5a a4 d0 58 63 31 73 32 57 85 S!!..tZ..Xc1s2W. -000001e0: 5a 5c ec be 3a c4 40 3d 04 ff 0c c0 c5 8b 7c 04 Z\..:.@=......|. -000001f0: 90 4b 40 21 25 c2 bc 2a 63 a2 0e bb 30 9c c6 f3 .K@!%..*c...0... -00000200: e6 5d b3 01 a0 58 b8 da ce 07 e7 1b 38 f3 f3 59 .]...X......8..Y -00000210: 54 33 f6 9b 19 8f 07 T3..... -// -00000007 7 -7373682d727361 "ssh-rsa" -00000003 3 -010001 65537 -00000201 513 -00b7cec04601ce2a12f0c924cb9a30eb990066812cb14369193f30b2b9fdd4af ((32*16) + 1) bytes (513 bytes) modulus (ASN.1 format) -cb300c918f2a77d64410f3617ae7c8ca318c257d3c4df4e2c4108bbbe93a8689 -4ba14b3575f2f72150bc381dcbfb742c7a196866fd3184ace96761adda0fc299 -2f6c866d7569919fc22d9c4bf0de405a8c76d519aa2a5329dc6825777229a5d0 -b753a7825a89b95275f9c025e215343c6c88cd6690a221f8ae9ef675ee464dc7 -d118da410507ea5d6b6489dd60afd8a6646492db3e279f1a78240db8abbda6c5 -0714c9636650a72081e7fa5d472c1428b07eae5d15b64ea1e2a7508512fe9ab6 -55f86a313486d3cca1dd8e90acc5c9fba4d6e767507fbab9f3a7f68c748142af -2a3701d31a8a9b7511958aa77187ba702ed934d385afcee42380e95e0e7e9bc0 -f4d23367fc770374167b7f0926fb6fdb6d05aad1cfd191824845b014e18153bf -0d1d3c3b1fadbb25a3f1d151f9b684633d8c1690fcd8cad05aac2aeb23dbf19a -37e480a008910319c116d47bd924b39942543b88a0f6127952b2d8e1290f3029 -f542aebe9c0c8e36cf3296865cd6643c8924d566ebf4971809399a1ac096fe1e -dc3b5f871bf5ef0b4d44e0ea27620d205142e0bfcf677b4db025532121a3f074 -5aa4d0586331733257855a5cecbe3ac4403d04ff0cc0c58b7c04904b402125c2 -bc2a63a20ebb309cc6f3e65db301a058b8dace07e71b38f3f3595433f69b198f -07 +/* +Same key as private.rsa example. */ func main() { diff --git a/sshkeys/ref/encrypted/private.ed25519 b/sshkeys/ref/encrypted/private.ed25519 index fab9dd8..5d71078 100644 --- a/sshkeys/ref/encrypted/private.ed25519 +++ b/sshkeys/ref/encrypted/private.ed25519 @@ -87,9 +87,18 @@ ANNOTATED HEX: DECRYPTED 4.0.1: (...) 4.0.1 000000a0 (160) - 4.0.1.0 - 4.0.1.1 - 4.0.1.2 - 4.0.2.3 - 4.0.2.4 - 4.0.2.5 \ No newline at end of file + 4.0.1.0 f890d89a (4170242202) + 4.0.1.1 f890d89a (4170242202) + 4.0.1.2 - + 4.0.1.2.0 0000000b (11) + 4.0.1.2.0.0 7373682d65643235353139 ("ssh-ed25519") + 4.0.1.2.1 00000020 (32) + 4.0.1.2.1.0 (bytes) + bfa2031aa5463113e40e16896af503c5299ead76b09cb63846f41cc4de1740f6 + 4.0.1.3 00000040 (64) + 4.0.1.3.0 (bytes) + ce6e2b8d638c9d5219dff455af1a90d0a5b72694cfcedfb93bc1e1b1816dee98 + bfa2031aa5463113e40e16896af503c5299ead76b09cb63846f41cc4de1740f6 + 4.0.1.4 00000012 (18) + 4.0.1.4.0 5468697320697320612074657374206b6579 ("This is a test key") + 4.0.1.5 0102030405060708090a0b ([1 2 3 4 5 6 7 8 9 10 11], 11 bytes) diff --git a/sshkeys/ref/encrypted/private.rsa b/sshkeys/ref/encrypted/private.rsa index 063cb24..f435957 100644 --- a/sshkeys/ref/encrypted/private.rsa +++ b/sshkeys/ref/encrypted/private.rsa @@ -253,22 +253,14 @@ ANNOTATED HEX: 4.0.0.1.0 010001 (65537) 4.0.0.2 00000201 (513) 4.0.0.2.0 (bytes) - 00b7cec04601ce2a12f0c924cb9a30eb990066812cb14369193f30b2b9fdd4af - cb300c918f2a77d64410f3617ae7c8ca318c257d3c4df4e2c4108bbbe93a8689 - 4ba14b3575f2f72150bc381dcbfb742c7a196866fd3184ace96761adda0fc299 - 2f6c866d7569919fc22d9c4bf0de405a8c76d519aa2a5329dc6825777229a5d0 - b753a7825a89b95275f9c025e215343c6c88cd6690a221f8ae9ef675ee464dc7 - d118da410507ea5d6b6489dd60afd8a6646492db3e279f1a78240db8abbda6c5 - 0714c9636650a72081e7fa5d472c1428b07eae5d15b64ea1e2a7508512fe9ab6 - 55f86a313486d3cca1dd8e90acc5c9fba4d6e767507fbab9f3a7f68c748142af - 2a3701d31a8a9b7511958aa77187ba702ed934d385afcee42380e95e0e7e9bc0 - f4d23367fc770374167b7f0926fb6fdb6d05aad1cfd191824845b014e18153bf - 0d1d3c3b1fadbb25a3f1d151f9b684633d8c1690fcd8cad05aac2aeb23dbf19a - 37e480a008910319c116d47bd924b39942543b88a0f6127952b2d8e1290f3029 - f542aebe9c0c8e36cf3296865cd6643c8924d566ebf4971809399a1ac096fe1e - dc3b5f871bf5ef0b4d44e0ea27620d205142e0bfcf677b4db025532121a3f074 - 5aa4d0586331733257855a5cecbe3ac4403d04ff0cc0c58b7c04904b402125c2 - bc2a63a20ebb309cc6f3e65db301a058b8dace07e71b38f3f3595433f69b198f + 00b7cec04601ce2a12f0c924cb9a30eb990066812cb14369193f30b2b9fdd4afcb300c918f2a77d64410f3617ae7c8ca318c257d3c4df4e2c4108bbbe93a8689 + 4ba14b3575f2f72150bc381dcbfb742c7a196866fd3184ace96761adda0fc2992f6c866d7569919fc22d9c4bf0de405a8c76d519aa2a5329dc6825777229a5d0 + b753a7825a89b95275f9c025e215343c6c88cd6690a221f8ae9ef675ee464dc7d118da410507ea5d6b6489dd60afd8a6646492db3e279f1a78240db8abbda6c5 + 0714c9636650a72081e7fa5d472c1428b07eae5d15b64ea1e2a7508512fe9ab655f86a313486d3cca1dd8e90acc5c9fba4d6e767507fbab9f3a7f68c748142af + 2a3701d31a8a9b7511958aa77187ba702ed934d385afcee42380e95e0e7e9bc0f4d23367fc770374167b7f0926fb6fdb6d05aad1cfd191824845b014e18153bf + 0d1d3c3b1fadbb25a3f1d151f9b684633d8c1690fcd8cad05aac2aeb23dbf19a37e480a008910319c116d47bd924b39942543b88a0f6127952b2d8e1290f3029 + f542aebe9c0c8e36cf3296865cd6643c8924d566ebf4971809399a1ac096fe1edc3b5f871bf5ef0b4d44e0ea27620d205142e0bfcf677b4db025532121a3f074 + 5aa4d0586331733257855a5cecbe3ac4403d04ff0cc0c58b7c04904b402125c2bc2a63a20ebb309cc6f3e65db301a058b8dace07e71b38f3f3595433f69b198f 07 4.0.1 00000750 (1872) 4.0.1.0 - 4.0.1.8 (AES256-CTR encrypted block) (bytes) @@ -303,7 +295,58 @@ ANNOTATED HEX: f51baa99e8e5cd59ac7af17daecd0e8926002403ab87a422e422a6fb1186b5bb7db25faffedad247fd741b2461aa3b9612342142af10decefe00c00b37a667ad 7665fbc4085b5312bda690166245a93b + DECRYPTED 4.0.1: (...) 4.0.1 00000750 (1872) - 4.0.1.0 \ No newline at end of file + 4.0.1.0 0d98bd61 (228113761) + 4.0.1.1 0d98bd61 (228113761) + 4.0.1.2 - + 4.0.1.2.0 00000007 (7) + 4.0.1.2.0.0 7373682d727361 ("ssh-rsa") + 4.0.1.2.1 00000201 (513) + 4.0.1.2.1.0 (bytes) + 00b7cec04601ce2a12f0c924cb9a30eb990066812cb14369193f30b2b9fdd4afcb300c918f2a77d64410f3617ae7c8ca318c257d3c4df4e2c4108bbbe93a8689 + 4ba14b3575f2f72150bc381dcbfb742c7a196866fd3184ace96761adda0fc2992f6c866d7569919fc22d9c4bf0de405a8c76d519aa2a5329dc6825777229a5d0 + b753a7825a89b95275f9c025e215343c6c88cd6690a221f8ae9ef675ee464dc7d118da410507ea5d6b6489dd60afd8a6646492db3e279f1a78240db8abbda6c5 + 0714c9636650a72081e7fa5d472c1428b07eae5d15b64ea1e2a7508512fe9ab655f86a313486d3cca1dd8e90acc5c9fba4d6e767507fbab9f3a7f68c748142af + 2a3701d31a8a9b7511958aa77187ba702ed934d385afcee42380e95e0e7e9bc0f4d23367fc770374167b7f0926fb6fdb6d05aad1cfd191824845b014e18153bf + 0d1d3c3b1fadbb25a3f1d151f9b684633d8c1690fcd8cad05aac2aeb23dbf19a37e480a008910319c116d47bd924b39942543b88a0f6127952b2d8e1290f3029 + f542aebe9c0c8e36cf3296865cd6643c8924d566ebf4971809399a1ac096fe1edc3b5f871bf5ef0b4d44e0ea27620d205142e0bfcf677b4db025532121a3f074 + 5aa4d0586331733257855a5cecbe3ac4403d04ff0cc0c58b7c04904b402125c2bc2a63a20ebb309cc6f3e65db301a058b8dace07e71b38f3f3595433f69b198f + 07 + 4.0.1.2.2 00000003 (3) + 4.0.1.2.2.0 010001 (65537) + 4.0.1.3 00000200 (512) + 4.0.1.3.0 (bytes) + 499f2c705e04bfe17a4476d27e5e1ddfd8c335f63ac22f748754f02183440f6da93f3f86429261663e0bddfda69d4c2f705d0bbe7dd31a8941bf5672e29844a1 + e0670970c6f2a98b76f85b26fafedb59c49786b8df7eaeeb86171fd579fe8df0eadd2536a4244a0332d5a9ad3eb8340c930464153e82b4ffad4f647a7ba808e3 + 854450f806b60e0b670fc99cb6b58786497d4c199e7750ee5089934eef25f46512394955c487e10744ebdb9a00951c8095b024d4ce75f1da3146b5b3447169f5 + 9e23d40685438bc7bcad1173927a389a0903ba111a46809d123b3432197cca8fc0c27816fbf215c2b7c584b94f37c9ed8a8e815942effdcf54757268afe58fd7 + 00cdcf6a98a20950617b0624aa835d95e27d7afcdee70c397ca1b6aa04735e6d5c5e01bfff2174cf562d36842624490e12ca8142595d52567494f38b2124012c + acacb2564e21c845eb94f5d6ebf6f39066e1fa04b318174e6f9994823ba4d9ef2c28b37cb3ea05fa3cad7200898394276835523e4e416054f23db0eb732211d3 + a11ea551390ae8d58d69e14664e0e20f2bf0ccd24d260b832a94144f5801ea7cdbb2436f21ba2dbaecbcd573f24c5e0d43fd26b4ae6764e138ddaf4775ac0163 + e45727c10027f716cbe3cc70fff73441bb2538e5426a1a5638b448a7bde968041ec2184ef67b0da60070297cd73deeefebd1951611c7a776c956e18e5f163a21 + 4.0.1.4 00000100 (256) + 4.0.1.4.0 (bytes) + 0ae2e1cf2455a0d82272e6a42bbba83eb765496e5a33e13b8c94756d8c32f7d7505fd997bdd5ec08c59bf8d1d659d1df02bec669ebb5aaaf5db1ec70ce2f2a6b + 3a17b7b1fce3adc6203c2905cd652d7622065dd011ae33894467c6dca3643952b0caedff9bc78ac40408074027566ee4c4751ad3ff452a2781af8b5c2c9bf09b + 34ee5e6201330b4bc381af766798667c5b9ad0733c19f4ef475fd264655e030553f2f2f8de59c2aee74b9dd6720e3108143dfedd41cf4bc11de2b9a9f40faec7 + 2a52312abee4c6155acfee9384a16348c715346ebe693895fe6d2348d4dedb0a137c487185ff949c209115b9c8a106329991f049e8430c7ba60dd5408d72ac98 + 4.0.1.5 00000101 (257) + 4.0.1.5.0 (bytes) + 00e50b65ba6ae4cb29ae66129c3e41ffeba36cd6ecbaa7045ff90cea71d09bc056b0b9134dc5754c49da1fe8ab169cd149eedaeccf4913d915f4f241c5fd86c7 + 7511e0c261c344600a84cce78e8cf493e492844cb82c42ab6d1246a53e5cf50ad4759c2a5c09d53b1c5c3b449328eea01434d6e537b3a513928dfaddf0a72728 + 23899b8d795220cb3344ab8d0e846e1e40ffdfb5c719262c2b527a890a51faabcf10904699135f7b997487f4b48d4490ad80fc25b346fa0bb587f09295bf0f71 + ac10a8086867d4bad00a0c27a6456f08e0c2bf8caed8768f0366a2440428180a292617af61feabab9a7075b8bc21209a5439bbfe3613917071fee74a8d5d80fe + 99 + 4.0.1.6 00000101 (257) + 4.0.1.6.0 (bytes) + 00cd7077659fad983104bcc7dc526242b9ea52cea40e923df771ac2a28e377f2b9231a58c2448c6b8d17fe83571ef6bdbbc11f3d4ab4254ea859684b8772911f + 9c6f355479053e3e3d3a6ecce13a016908298ca3f8b628d2111749a3627628eb05844f546795a5067d39b1d304e19cc6fc1be00a6164ea33e4abbc87f5683227 + 1d825c868c5ccda3775b037711e99436f96c53f3780b985084e1d84a458c687ab0938a09bf6f9b3ffec41ed02fd5b27572c7d180039e405a559b62fc08f804b1 + 9f043dba4c6f7565b1c72759f4b932d4f93d4f41da91b1b146f29854a1008341e4760bdd4987097ec4a6551ab96e099a04a38d6a893b533db185abb55736419e + 9f + 4.0.1.7 00000018 (24) + 4.0.1.7.0 54686973206973206120636f6d6d656e7420737472696e67 ("This is a comment string") + 4.0.1.8 010203 ([1 2 3], 3 bytes) \ No newline at end of file diff --git a/sshkeys/ref/encrypted/public.rsa b/sshkeys/ref/encrypted/public.rsa index f7a49a9..6d57a9c 100644 --- a/sshkeys/ref/encrypted/public.rsa +++ b/sshkeys/ref/encrypted/public.rsa @@ -16,11 +16,69 @@ along with this program. If not, see . ############################################################################# -The following uses the bcrypt encryption. The passphrase is "test". +The following uses the bcrypt encryption (4096-bit). The passphrase is "test". PEM: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC3zsBGAc4qEvDJJMuaMOuZAGaBLLFDaRk/MLK5/dSvyzAMkY8qd9ZEEPNheufIyjGMJX08TfTixBCLu+k6holLoUs1dfL3IVC8OB3L+3QsehloZv0xhKzpZ2Gt2g/CmS9shm11aZGfwi2cS/DeQFqMdtUZqipTKdxoJXdyKaXQt1OnglqJuVJ1+cAl4hU0PGyIzWaQoiH4rp72de5GTcfRGNpBBQfqXWtkid1gr9imZGSS2z4nnxp4JA24q72mxQcUyWNmUKcggef6XUcsFCiwfq5dFbZOoeKnUIUS/pq2VfhqMTSG08yh3Y6QrMXJ+6TW52dQf7q586f2jHSBQq8qNwHTGoqbdRGViqdxh7pwLtk004WvzuQjgOleDn6bwPTSM2f8dwN0Fnt/CSb7b9ttBarRz9GRgkhFsBThgVO/DR08Ox+tuyWj8dFR+baEYz2MFpD82MrQWqwq6yPb8Zo35ICgCJEDGcEW1HvZJLOZQlQ7iKD2EnlSstjhKQ8wKfVCrr6cDI42zzKWhlzWZDyJJNVm6/SXGAk5mhrAlv4e3Dtfhxv17wtNRODqJ2INIFFC4L/PZ3tNsCVTISGj8HRapNBYYzFzMleFWlzsvjrEQD0E/wzAxYt8BJBLQCElwrwqY6IOuzCcxvPmXbMBoFi42s4H5xs48/NZVDP2mxmPBw== This is a comment string HEX: +00000000: 0000 0007 7373 682d 7273 6100 0000 0301 ....ssh-rsa..... +00000010: 0001 0000 0201 00b7 cec0 4601 ce2a 12f0 ..........F..*.. +00000020: c924 cb9a 30eb 9900 6681 2cb1 4369 193f .$..0...f.,.Ci.? +00000030: 30b2 b9fd d4af cb30 0c91 8f2a 77d6 4410 0......0...*w.D. +00000040: f361 7ae7 c8ca 318c 257d 3c4d f4e2 c410 .az...1.%}'..x$ +000000d0: 0db8 abbd a6c5 0714 c963 6650 a720 81e7 .........cfP. .. +000000e0: fa5d 472c 1428 b07e ae5d 15b6 4ea1 e2a7 .]G,.(.~.]..N... +000000f0: 5085 12fe 9ab6 55f8 6a31 3486 d3cc a1dd P.....U.j14..... +00000100: 8e90 acc5 c9fb a4d6 e767 507f bab9 f3a7 .........gP..... +00000110: f68c 7481 42af 2a37 01d3 1a8a 9b75 1195 ..t.B.*7.....u.. +00000120: 8aa7 7187 ba70 2ed9 34d3 85af cee4 2380 ..q..p..4.....#. +00000130: e95e 0e7e 9bc0 f4d2 3367 fc77 0374 167b .^.~....3g.w.t.{ +00000140: 7f09 26fb 6fdb 6d05 aad1 cfd1 9182 4845 ..&.o.m.......HE +00000150: b014 e181 53bf 0d1d 3c3b 1fad bb25 a3f1 ....S...<;...%.. +00000160: d151 f9b6 8463 3d8c 1690 fcd8 cad0 5aac .Q...c=.......Z. +00000170: 2aeb 23db f19a 37e4 80a0 0891 0319 c116 *.#...7......... +00000180: d47b d924 b399 4254 3b88 a0f6 1279 52b2 .{.$..BT;....yR. +00000190: d8e1 290f 3029 f542 aebe 9c0c 8e36 cf32 ..).0).B.....6.2 +000001a0: 9686 5cd6 643c 8924 d566 ebf4 9718 0939 ..\.d<.$.f.....9 +000001b0: 9a1a c096 fe1e dc3b 5f87 1bf5 ef0b 4d44 .......;_.....MD +000001c0: e0ea 2762 0d20 5142 e0bf cf67 7b4d b025 ..'b. QB...g{M.% +000001d0: 5321 21a3 f074 5aa4 d058 6331 7332 5785 S!!..tZ..Xc1s2W. +000001e0: 5a5c ecbe 3ac4 403d 04ff 0cc0 c58b 7c04 Z\..:.@=......|. +000001f0: 904b 4021 25c2 bc2a 63a2 0ebb 309c c6f3 .K@!%..*c...0... +00000200: e65d b301 a058 b8da ce07 e71b 38f3 f359 .]...X......8..Y +00000210: 5433 f69b 198f 07 T3..... + ANNOTATED HEX: +0 00000007 (7) + 0.0 7373682d727361 ("ssh-rsa") +1 00000003 (3) + 1.0 010001 (65537) +2 00000201 (513) + 2.0 (bytes) + 00b7cec04601ce2a12f0c924cb9a30eb990066812cb14369193f30b2b9fdd4af + cb300c918f2a77d64410f3617ae7c8ca318c257d3c4df4e2c4108bbbe93a8689 + 4ba14b3575f2f72150bc381dcbfb742c7a196866fd3184ace96761adda0fc299 + 2f6c866d7569919fc22d9c4bf0de405a8c76d519aa2a5329dc6825777229a5d0 + b753a7825a89b95275f9c025e215343c6c88cd6690a221f8ae9ef675ee464dc7 + d118da410507ea5d6b6489dd60afd8a6646492db3e279f1a78240db8abbda6c5 + 0714c9636650a72081e7fa5d472c1428b07eae5d15b64ea1e2a7508512fe9ab6 + 55f86a313486d3cca1dd8e90acc5c9fba4d6e767507fbab9f3a7f68c748142af + 2a3701d31a8a9b7511958aa77187ba702ed934d385afcee42380e95e0e7e9bc0 + f4d23367fc770374167b7f0926fb6fdb6d05aad1cfd191824845b014e18153bf + 0d1d3c3b1fadbb25a3f1d151f9b684633d8c1690fcd8cad05aac2aeb23dbf19a + 37e480a008910319c116d47bd924b39942543b88a0f6127952b2d8e1290f3029 + f542aebe9c0c8e36cf3296865cd6643c8924d566ebf4971809399a1ac096fe1e + dc3b5f871bf5ef0b4d44e0ea27620d205142e0bfcf677b4db025532121a3f074 + 5aa4d0586331733257855a5cecbe3ac4403d04ff0cc0c58b7c04904b402125c2 + bc2a63a20ebb309cc6f3e65db301a058b8dace07e71b38f3f3595433f69b198f + 07 \ No newline at end of file diff --git a/sshkeys/ref/plain/private.rsa b/sshkeys/ref/plain/private.rsa index c085e5a..9644a41 100644 --- a/sshkeys/ref/plain/private.rsa +++ b/sshkeys/ref/plain/private.rsa @@ -343,4 +343,4 @@ ANNOTATED HEX: 9f 4.0.1.7 00000018 (24) 4.0.1.7.0 54686973206973206120636f6d6d656e7420737472696e67 ("This is a comment string") - 4.0.1.8 010203 (padding) \ No newline at end of file + 4.0.1.8 010203 ([1 2 3], 3 bytes) \ No newline at end of file diff --git a/sshkeys/ref/plain/public.rsa b/sshkeys/ref/plain/public.rsa index 18a99b7..61b6d1c 100644 --- a/sshkeys/ref/plain/public.rsa +++ b/sshkeys/ref/plain/public.rsa @@ -16,3 +16,72 @@ along with this program. If not, see . ############################################################################# +The following is a plaintext pubkey (no passphrase provided) (4096-bit). + +Keys in the "PEM" (.pub) format are prefixed with the key type string and suffixed with the comment string. + +All length ints are uint32, network-byte order. + +PEM: +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC3zsBGAc4qEvDJJMuaMOuZAGaBLLFDaRk/MLK5/dSvyzAMkY8qd9ZEEPNheufIyjGMJX08TfTixBCLu+k6holLoUs1dfL3IVC8OB3L+3QsehloZv0xhKzpZ2Gt2g/CmS9shm11aZGfwi2cS/DeQFqMdtUZqipTKdxoJXdyKaXQt1OnglqJuVJ1+cAl4hU0PGyIzWaQoiH4rp72de5GTcfRGNpBBQfqXWtkid1gr9imZGSS2z4nnxp4JA24q72mxQcUyWNmUKcggef6XUcsFCiwfq5dFbZOoeKnUIUS/pq2VfhqMTSG08yh3Y6QrMXJ+6TW52dQf7q586f2jHSBQq8qNwHTGoqbdRGViqdxh7pwLtk004WvzuQjgOleDn6bwPTSM2f8dwN0Fnt/CSb7b9ttBarRz9GRgkhFsBThgVO/DR08Ox+tuyWj8dFR+baEYz2MFpD82MrQWqwq6yPb8Zo35ICgCJEDGcEW1HvZJLOZQlQ7iKD2EnlSstjhKQ8wKfVCrr6cDI42zzKWhlzWZDyJJNVm6/SXGAk5mhrAlv4e3Dtfhxv17wtNRODqJ2INIFFC4L/PZ3tNsCVTISGj8HRapNBYYzFzMleFWlzsvjrEQD0E/wzAxYt8BJBLQCElwrwqY6IOuzCcxvPmXbMBoFi42s4H5xs48/NZVDP2mxmPBw== This is a comment string + +HEX: +00000000: 0000 0007 7373 682d 7273 6100 0000 0301 ....ssh-rsa..... +00000010: 0001 0000 0201 00b7 cec0 4601 ce2a 12f0 ..........F..*.. +00000020: c924 cb9a 30eb 9900 6681 2cb1 4369 193f .$..0...f.,.Ci.? +00000030: 30b2 b9fd d4af cb30 0c91 8f2a 77d6 4410 0......0...*w.D. +00000040: f361 7ae7 c8ca 318c 257d 3c4d f4e2 c410 .az...1.%}'..x$ +000000d0: 0db8 abbd a6c5 0714 c963 6650 a720 81e7 .........cfP. .. +000000e0: fa5d 472c 1428 b07e ae5d 15b6 4ea1 e2a7 .]G,.(.~.]..N... +000000f0: 5085 12fe 9ab6 55f8 6a31 3486 d3cc a1dd P.....U.j14..... +00000100: 8e90 acc5 c9fb a4d6 e767 507f bab9 f3a7 .........gP..... +00000110: f68c 7481 42af 2a37 01d3 1a8a 9b75 1195 ..t.B.*7.....u.. +00000120: 8aa7 7187 ba70 2ed9 34d3 85af cee4 2380 ..q..p..4.....#. +00000130: e95e 0e7e 9bc0 f4d2 3367 fc77 0374 167b .^.~....3g.w.t.{ +00000140: 7f09 26fb 6fdb 6d05 aad1 cfd1 9182 4845 ..&.o.m.......HE +00000150: b014 e181 53bf 0d1d 3c3b 1fad bb25 a3f1 ....S...<;...%.. +00000160: d151 f9b6 8463 3d8c 1690 fcd8 cad0 5aac .Q...c=.......Z. +00000170: 2aeb 23db f19a 37e4 80a0 0891 0319 c116 *.#...7......... +00000180: d47b d924 b399 4254 3b88 a0f6 1279 52b2 .{.$..BT;....yR. +00000190: d8e1 290f 3029 f542 aebe 9c0c 8e36 cf32 ..).0).B.....6.2 +000001a0: 9686 5cd6 643c 8924 d566 ebf4 9718 0939 ..\.d<.$.f.....9 +000001b0: 9a1a c096 fe1e dc3b 5f87 1bf5 ef0b 4d44 .......;_.....MD +000001c0: e0ea 2762 0d20 5142 e0bf cf67 7b4d b025 ..'b. QB...g{M.% +000001d0: 5321 21a3 f074 5aa4 d058 6331 7332 5785 S!!..tZ..Xc1s2W. +000001e0: 5a5c ecbe 3ac4 403d 04ff 0cc0 c58b 7c04 Z\..:.@=......|. +000001f0: 904b 4021 25c2 bc2a 63a2 0ebb 309c c6f3 .K@!%..*c...0... +00000200: e65d b301 a058 b8da ce07 e71b 38f3 f359 .]...X......8..Y +00000210: 5433 f69b 198f 07 T3..... + +ANNOTATED HEX: +0 00000007 (7) + 0.0 7373682d727361 ("ssh-rsa") +1 00000003 (3) + 1.1 010001 (65537) +2 00000201 (513) + 2.0 (bytes) + 00b7cec04601ce2a12f0c924cb9a30eb990066812cb14369193f30b2b9fdd4af + cb300c918f2a77d64410f3617ae7c8ca318c257d3c4df4e2c4108bbbe93a8689 + 4ba14b3575f2f72150bc381dcbfb742c7a196866fd3184ace96761adda0fc299 + 2f6c866d7569919fc22d9c4bf0de405a8c76d519aa2a5329dc6825777229a5d0 + b753a7825a89b95275f9c025e215343c6c88cd6690a221f8ae9ef675ee464dc7 + d118da410507ea5d6b6489dd60afd8a6646492db3e279f1a78240db8abbda6c5 + 0714c9636650a72081e7fa5d472c1428b07eae5d15b64ea1e2a7508512fe9ab6 + 55f86a313486d3cca1dd8e90acc5c9fba4d6e767507fbab9f3a7f68c748142af + 2a3701d31a8a9b7511958aa77187ba702ed934d385afcee42380e95e0e7e9bc0 + f4d23367fc770374167b7f0926fb6fdb6d05aad1cfd191824845b014e18153bf + 0d1d3c3b1fadbb25a3f1d151f9b684633d8c1690fcd8cad05aac2aeb23dbf19a + 37e480a008910319c116d47bd924b39942543b88a0f6127952b2d8e1290f3029 + f542aebe9c0c8e36cf3296865cd6643c8924d566ebf4971809399a1ac096fe1e + dc3b5f871bf5ef0b4d44e0ea27620d205142e0bfcf677b4db025532121a3f074 + 5aa4d0586331733257855a5cecbe3ac4403d04ff0cc0c58b7c04904b402125c2 + bc2a63a20ebb309cc6f3e65db301a058b8dace07e71b38f3f3595433f69b198f + 07 diff --git a/sshkeys/rsa.go b/sshkeys/rsa.go index a800729..5ecb912 100644 --- a/sshkeys/rsa.go +++ b/sshkeys/rsa.go @@ -35,7 +35,7 @@ func (k *SSHPrivKey) generateRsa() error { } else { k.Key = sk // See https://golang.org/pkg/crypto/rsa/#PrivateKey k.PublicKey.KeyType = KeyRsa - k.PublicKey.Key = k.Key.PublicKey + k.PublicKey.Key = sk.PublicKey } return nil } diff --git a/sshkeys/struct.go b/sshkeys/struct.go index 6253856..8fb0245 100644 --- a/sshkeys/struct.go +++ b/sshkeys/struct.go @@ -31,14 +31,14 @@ type EncryptedSSHKeyV1 struct { Passphrase []byte } -// SSHEncryptionKey contains the PublicKey and PrivateKey bytes (as derived by KDF, different from the actual SSH keypair), +// SSHCrypt contains the encryption object Stream, the cipher object Cipher, the ephemeral salt (CryptSalt), and the ephemeral key (CryptKey). // the Cipher, and the stream. type SSHCrypt struct { Stream cipher.Stream Cipher cipher.Block - CryptSalt []byte - PrivateKey []byte - CryptKey []byte + PrivateKey []byte // encryption key + CryptSalt []byte // ephemeral salt + CryptKey []byte // ephemeral key (not really used) } // SSHKDFOpts contains a set of KDF options. @@ -56,7 +56,6 @@ type SSHKeyV1 struct { KDFName string CipherName string KeySize uint32 - BlockSize uint32 Keys []SSHPrivKey // 1 by default. Buffer bytes.Buffer } @@ -71,6 +70,7 @@ type SSHPubKey struct { type SSHPrivKey struct { PublicKey *SSHPubKey BitSize uint32 + BlockSize int Key interface{} // ED25519 keys are actually "sk + pk", where sk is the secret key and pk is the pubkey. // We store that here.