Hello,
Two issues I wanted to report (I believe related to #37) that I have recently experienced on my mac (catalina) when using ssh-vault:
how to reproduce the issue:
ssh-keygen -t rsa -b 4096 -C "[email protected]"(gitlab example)
ssh-vault -k id_rsa.pub create < file > file.vault
ssh-vault -k id_rsa view file.vault
output:
enter passphrase:
could not parse private key: ssh: this private key is passphrase protected
analysis:
When having a passphrase protected key, and no usual PEM header (no dek-info section as tested by x509.IsEncryptedPEMBlock()), it goes through ssh.ParseRawPrivateKey() instead of ssh.ParseRawPrivateKeyWithPassphrase().
However without password it works fine since it goes through ssh.ParseRawPrivateKey and when -k parameter is the private key ssh-keygen -yf works, if -k is a public key it works too (when both are in local and in the same directory).
proposal:
Either decode the header of the openSSH format private key that should contain something like this when encrypted:
openssh-key-v1
aes256-ctr bcrypt
Or when having a block.Type of "OPENSSH PRIVATE KEY" trying ssh.ParseRawPrivateKey() followed by
ssh.ParseRawPrivateKeyWithPassphrase() when the first is not successful.
Also a second issue appears due to -k parameter. Indeed the usage of ssh-keygen -yf doesn't deal well with passphrase protection. So it works when having the public key as parameter but not the private one. (when both are in local and in the same directory).
how to reproduce the issue:
ssh-keygen -t rsa -b 4096 -C "[email protected]" -m PEM([gitlab example]
analysis:
I don't know why we need to extract sometimes the public key from the private one. -k parameter as showed by the command helper is a public key so I am not quite sure why we are passing the private key sometimes even though that is the private key which is needed to decrypt.
// use private key only
if strings.HasSuffix(v.key, ".pub") {
v.key = strings.Trim(v.key, ".pub")
}
proposal:
Either decoding the private key and the public from it without using ssh-keygen as already mentionned in the TODO or perhaps adding another parameter to distinguish between public and private keys. Another option could also be to add the suffix pub and get it.
Thanks for the great work and your help !
