OpenSSH private key encryption: time for AES?

[Damien Miller]

On Tue, 20 Jan 2009, Jim Knoble wrote:

> Circa 2009-01-20 02:30 dixit Damien Miller:
> 
> : On Tue, 20 Jan 2009, Jim Knoble wrote:
> : 
> : > [...]how can i encrypt my 4096-bit SSH RSA keypair with
> : > something like AES-128, AES-256, or Twofish instead of 3DES and still
> : > use it with OpenSSH?  Can ssh-add read (unencrypted) key data from stdin?
> 
> Experimentation has shown that the following will add a key to a running
> ssh-agent (OpenSSH_4.6p1, Ubuntu 7.10):
> 
>     $ cat id_rsa-unencrypted |ssh-add /dev/stdin
>     $ ssh-add -l |fgrep /dev/stdin
>     2048 xx:xx:xx:...:xx:xx:xx /dev/stdin (RSA)
>     $ 
> 
> However, the following will not remove the key from the agent:
> 
>     $ cat id_rsa-unencrypted |ssh-add -d /dev/stdin
>     Bad key file /dev/stdin
>     $ 

Does that work without the patch? I don't think it would even with
the current cipher because it needs to reread the file IIRC.

> If both operations worked, then one could use an external
> encryption/decryption facility with one's private keys, e.g.:
> 
>     openssl enc -d -in ~/.ssh/id_rsa -aes-256-cbc |ssh-add /dev/stdin
> 
> (although it would take a passphrase to remove a key from ssh-agent).

Wouldn't this just require the former to work? You'd be passing keys
to ssh-agent in unencrypted form always, no?

> : If you want to change it then you can do something like [a one-liner
> : change to authfile.c]. It probably wouldn't hurt to change - new
> : installations will still be able to read old keys
> 
> It would be nice for newer OpenSSH to be able to produce private keys
> usable by older OpenSSH as well.

The key encryption for SSH protocol 2 keys is done by OpenSSL's PEM
functions, so AES should be supported by any OpenSSL version that supports
AES in PEM. IIRC this has been supported for a number of years.

> Any chance of an option in ssh-keygen to specify the cipher?  E.g.:

No, I think that would be a microknob that add little value, and ssh-add
has waaaay to many buttons already.

If we change then it should be to the best encryption that is supported by
widely deployed SSL/OpenSSH versions.

-d