Subject: [netconf] SSH private key format?

From: Kent Watsen <[email-masked]>
Date: Wed, 12 Feb 2020 12:06:54 +0000

Related to the crypto-types, keystore, and truststore drafts...

Everyone seems to agree that the *public* key format can be specified as:

	leaf public-key {
	   type binary;
	   description
	      "The binary public key data for an SSH key, as
	       specified by RFC 4253, Section 6.6, i.e.:

	         string    certificate or public key format identifier
	         byte[n]   key/certificate data.";
	   reference
	      "RFC 4253: The Secure Shell (SSH) Transport
	       Layer Protocol”;
	}

	BTW, being “binary”, this produces a block a base64,
	a la https://tools.ietf.org/html/rfc4716#section-3.6 <https://tools.ietf.org/html/rfc4716#section-3.6>, but
	without the headers and footers, or EOL characters.

	Also note that “key data” is underspecified.  “certificate
	data” is better, as PGP/X.509 certs are well-specified,
	though we have to *assume* the encoding is “DER".

But what is the *private* key format?  (i.e., ~/.ssh/id_dsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ed25519 or ~/.ssh/id_rsa).  

SSH-KEYGEN(1) says this:

     -m key_format
             Specify a key format for the -i (import) or -e (export) conversion options.  The supported key formats are:
             ``RFC4716'' (RFC 4716/SSH2 public or private key), ``PKCS8'' (PEM PKCS8 public key) or ``PEM’'
             (PEM public key). The default conversion format is ``RFC4716''.

FWIW, RFC 4716 does NOT define a private key format.  PKCS8 does define a private key format.  PKCS8 was obsoleted by RFC 5958, which defines the “OneAsymmetricKey" format, which is one of the formats used for TLS private keys.

That said, without actually trying to parse these private keys files,I suspect that they are actually raw private keys (e.g., RSAPrivateKey, ECPrivateKey, etc.) and not PKCS8/OneAsymmetricKey because, if they were a OneAsymmetricKey, there would be no need for different filenames...

Can anyone dig into this and confirm what these file formats are?

Kent // contributor

---

From: Kent Watsen <[email-masked]>
Date: Thu, 13 Feb 2020 16:44:29 +0000

After a little digging…

1) `ssh-keygen` default private key format is a proprietary format:
    https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.key?annotate=HEAD <https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.key?annotate=HEAD>

2) `ssh-keygen` can told to save a generated private key to the standard 
     PKCS/CMS format using the “-m PEM” parameter

3) `ssh-keygen` can also convert its proprietary private key format to the 
     PKCS/CMS format (e.g., ssh-keygen -p -N "" -m PEM -f <filename>)

4) OpenSSH can read (but not write) PKCS#8/OneAsymmetricKey
     formats. See the 9th paragraph of the accepted answer here:
     https://superuser.com/questions/1477472/openssh-public-key-file-format <https://superuser.com/questions/1477472/openssh-public-key-file-format>

 5) strangely, for “ecdsa” keys only, creating the “PEM” format via (3) or (4)
     produces different EC keys (different number of fields), though both are
     still parsable via `openssl ec …`

More info here: https://www.thedigitalcatonline.com/blog/2018/04/25/rsa-keys <https://www.thedigitalcatonline.com/blog/2018/04/25/rsa-keys>

Conclusion:

  - It seems that both SSH and TLS private keys use the same PKCS/CMS and
    OneAsymmetricKey formats.

Kent // contributor

> On Feb 12, 2020, at 7:06 AM, Kent Watsen <[email-masked]> wrote:
> 
> _______________________________________________
> netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf