Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/crypto/ssh: AES256-CBC isn't supported for passphrase-protected OpenSSH keys #37939

Closed
RKinsey opened this issue Mar 19, 2020 · 3 comments
Closed

x/crypto/ssh: AES256-CBC isn't supported for passphrase-protected OpenSSH keys #37939

RKinsey opened this issue Mar 19, 2020 · 3 comments
Labels
FrozenDueToAge NeedsFix The path to resolution is known, but the work has not been done.
Milestone
Unreleased

Comments

@RKinsey
Copy link

RKinsey commented Mar 19, 2020 •
edited

Someone over in @FiloSottile's age repo filed an issue a couple weeks ago (FiloSottile/age#100) because age reported an error on an older Ed25519 SSH key. Until v7.6 in 2017, OpenSSH used AES256-CBC as its default for password protected keys, and many of those keys are still in use.

The easiest demonstration is to use age and these keys: ed25519_pass.zip
Run
age -r ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDne4/teO42zTDdjNwxUMNpbfmp/dxgU4ZNkC3ydgcug -o out.age [file of your choice]
then
age -d -i /path/to/private/key /path/to/out.age
The passphrase is password

It should report something like Error: failed to decrypt SSH key file: ssh: unknown cipher "aes256-cbc", only supports "aes256-ctr" along with some age-specific boilerplate.
Edit: A playground is even better: https://play.golang.org/p/IUdSKrVgMpT

This happens because x/crypto/ssh only checks for CTR-mode AES in crypto/ssh/keys.go#L1249-L1251. The error isn't triggered with RSA keys generated by the same OpenSSH version, as they're labeled RSA PRIVATE KEY rather than OPENSSH PRIVATE KEY.

I'm partway through a fix, but I want to make sure that this wasn't an intentional move to discourage using older keys before I put too much effort into it.
@RKinsey RKinsey changed the title AES256-CBC isn't supported for passphrase-protected OpenSSH keys x/crypto/ssh: AES256-CBC isn't supported for passphrase-protected OpenSSH keys Mar 19, 2020
@gopherbot gopherbot added this to the Unreleased milestone Mar 19, 2020
@FiloSottile
Copy link
Contributor

FiloSottile commented Mar 19, 2020 via email

@martinseener
Copy link

@FiloSottile i'm still using them with OpenSSH daily (on macOS 10.5.3 and Linux Mint 19.3/Ubuntu 18.04).

@cagedmantis cagedmantis added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Mar 20, 2020
@FiloSottile FiloSottile added the NeedsFix The path to resolution is known, but the work has not been done. label Mar 21, 2020
@gopherbot gopherbot removed the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Mar 21, 2020
@gopherbot
Copy link

Change https://golang.org/cl/224817 mentions this issue: x/crypto/ssh: support aes256-cbc for passphrase-protected OpenSSH keys

@RKinsey RKinsey mentioned this issue Mar 24, 2020
Merged
FiloSottile pushed a commit to FiloSottile/age that referenced this issue Mar 24, 2020
@RKinsey
go.mod: update x/crypto for aes256-cbc support (#111, golang/go#37939)
35e5825
@golang golang locked and limited conversation to collaborators Mar 23, 2021
c-expert-zigbee pushed a commit to c-expert-zigbee/crypto_go that referenced this issue Mar 28, 2022
@RKinsey @FiloSottile
ssh: support aes256-cbc for passphrase-protected OpenSSH keys
b81cdbe 
The existing code for decrypting OpenSSH-format keys only allows aes256-ctr, the current ssh-keygen default.
However, the default encryption scheme was aes256-cbc until relatively recently, and some of these keys are still in use.
Support for aes256-cbc has been added.

Fixes golang/go#37939

Change-Id: I3730347109c5dd18e4cbe61b48bbca9566ad61d2
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/224817
Reviewed-by: Filippo Valsorda <filippo@golang.org>
c-expert-zigbee pushed a commit to c-expert-zigbee/crypto_go that referenced this issue Mar 29, 2022
@RKinsey @c-expert-zigbee
ssh: support aes256-cbc for passphrase-protected OpenSSH keys
0681eac 
The existing code for decrypting OpenSSH-format keys only allows aes256-ctr, the current ssh-keygen default.
However, the default encryption scheme was aes256-cbc until relatively recently, and some of these keys are still in use.
Support for aes256-cbc has been added.

Fixes golang/go#37939

Change-Id: I3730347109c5dd18e4cbe61b48bbca9566ad61d2
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/224817
Reviewed-by: Filippo Valsorda <filippo@golang.org>
c-expert-zigbee pushed a commit to c-expert-zigbee/crypto_go that referenced this issue Mar 29, 2022
@RKinsey @c-expert-zigbee
ssh: support aes256-cbc for passphrase-protected OpenSSH keys
6958855 
The existing code for decrypting OpenSSH-format keys only allows aes256-ctr, the current ssh-keygen default.
However, the default encryption scheme was aes256-cbc until relatively recently, and some of these keys are still in use.
Support for aes256-cbc has been added.

Fixes golang/go#37939

Change-Id: I3730347109c5dd18e4cbe61b48bbca9566ad61d2
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/224817
Reviewed-by: Filippo Valsorda <filippo@golang.org>
LewiGoddard pushed a commit to LewiGoddard/crypto that referenced this issue Feb 16, 2023
@RKinsey @FiloSottile
ssh: support aes256-cbc for passphrase-protected OpenSSH keys
ef6890f 
The existing code for decrypting OpenSSH-format keys only allows aes256-ctr, the current ssh-keygen default.
However, the default encryption scheme was aes256-cbc until relatively recently, and some of these keys are still in use.
Support for aes256-cbc has been added.

Fixes golang/go#37939

Change-Id: I3730347109c5dd18e4cbe61b48bbca9566ad61d2
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/224817
Reviewed-by: Filippo Valsorda <filippo@golang.org>
BiiChris pushed a commit to BiiChris/crypto that referenced this issue Sep 15, 2023
@RKinsey @FiloSottile
ssh: support aes256-cbc for passphrase-protected OpenSSH keys
0ad4e3d 
The existing code for decrypting OpenSSH-format keys only allows aes256-ctr, the current ssh-keygen default.
However, the default encryption scheme was aes256-cbc until relatively recently, and some of these keys are still in use.
Support for aes256-cbc has been added.

Fixes golang/go#37939

Change-Id: I3730347109c5dd18e4cbe61b48bbca9566ad61d2
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/224817
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge NeedsFix The path to resolution is known, but the work has not been done.
Projects
None yet
Milestone
Unreleased
Development

No branches or pull requests
5 participants
@cagedmantis @FiloSottile @martinseener @gopherbot @RKinsey