Score:2

'ssh-keygen' - creates ssh key pair but silently skips encrypting the public key. Why?

jp flag

For example ssh-keygen -t rsa -b 4096 -C "test" -f test -N "1234567890" creates a public key beginning with

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNz....

instead of

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,....

Until recently, I was able to create encrypted keys (as in the example) without problem.

I have already encrypted keys generated earlier, and if I use ssh-add to add the key, it will prompt me to enter the password and correctly decrypts and adds it.

What could be the problem?

Score:2
om flag

It is encrypted - it's just not shown in the header.

This can be verified using ssh-keygen -yf file. If the key is encrypted you will be prompted for pass phrase. If it's not encrypted you will not be prompted for pass phrase before public key is printed to stdout.

-y creates the public key for the corresponding private key in file. Here it's used just to verify if the key is encrypted or not, and does not modify the file with the private key in any way.

Craig  Hicks avatar
jp flag
I see, the private key format has changed.
vidarlo avatar
om flag
Yep, looks that way. If you try to use the key you'll be prompted. `ssh-keygen -y` is simply easiest way of *using* a random key...
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.