Documentation
¶
Overview ¶
Package sshkey parses an OpenSSH private key file (the "-----BEGIN OPENSSH PRIVATE KEY-----" / openssh-key-v1 format) for triage. A stolen private key (id_ed25519 / id_rsa) is top pentest loot, and the first questions are: is it **encrypted** (so it must be cracked — ssh2john → hashcat -m 22921 — before use, or used directly if not)? what **key type**? what **SHA256 fingerprint** (to correlate the key with an authorized_keys entry / a known target identity)? and what **comment** (often user@host)? This answers all of those from the key's public portion (always readable, even for an encrypted key). Pure offline transform; no network or device.
Wrap-vs-native judgement ¶
Native. The format is a documented, self-delimited binary blob inside PEM base64 (PROTOCOL.key): a "openssh-key-v1\0" magic, then SSH-wire length-prefixed strings — ciphername, kdfname, kdfoptions, key count, the public-key blob(s), and the (possibly encrypted) private section. It is a base64-decode + a length-prefixed walk + a SHA-256; there is nothing to wrap, and pulling in golang.org/x/crypto/ssh (which refuses to even parse an encrypted key without the passphrase) defeats the triage purpose. Consistent with the other in-tree parsers.
Verifiable / no confidently-wrong output ¶
The cipher / kdf / key-type / fingerprint are anchored to `ssh-keygen`: for a generated ed25519 and rsa key (encrypted and not), the parser reproduces ssh-keygen -l's exact SHA256 fingerprint + type + encrypted state + the comment. A non-openssh-key-v1 blob, or a truncated/over-long length field, is rejected. The comment of an encrypted key lives in the encrypted section and is correctly reported as unavailable rather than guessed.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type PubKey ¶
type PubKey struct {
Type string `json:"type"`
Fingerprint string `json:"fingerprint"` // SHA256:... (as `ssh-keygen -l` prints)
}
PubKey is one public key carried in the file.
type Result ¶
type Result struct {
Format string `json:"format"`
Cipher string `json:"cipher"`
Encrypted bool `json:"encrypted"`
KDF string `json:"kdf"`
KDFRounds int `json:"kdf_rounds,omitempty"`
KDFSaltLen int `json:"kdf_salt_len,omitempty"`
NumKeys int `json:"num_keys"`
Keys []*PubKey `json:"keys"`
Comment string `json:"comment,omitempty"`
Note string `json:"note,omitempty"`
}
Result is the triage view of an OpenSSH private key file.
Source Files