Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have several users that use SmartCVS on OSX to interact with our CVS repository. We use the cvs :ext: (SSH2) method to access the repository, which is stored on a remote linux system. We use ssh key authentication, and require that users encrypt their private keys with a passphrase.

The version of ssh-keygen that ships with OSX uses AES-128-CBC to encrypt private keys, and apparently whatever ssh library SmartCVS uses doesn't support decrypting this cipher, as it throws an error. If I generate a key on Windows using PuTTYgen and move that key over to OSX, things work fine. PuTTYgen (and most versions of ssh-keygen on linux) use the DES-EDE3-CBC cipher, which SmartCVS is able to decrypt without issue.

So, my question is: is there a way to tell ssh-keygen which cipher to use when encrypting the private key? The ssh-keygen(1) man page on OSX doesn't say anything about being able to set the cipher type, but I'm hoping there may be some other way to convert to another cipher type after generation.

share|improve this question
Oh dear, you are still using CVS? Get off that decrepit old crap ASAP! CVS was always damn near unusable and there have been far better alternatives developed over the last 10 years. GIT is a godsend, and even SVN is a million times better than CVS. –  psusi Feb 9 '12 at 3:18
@psusi - Trust me, I know. Unfortunately this one is out of my control. We use SVN and git extensively elsewhere. –  EEAA Feb 9 '12 at 3:44

1 Answer 1

up vote 6 down vote accepted

I am not sure about how to get ssh-keygen to create a key using a specific encyprption algorithm.

You could generate your key using OpenSSL directly.

# create 1024 bit rsa and encrypt with des3 
#    make sure you set your umask or chmod this so that it is 0600, 
#    or else ssh will refuse to use it.
openssl genrsa -des3 -out .ssh/id_rsa 1024
# export an ssh public key
ssh-keygen -y -f .ssh/id_rsa > .ssh/id_rsa.pub

You could also convert the cipher of an existing key after the fact using OpenSSL.

openssl rsa -in id_rsa -out newkey_id_rsa -des3

See: genrsa(1), rsa(1), and ssh-keygen(1) for a list of the various options.

share|improve this answer
Both examples were tested and created valid working keys on my Debian Squeeze box with stock versions of ssh/openssl. –  Zoredache Feb 9 '12 at 1:59
Bingo - this works perfectly from within linux as well as with the built-in openssl on OSX. Thanks! –  EEAA Feb 9 '12 at 3:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.