9

I think my problem comes down to the fact something is wrong with the key but I cannot just decrypt it, for further investigation, with out parsing it. But I am not sure.

I am trying to use standard method:

openssl rsa -in ./id_rsa -out ./id_rsa.decrypted

I think I know the passphrase, because when I input a wrong one I get:

Enter pass phrase for ./id_rsa:
unable to load Private Key
140256774473360:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:544:
140256774473360:error:0906A065:PEM routines:PEM_do_header:bad decrypt:pem_lib.c:483

"bad decrypt" is pretty clear. Now, when I input my seemingly good passphrase I get back:

Enter pass phrase for ./id_rsa:
unable to load Private Key
139662870623888:error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long:asn1_lib.c:153:
139662870623888:error:0D068066:asn1 encoding routines:ASN1_CHECK_TLEN:bad object header:tasn_dec.c:1314:
139662870623888:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:381:Type=RSA
139662870623888:error:04093004:rsa routines:OLD_RSA_PRIV_DECODE:RSA lib:rsa_ameth.c:115:
139662870623888:error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long:asn1_lib.c:153:
139662870623888:error:0D068066:asn1 encoding routines:ASN1_CHECK_TLEN:bad object header:tasn_dec.c:1314:
139662870623888:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:381:Type=PKCS8_PRIV_KEY_INFO
139662870623888:error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib:pem_pkey.c:132:

It also failed to load key, but now it failed on asn1 parser, nothing about passphrase.

Can I somehow get unencrypted version of key and use other tools to see what is wrong with?

I have seen some posts that something changed and possible causes for seemingly good keys fail to parse, but they all worked on unencrypted version. But they only method I have seen to dercypt key is the above one.

  • The name hints that the file may have been generated by ssh-keygen. Have you tried using ssh-keygen to decrypt it as well? ssh-keygen -p -f keyfile will change the passphrase on a keyfile (it will overwrite the file, so create a copy first). By specifying an empty passphrase as the new passphrase, it will decrypt the file. – kasperd Mar 24 '15 at 21:35
  • @kasperd Yes, it says bad passphrase. Every other tool says it's a badphrase, except openssl. But from the openssl behaviour I think it's good one, I haven't use they key for some time, but it's one of my "standard" passwords, so it would fit. Doesn't ssh-keygen use openssl under the hood? – luk32 Mar 24 '15 at 21:40
  • @dawud I tried it, but I think this tool assumes the input is already decoded, doesn't ask for passphrase and says "header too long" right away. I think it's the next step to see what is wrong with they key, after I get the decrypted version. – luk32 Mar 24 '15 at 21:43
  • 1
    I could have asked for a copy of the file and the correct passphrase in order to reproduce the symptoms. But I could see some problems in that approach. So I am just guessing here, and I have no good way to test whether my guesses are going to work other than by asking you. – kasperd Mar 24 '15 at 21:47
  • 1
    When testing your openssl decryption command on a deliberately corrupted file, I got the same error with both a correct and an invalid password. This lead me to doubt the possibility of this being a case of the encrypted file having been corrupted over time due to random bitflips. – kasperd Mar 24 '15 at 21:56
9

I believe your private key was modified, as i was able to duplicate the same error message by changing a single character in a sample pass phrase protected key i just created.

You can reproduce this as follows -

  1. Create pass phrase protected private key
  2. Decrypt the private key to make sure it works.
  3. Change a single character inside the file containing the encrypted private key.
  4. Try to decrypt it now.
[testuser@whitehat .ssh]$ openssl rsa -in id_rsa -out id_rsa.decrypted
Enter pass phrase for id_rsa:
writing RSA key
[testuser@whitehat .ssh]$ ls -al id_rsa*
-rw-------. 1 testuser testuser 951 Mar 24 15:01 id_rsa
-rw-rw-r--. 1 testuser testuser 887 Mar 24 15:02 id_rsa.decrypted
-rw-r--r--. 1 testuser testuser 236 Mar 24 14:52 id_rsa.pub
[testuser@whitehat .ssh]$ vim id_rsa
[testuser@whitehat .ssh]$ openssl rsa -in id_rsa -out id_rsa.decrypted
Enter pass phrase for id_rsa:
unable to load Private Key
139900595279688:error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long:asn1_lib.c:150:
139900595279688:error:0D068066:asn1 encoding routines:ASN1_CHECK_TLEN:bad object header:tasn_dec.c:1306:
139900595279688:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:381:Type=RSA
139900595279688:error:04093004:rsa routines:OLD_RSA_PRIV_DECODE:RSA lib:rsa_ameth.c:115:
139900595279688:error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long:asn1_lib.c:150:
139900595279688:error:0D068066:asn1 encoding routines:ASN1_CHECK_TLEN:bad object header:tasn_dec.c:1306:
139900595279688:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:381:Type=PKCS8_PRIV_KEY_INFO
139900595279688:error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib:pem_pkey.c:132:
[testuser@whitehat .ssh]$ 

OS and openssl version info

[testuser@whitehat /]$ lsb_release -a
LSB Version:    :core-4.0-amd64:core-4.0-noarch:graphics-4.0-amd64:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-noarch
Distributor ID: Scientific
Description:    Scientific Linux release 6.2 (Carbon)
Release:    6.2
Codename:   Carbon
[testuser@whitehat /]$ rpm -q openssl
openssl-1.0.1e-30.el6_6.5.x86_64
1

I ended up here because I had the same problem, but mine was caused by the AWS ACM certificate export interface. (Private CA certificates can be exported with a passphrase)

Something about the particular passphrase I used... Not sure exactly what caused the issue, but it was likely the length, or symbols used.

The end result was I had a key with a different/shortened passphrase to what I expected.

Hope that helps someone...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.