I looked into this when trying to make a piece of toy software to serialize and de-serialize *all* OpenSSH-supported public key formats.<\/p>\n
While OpenSSH uses standardized formats for private keys, the You can see from the following code fragment (which I wrote, and which is correct as regards OpenSSH-generated These formats (SEC 1<\/a>, Bernstein<\/a>) were both \"borrowed\" wholesale from the non-OpenSSH elliptic-curve software ecosystem.<\/p>\n What's interesting to me (and why I wrote this post) is how nearly<\/em> similar these 2 formats are. Actually, instead of saying how they're similar, I'll just enumerate comprehensively<\/em> their differences:<\/p>\n [NOTE FROM EDITOR: The above formulas are all based on prime $p\\neq 2$<\/span>. While no Bernstein protocol is yet<\/em> based on a characteristic-$2$<\/span> field, for SEC 1, some of these formulas are actually different for characteristic-$2$<\/span>.]<\/p>\n The first point is the most significant difference; it was a design choice to create the following \"knock-on\" effects:<\/p>\n These are security features because trying to treat with the point at infinity or points-off-the-curve can leak your private key or otherwise damage the security of the handshake if the software you're using wasn't specifically designed to handle those inputs (see CVE-2022-21449<\/a> and CVE-2017-16007<\/a> for representative examples); it's very easy for library developers to just assume<\/em> that the public key you're trying to treat with is a fully legitimate one. By categorically preventing the deserializer from emitting them, the library developer is saved totally from being required to even think about<\/strong> these cases, and the application (and, therefore, the user) which uses a Bernstein protocol is saved totally from library developers who neglected to think about these cases.<\/p>\n","protected":false},"excerpt":{"rendered":" I looked into this when trying to make a piece of toy software to serialize and de-serialize *all* OpenSSH-supported public key formats. While OpenSSH uses standardized formats for private keys, the ssh-* AAAA\/3NzaC0\u2026 format you're used to pasting into remote servers is actually\u00a0a \"proprietary\" (though with freely-licensed spec and implementation) encoding\u2014it's not JSON, and not …<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[97],"tags":[],"class_list":["post-2579","post","type-post","status-publish","format-standard","hentry","category-original-content"],"_links":{"self":[{"href":"http:\/\/www.ishygddt.xyz\/~blog\/wp-json\/wp\/v2\/posts\/2579","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.ishygddt.xyz\/~blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.ishygddt.xyz\/~blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.ishygddt.xyz\/~blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/www.ishygddt.xyz\/~blog\/wp-json\/wp\/v2\/comments?post=2579"}],"version-history":[{"count":40,"href":"http:\/\/www.ishygddt.xyz\/~blog\/wp-json\/wp\/v2\/posts\/2579\/revisions"}],"predecessor-version":[{"id":2636,"href":"http:\/\/www.ishygddt.xyz\/~blog\/wp-json\/wp\/v2\/posts\/2579\/revisions\/2636"}],"wp:attachment":[{"href":"http:\/\/www.ishygddt.xyz\/~blog\/wp-json\/wp\/v2\/media?parent=2579"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.ishygddt.xyz\/~blog\/wp-json\/wp\/v2\/categories?post=2579"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.ishygddt.xyz\/~blog\/wp-json\/wp\/v2\/tags?post=2579"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}ssh-* AAAA\/3NzaC0\u2026<\/code> format you're used to pasting into remote servers is actually\u00a0a \"proprietary\" (though with freely-licensed spec and implementation) encoding\u2014it's not JSON, and not any standardized BER\/DER codec; instead, it's\u00a0mostly<\/em> a Length-Value encoding (think TLV<\/a> without the T) with fixed-length length fields. (Technically, the underlying encoding<\/a> is basically ad-hoc, but in practice the only 2 of its datatypes anyone practically ever uses are string<\/code>, which holds octet strings of length variable at runtime up to $2^{32}-1$<\/span> bytes long; and mpint<\/code>, which holds the integers in range ${[{{-2^{{({2^{32}-1})}\\times 8}},{2^{{({2^{32}-1})}\\times 8}}})}$<\/span>; both of which are, obviously, encoded as a uint32<\/code> length followed by the raw value.)<\/p>\n~\/.ssh\/id_*.pub<\/code> files) that, while OpenSSH actually encodes RSA's (and DSS's) key values itself, it just stashes elliptic-curve keys of all species as foreign \"data blobs\" that have<\/em> to be parsed out by respective functions unpack_bernstein_compressed_point<\/code> and unpack_sec1ec_point<\/code>:<\/p>\nfunction _ossh2obj(buf) {\n\tlet reader = new _OsshReader(buf);\n\tlet type = reader.readString();\n\tswitch (type) {\n\n\t\tcase "ssh-rsa": {\n\t\t\tlet e = reader.readMpint();\n\t\t\tlet n = reader.readMpint();\n\n\t\t\treturn {type: 'rsa', value: {n, e}};\n\t\t}\n\n\t\tcase "ssh-dss": {\n\t\t\tlet p = reader.readMpint();\n\t\t\tlet q = reader.readMpint();\n\t\t\tlet g = reader.readMpint();\n\t\t\tlet y = reader.readMpint();\n\n\t\t\treturn {type: 'dss', value: {p, q, g, y}};\n\t\t}\n\n\t\tcase "ssh-ed25519":\n\t\tcase "ssh-ed448": {\n\n\t\t\t\/\/ 1. Curve\n\t\t\tlet identifier = type.match(\/^ssh-(ed\\S+)$\/)[1];\n\t\t\tlet params = getEdDSAParams(identifier);\n\n\t\t\t\/\/ 2. Point\n\t\t\tlet A = reader.readBytes();\n\t\t\tif (A.length !== get_bernstein_compressed_length(params))\n\t\t\t\tthrow new Error(`Invalid key (wrong ${type} length).`);\n\t\t\tlet P = unpack_bernstein_compressed_point(A, params);\n\t\t\t\/\/ let {x, y} = P;\n\n\t\t\treturn {type: 'eddsa', value: {identifier, point: P}};\n\t\t}\n\n\t\tcase "ecdsa-sha2-nistp256":\n\t\tcase "ecdsa-sha2-nistp384":\n\t\tcase "ecdsa-sha2-nistp521": {\n\t\t\t\/\/ https:\/\/www.rfc-editor.org\/rfc\/rfc5656#section-3.1\n\n\t\t\t\/\/ 1. Curve\n\t\t\tlet [hash_name, expected_identifier] = type.match(\/^ecdsa-(\\w+)-(\\w+)$\/).slice(1);\n\t\t\tlet identifier = reader.readString();\n\t\t\tif (identifier !== expected_identifier)\n\t\t\t\tthrow new Error("Invalid key (mismatched type field and SEC 1 identifier).");\n\t\t\tlet params = getECDSAParams(identifier);\n\n\t\t\t\/\/ 2. Point\n\t\t\tlet Q = reader.readBytes();\n\t\t\tlet P = unpack_sec1ec_point(Q, params);\n\t\t\t\/\/ let {x, y} = P;\n\n\t\t\treturn {type: 'ecdsa', value: {identifier, h: hash_name, point: P}};\n\t\t}\n\n\t\tdefault:\n\t\t\tthrow new Error(`Unsupported OpenSSH key type: ${type}`);\n\t};\n}<\/code><\/pre>\n\n
\n
\n
\n