brendanthompson / keycrypt

Generate new SSH key and Encrypt with OpenSSL

keycrypt

keycrypt is a wrapper for generating SSH Keys and then encrypting them with OpenSSL. keycrypt offers other features like copying the pubkey from your local machine to a remote host. This can even be done as part of the create step!

Current Features

• SSH Key Creation
• SSH Key Encryption with OpenSSL
• Copying PubKey to Remote Server (similar to ssh-copy-id)

Future Features

• Improved PubKey Copying
• Scanning for unencrypted keys and prompting for encryption

Why would I need this?

The default encryption that ships with SSH isn't the most secure, it comprises of the following:

The header tells us the encryption algorithm that was used: AES-128 in CBC mode. The 128-bit hex string in the DEK-Info header is the initialization vector (IV) for the cipher. This is pretty standard stuff; all common crypto libraries can handle it.

Martin Kleppmann has show below that there are two primary weaknesses in the way SSH encrypts it's keys:

• The digest algorithm is hard-coded to be MD5, which means that without changing the format, it’s not possible to upgrade to another hash function (e.g. SHA-1). This could be a problem if MD5 turns out not to be good enough.

• The hash function is only applied once — there is no stretching. This is a problem because MD5 and AES are both fast to compute, and thus a short passphrase is quite easy to break with brute force.

From this it was devised that we could get a higher level of security from using OpenSSL. As such I wanted to automate the process of creating an SSH key and then encrypting it with OpenSSL, and keycrypt was born.

---

Credits

This idea was fostered from an article written by Martin Kleppmann

keycrypt's Issues

Allow for Automated Key Copy

Have a secondary function that doesn't prompt for in put, merely takes input so that it can be used in a scripted fashion.

Prompt to Remove Backup

Prompt to remove the backup key after process completed.

new random password causing issues

Random password is causing issues in creating a key

Check OS type

Check for the OS type in the defaultKeyLocation function, and chose the default dependent on that.

Key Analysis

Need to add an option to look at the existing keys, check to see if these are encrypted. If not do you want to encrypt some of them or all of them. If they are already encrypted then offer to exit or offer to re-encrypt them.

Check for key.bak existence

In the key backup function check to see if a backup already exists

Check for existence of OpenSSL

enable re-encryption of keys

enable user to re-encrypt an old key that is using the default SSH encryption

Improve the copyPubKey

improve the copying of pubkeys to verify the key is in the remote server.

Check if an old key is encrypted before re-encryption

When user calls the encrypt function check to see if the key they're trying to encrypt is already encrypted. If it is prompt for password, else prompt for new password.

Copy newly created key to remote server(s)

When creating a new key, give the option to add it to a remote server.

Handle Multiple Public Keys in Copy Function

Allow for multiple keys to be copied to a remote server.

Add Autocomplete

Add in autocomplete for bash and zsh.

issue with key encryption failing

A few suggestions

Thanks for the script!

Here are a few suggestions:
1> /dev/null should be > /dev/null
Otherwise, there is an error when running on MacOS.

Include correct email in key. Add the following in createKey():
KNAME=$(basename $KEY)
grep -q '@' <<< $KNAME || KNAME=$KNAME@$HOSTNAME
KEYEMAIL="-C $KNAME"

    COMMAND="$COMMAND $TYPE $BITS $KEYEMAIL $OUTPUT_DIR $PASS"

tmp password change to random password run at the time of creation

Line 8
TMP_PASS="bubbl3s"

Change to random password generated which is run at the time of creation

Default key locations

If no location is supplied when executing create then create the key in ~/.ssh

Add Comment Functionality

Allow user to be able to add comment to key

Improve Informational & Error Messages

Make the informational and the error messages stand out and be more descriptive.

If port 22 is supplied it errors

In the copyPubKey function if port 22 is supplied it will error out saying Bad Port