SSH Key (ssh-keygen -t ed25519 -f age-ssh -a 100 -Z "") decryption results in an error about age

[codesoap]

It looks to me like the bug is not in age, but in golang.org/x/crypto/ssh. With this program you can reproduce the described error:

package main

import "golang.org/x/crypto/ssh"

// Generated with this command; password not empty!:
// ssh-keygen -t ed25519 -Z [email protected] -f key
var secretKey = `
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAAHWNoYWNoYTIwLXBvbHkxMzA1QG9wZW5zc2guY29tAAAABm
JjcnlwdAAAABgAAAAQpOLR3nv7KFNUrn9ETd8xLgAAABAAAAABAAAAMwAAAAtzc2gtZWQy
NTUxOQAAACDzMkP7oq1LPCZQ57/dfqPlhSXAQD4e+YShT8F6ePWQcQAAAJDN11o6u28HV4
1HdH3MIsiwysiD+nUNt0RGTO46nZzc/itKhUq3pgg+V1tN0tREeVkebp34nyPbmglDMsZm
YLHZJuDAJ/57J6YsZ0iZV8ZzY1u1Wf0RtsiujUAlr2K1vxdHROJIwAyosEvTgJ3o/FHap4
xPFxkRK/ZK/bI+BRvPO9dAEqo3fNPVW7RLVwLfi332ObUSUvnoihvTTaQ1oxqn
-----END OPENSSH PRIVATE KEY-----
`

func main() {
	_, err := ssh.ParseRawPrivateKey([]byte(secretKey))
	if err != nil {
		// Should be ssh.PassphraseMissingError, but is ssh.ParseError.
		panic(err)
	}
}

I think you should report the problem at https://github.com/golang/go/issues.

Narrowing down the problem

I have investigated some more and found some conditions under which the problem occurs:

The problem does not occur with keys generated like this:

• ssh-keygen -f key -t ed25519 -Z 3des-cbc (with password)
• ssh-keygen -f key -t ed25519 -Z aes128-cbc (with password)
• ssh-keygen -f key -t ed25519 -Z aes192-cbc (with password)
• ssh-keygen -f key -t ed25519 -Z aes256-cbc (with password)
• ssh-keygen -f key -t ed25519 -Z aes128-ctr (with password)
• ssh-keygen -f key -t ed25519 -Z aes192-ctr (with password)
• ssh-keygen -f key -t ed25519 -Z aes256-ctr (with password)
• ssh-keygen -f key -Z aes256-ctr (with password)
• ssh-keygen -f key -Z aes256-ctr (without password)
• ssh-keygen -f key -Z [email protected] (without password)
• ssh-keygen -f key -Z [email protected] (without password)
• ssh-keygen -f key -Z [email protected] (without password)

The problem does occur with keys generated like this:

• ssh-keygen -f key -t ed25519 -Z [email protected] (with password)
• ssh-keygen -f key -t ed25519 -Z [email protected] (with password)
• ssh-keygen -f key -t ed25519 -Z [email protected] (with password)
• ssh-keygen -f key -Z [email protected] (with password)

It seems to me like the problem only occurs when using the ciphers [email protected], [email protected] and [email protected] and only when using a password protected key. The type of key seems to be irrelevant.

[flotester]

Great. I will raise the issue there. Thanks.