Re: Using the SSL module.

On Tue, Jun 23, 2015 at 1:16 AM, Henrik Grubbström <[email protected]> wrote:
> [Parsing of a PEM-file by hand removed]
>
> You might want to have a look at Standards.PEM.

Oh, cool, thanks! Hadn't spotted that one.

That saves me a small amount of trouble, but there's one thing that
still doesn't gel with me. In a program that uses keypairs generated
by ssh-keygen(1), I can parse a private key nice and easily, but the
public key is a bit different. Here's mine, straight from
.ssh/id_rsa.pub:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDk7uBGern7ntWxWqyYnSGmZykktC/sb7or9AY4UKM8/zwAWwLhubmnr9SysEaMayc4R7WSbdRaD4g2ZTn/F46awdgLS4uybDIfChSUUnwNUAuxmlPS+9mGbs3ajQZ3svt1h1/Xr6tuyI4BSwScJlTgRKE+il4zYiGFteqdWUjGSLshm4CBCL5QaCtebtKsVIut8uIHEQH0uepSqMs4vvZUS+xsUYyVjDSjJ4RfNDs23CnVGHaEp3WNnOnn/r9341ksiUtc2+MofMUUycrPVewh0YnxSMpK8YcQ/i0b/EpiB0poe4JOm/bIa50C5Y9FV7buVc9TqS+BueJkO9XBRkxp
rosuav@sikorsky

But trying to parse that invariably fails. Currently, here's how I do it:

object load_public_key(string fn) {return
decode_public_key((Stdio.read_file(fn)/" ")[1]);}
object decode_public_key(string key)
{
    key=MIME.decode_base64(key);
    //I have no idea how this rewrapping works, but it appears to. There's some
    //signature data at the beginning of the MIME-encoded file, but we need some
    //different signature data for parse_public_key().
    return Standards.PKCS.RSA.parse_public_key("0\202\1\n\2\202"+key[20..]+"\2\3\1\0\1");
}

Stripping off the leading "ssh-rsa" and the trailing identifier, that
makes reasonable sense. But I have no idea what the rewrapping means -
I have to strip off the first twenty bytes, which seem always to be
"\0\0\0\assh-rsa\0\0\0\3\1\0\1\0\0", and then patch on a replacement
set of framing bytes, including some at the end. Is there a standard
way to parse these keys? Or is it ssh-keygen that's doing something
unusual here (maybe something SSH-specific)?

Other than that rewrapping, the keys seem to be perfectly compatible,
which means I can make use of the key exchanges that I've already done
around the network. But it does seem weird.

ChrisA