Re: Using the SSL module.

On Tue, 23 Jun 2015, Chris Angelico wrote:

> On Tue, Jun 23, 2015 at 1:16 AM, Henrik Grubbström <[email protected]> wrote:
>> [Parsing of a PEM-file by hand removed]
>>
>> You might want to have a look at Standards.PEM.
>
> Oh, cool, thanks! Hadn't spotted that one.
>
> That saves me a small amount of trouble, but there's one thing that
> still doesn't gel with me. In a program that uses keypairs generated
> by ssh-keygen(1), I can parse a private key nice and easily, but the
> public key is a bit different. Here's mine, straight from
> .ssh/id_rsa.pub:
>
> ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDk7uBGern7ntWxWqyYnSGmZykktC/sb7or9AY4UKM8/zwAWwLhubmnr9SysEaMayc4R7WSbdRaD4g2ZTn/F46awdgLS4uybDIfChSUUnwNUAuxmlPS+9mGbs3ajQZ3svt1h1/Xr6tuyI4BSwScJlTgRKE+il4zYiGFteqdWUjGSLshm4CBCL5QaCtebtKsVIut8uIHEQH0uepSqMs4vvZUS+xsUYyVjDSjJ4RfNDs23CnVGHaEp3WNnOnn/r9341ksiUtc2+MofMUUycrPVewh0YnxSMpK8YcQ/i0b/EpiB0poe4JOm/bIa50C5Y9FV7buVc9TqS+BueJkO9XBRkxp
> rosuav@sikorsky
>
> But trying to parse that invariably fails. Currently, here's how I do it:
[...]
> Stripping off the leading "ssh-rsa" and the trailing identifier, that
> makes reasonable sense. But I have no idea what the rewrapping means -
> I have to strip off the first twenty bytes, which seem always to be
> "\0\0\0\assh-rsa\0\0\0\3\1\0\1\0\0", and then patch on a replacement
> set of framing bytes, including some at the end. Is there a standard
> way to parse these keys? Or is it ssh-keygen that's doing something
> unusual here (maybe something SSH-specific)?

It looks like a simple SSH-specific encoding. From looking at your 
example, I believe that something like the following might work:

   Stdio.Buffer buf = Stdio.Buffer(MIME.decode_base64(encoded_key));

   string tag = buf->read_hstring(4);

   if (tag == "ssh-rsa") {
     int modulo = buf->read_hint(4);

     int pub = buf->read_hint(4);

     Crypto.RSA rsa = Crypto.RSA();

     rsa->set_public_key(modulo, pub);

     return rsa;
   }

> Other than that rewrapping, the keys seem to be perfectly compatible,
> which means I can make use of the key exchanges that I've already done
> around the network. But it does seem weird.

 	/grubba

-- 
Henrik Grubbström					[email protected]
Roxen Internet Software AB