0

Per https://www.reddit.com/r/sysadmin/comments/wf7ri8/comment/iit1rwx/ to convert a private key from PEM to OpenSSH format I need to first make a copy of the file and then run:

ssh-keygen -p -f private_key_openssh.pem -N ""

The problem is that every time I run this command, a portion of the output keeps on changing as if some random salt was being used. I need a command that will generate consistent output because the value is being used in automated tests.

Is there another way to convert PEM to OpenSSH format? Is there a way to hard-code the changing component to something stable?

UPDATE: As requested, here is a concrete example...

Given this test key in PEM format:

-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIFILtH9SV+gU1C91FN16twvHqxf1tnCIM7gh3Ii6eeR2oAoGCCqGSM49
AwEHoUQDQgAEdZ9Uhb8uw4t/dhpjMvCbFhI2330wrpxisGayIKv8iMtQt97neG8T
d1uL21wrWX8j3lW1jaVtXl0mf97lpnCd0g==
-----END EC PRIVATE KEY-----

if I copy /Y private_key.pem private_key_openssh.pem and then ssh-keygen -p -f private_key_openssh.pem -N "" I get this output:

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQR1n1SFvy7Di392GmMy8JsWEjbffTCu
nGKwZrIgq/yIy1C33ud4bxN3W4vbXCtZfyPeVbWNpW1eXSZ/3uWmcJ3SAAAAmLDjFkWw4x
ZFAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHWfVIW/LsOLf3Ya
YzLwmxYSNt99MK6cYrBmsiCr/IjLULfe53hvE3dbi9tcK1l/I95VtY2lbV5dJn/e5aZwnd
IAAAAgUgu0f1JX6BTUL3UU3Xq3C8erF/W2cIgzuCHciLp55HYAAAAA
-----END OPENSSH PRIVATE KEY-----

If I repeat this process a second time I get this output:

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQR1n1SFvy7Di392GmMy8JsWEjbffTCu
nGKwZrIgq/yIy1C33ud4bxN3W4vbXCtZfyPeVbWNpW1eXSZ/3uWmcJ3SAAAAmNyNVafcjV
WnAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHWfVIW/LsOLf3Ya
YzLwmxYSNt99MK6cYrBmsiCr/IjLULfe53hvE3dbi9tcK1l/I95VtY2lbV5dJn/e5aZwnd
IAAAAgUgu0f1JX6BTUL3UU3Xq3C8erF/W2cIgzuCHciLp55HYAAAAA
-----END OPENSSH PRIVATE KEY-----

and so on. Every time I run the command, the same subset of the output gets modified, but every time I get a different value.

Gili
  • 1,901

1 Answers1

0

Just use the public key in your unit tests. I.e: you can generate the public key from the private with:

 ssh-keygen -y -f private.key > public.key

By definition if two private keys authenticate against the same public key they are the same private keys.

Additionally you don't need to worry about leaking secrets - if you want to put the public key in source control etc, since the public key is not considered secret.

DavidT
  • 1,242