Question/Feature Request: Is Encryption/Description of text with SSH Key possible?

[gerion0]

I tried to find a possibility for encrypting and descripting text via an SSH key pair but only found functions to sign and verify text. Is ecryption/decryption implemented?

This would be the corresponding openssl function:

$ ssh-keygen -f path/to/id_rsa.pub -e -m PKCS8 > /tpm/ssh_key.pem
$ echo "some text" | openssl rsautl -encrypt -pubin -inkey /tmp/ssh_key.pem > encrypted.txt
$ openssl rsautl -decrypt -inkey ~/.ssh/id_rsa < encrypted.txt

[tarcieri]

I would suggest using https://github.com/str4d/rage

[gerion0]

Thanks for the suggestion. This seems to be a completely independent crypto stack but will work for my use case. Currently, I'm using the key also for an SSH connection via russh that uses this library, but I can reread the key.

Should I leave this open as a feature request?

[tarcieri]

What you're doing isn't really an (Open)SSH feature. You're using ssh-keygen to create a standard PKCS#8 formatted RSA private key (which is atypical for SSH, which typically uses the OpenSSH format these days), and then using a different program, OpenSSL, to perform encryption using that PKCS#8 private key.

There's not really a native SSH equivalent of this functionality. age/rage are the closest thing. rage predates these crates and doesn't use them, but the protocol it implements is the one I would recommend for performing public-key encryption keyed using OpenSSH private keys. It's also a nontrivial protocol that's separate from (Open)SSH, so I don't think it makes sense for the crates in this repo to implement it.

All that said, general support for loading ssh_key::PrivateKey from a PKCS#8-formatted file is still a useful feature we don't have (see checklist in README), and can be implemented using the pkcs8 crate.

[gerion0]

Oh, I somehow was thinking that SSH also uses the key for encryption/decryption internally (so for example to handle out the symmetric key) but that's apparently wrong (it seems to use Diffie-Hellman and uses the "ssh"-key only for authentication).

If loading private keys from pkcs8 is already mentioned in the README, I would close this/my request, since it is about something different conceptually. I was posting the above comments only because this was the CLI way that I found to achieve the overall goal to use SSH-Keys directly for encryption and decryption.