From 91eea9449dda53b6d5da084ad41aaa6df9fe86a3 Mon Sep 17 00:00:00 2001 From: simon Date: Mon, 12 Apr 2010 11:02:06 +0000 Subject: [PATCH] Add comments on OpenSSH AES-encrypted key support, including one mentioning that I haven't yet switched to _exporting_ OpenSSH keys in the new style. git-svn-id: svn://svn.tartarus.org/sgt/putty@8917 cda61777-01e9-0310-a592-d414129be87e --- import.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/import.c b/import.c index 17bf65b9..20a77e5f 100644 --- a/import.c +++ b/import.c @@ -529,6 +529,10 @@ struct ssh2_userkey *openssh_read(const Filename *filename, char *passphrase, * - let block B equal MD5(A || passphrase || iv) * - block C would be MD5(B || passphrase || iv) and so on * - encryption key is the first N bytes of A || B + * + * (Note that only 8 bytes of the iv are used for key + * derivation, even when the key is encrypted with AES and + * hence there are 16 bytes available.) */ struct MD5Context md5c; unsigned char keybuf[32]; @@ -872,6 +876,9 @@ int openssh_write(const Filename *filename, struct ssh2_userkey *key, /* * Encrypt the key. + * + * For the moment, we still encrypt our OpenSSH keys using + * old-style 3DES. */ if (passphrase) { /* -- 2.11.0