UI copy/export behavior of SSH keys generated by 1P8
I've been testing out the SSH Agent functionality built into 1P8, and this was something I ran across today when attempting to use SSH keys generated by 1P8.
(This is a bogus key, created just for this post)
If you click on the Private Key to copy it (e.g., to paste it into a file on a remote host), you end up with a key in this format that does not follow RFC4716 and is not usable by OpenSSH. At first glance, it appears to be PEM format, but attempting to convert from PEM fails (see below).
-----BEGIN PRIVATE KEY----- MFMCAQEwBQYDK2VwBCIEIMZ0cI9G+jyUB1i/2L17theJdVj3F+w+Xg9JunCyb0SN oSMDIQB9MEvJCx15KcncldXIqHdNbWcr8l6zmfFuDQJxRO0+JA== -----END PRIVATE KEY-----
However if you click the down arrow and choose Download you end up with a key that is usable by OpenSSH:
-----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW QyNTUxOQAAACDdFnR7fMC7OdO4L/wLfY8k/nooV8et6RA5/84ikZtingAAAIg/6vA3P+rw NwAAAAtzc2gtZWQyNTUxOQAAACDdFnR7fMC7OdO4L/wLfY8k/nooV8et6RA5/84ikZting AAAEDAxt6+dY8QtiQGI5+DJfQ0MTliA6N5iRomikSoulEcrt0WdHt8wLs507gv/At9jyT+ eihXx63pEDn/ziKRm2KeAAAAAAECAwQF -----END OPENSSH PRIVATE KEY-----
This difference in behavior is not documented nor expected by a user, as it's not an intuitive difference. Since I wasn't examining the contents of the key closely, my first attempts to use it after pasting it to the remote all failed because the key was in an invalid format (for openssh).
Attempting to use ssh-keygen to convert the private key into a usable format all fail:
$ cat id_ed25519 -----BEGIN PRIVATE KEY----- MFMCAQEwBQYDK2VwBCIEIMZ0cI9G+jyUB1i/2L17theJdVj3F+w+Xg9JunCyb0SN oSMDIQB9MEvJCx15KcncldXIqHdNbWcr8l6zmfFuDQJxRO0+JA== -----END PRIVATE KEY----- $ ssh-keygen -f id_ed25519 -i -m pem do_convert_from_pem: unrecognised raw private key format $ ssh-keygen -f id_ed25519 -i -m pkcs8 do_convert_from_pkcs8: id_ed25519 is not a recognised public key format $ ssh-keygen -f id_ed25519 -i -m rfc4716 do_convert_from_ssh2: parse key: invalid format $ ssh-keygen -f id_ed25519 -i do_convert_from_ssh2: parse key: invalid format $
1Password Version: 80900001
Extension Version: n/a
OS Version: macOS 13
Browser:_ n/a
Comments
-
Found an answer at https://security.stackexchange.com/a/267767/288895, basically:
Install sshpk: npm install -g sshpk
Convert key: op item get --fields='label=private key' --format json 'My Key' | jq -r '.value' | sshpk-conv -t ssh -p0 -
Thanks, but this wasn't a request for assistance... just a bug report. You can already export a properly formatted key using the Download button, so there's no need for someone to install node and then an unknown node app in order to convert file formats. That's not a reasonable thing to expect a user to do.
0 -
The
Copy/Downloadactions have been replaced with a singleExportaction and accompanying modal, which lets you also encrypt it with a passphrase.
0 -
Hey fam, any plan to have this supported on the CLI client as well?
0
