78

So, the scenario is: Given I'm Bob, I want to encrypt some message for Alice. The only public key I have is her ssh-rsa id_rsa.pub like this:

ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAyb+qaZLwgC7KAQJzYikf3XtOWuhlMXVv2mbTKa5dp0sHPRd2RaYnH8ZRkt7V8bjqct1IHGCuxI8xyoEp4at3FHe6j9RfWiarc1ldLUCmTtryI0GGpRs6Zpvqdtpcq/1NCIYtUQAvsImyEFCtqmB2suDo1ZSllZQ0x9TCKHdCANYIOeaniuFzR57POgE3vxk/r6PO24oy8BIWqxvi29r0n1LUigVBJ7CmMHuzb4/+i1v6PxV1Lqnj6osPP9GpXpsh8kLUCby/KcmcryWNdSP0esyCdDxkA5hlIuk8qL1vzsyPluUQuc0BEHu6nuw8WQlCF1mFFxcpJL+MhWEr01WIIw== sikachu@Sikachus-Notebook.local

So, is there a way to encrypt a string using this public key so she can use her private key from id_rsa (generated from ssh-keygen) to decrypt the message?

(I know that it's possible right away if you're using .pem key pair file. If you can show me how to convert this to the format that openssl supports, that'd be great as well!)

Thanks!

Improve this question
2
  • 9
    You and alice should really investigate gpg ... gnupg.org ;D
    – tink
    Apr 1, 2013 at 20:24
  • 8
    Hahaha, indeed! However, the scenario that I have here is that I have access to their ssh-rsa public key already, and I don't want to add another layer of complexity (like, asking the recipient to go install gpg, etc.)
    – sikachu
    Apr 2, 2013 at 0:07

5 Answers 5

Reset to default
105

It's possible to convert your ssh public key to PEM format(that 'openssl rsautl' can read it):

Example: 

ssh-keygen -f ~/.ssh/id_rsa.pub -e -m PKCS8 > id_rsa.pem.pub

Assuming 'myMessage.txt' is your message which should be public-key encrypted.

Then just encrypt your message with openssl rsautl and your converted PEM public-key as you would normally do: 

openssl rsautl -encrypt -pubin -inkey id_rsa.pem.pub -ssl -in myMessage.txt -out myEncryptedMessage.txt

The result is your encrypted message in 'myEncryptedMessage.txt'

To test your work to decrypt the with Alice' private key: 

openssl rsautl -decrypt -inkey ~/.ssh/id_rsa -in myEncryptedMessage.txt -out myDecryptedMessage.txt
Improve this answer
9
  • 5
    I wrapped this up in a script that pulls the users public key from GitHub. github.com/twe4ked/catacomb
    – twe4ked
    Apr 3, 2013 at 10:30
  • This does not work for me. My ssh-keygen does not have a -m option. (I cannot figure out how to ask ssh-keygen for its version.) Replacing -m with -t works, but then openssl tells me "unable to load Public Key". See stackoverflow.com/questions/18285294/….
    – Jason Gross
    Aug 17, 2013 at 5:46
  • 1
    Same issue as Jason has on MaxOS Mavericks. Replaced -m with -t for keygen enabled key generation.
    – Robert Christian
    Dec 3, 2013 at 18:59
  • 10
    Note that this only works if the file is small enough. e.g. 200 bytes. See stackoverflow.com/questions/7143514/…
    – h__
    Apr 16, 2014 at 13:45
  • 3
    Echoing what @hyh said, this works only if the input file is small (the line is somewhere around 254 bytes, otherwise It will give "rsa routines:RSA_padding_add_SSLv23:data too large for key size:/SourceCache/OpenSSL098/OpenSSL098-52.20.2/src/crypto/rsa/rsa_ssl.c:73" error.
    – Devy
    Jun 11, 2015 at 20:41
2

Give a try to ssh-vault it uses ssh-rsa public keys to encrypt "create a vault" and the ssh-rsa private key to decrypt "view content of the vault"

Improve this answer
1
  • 2
    This seems to do a lot more than what the OP asked for, which is nice (looks like a well engineered tool!) but a bit misleading as it took me quite a few minutes to find out that this is not a wrapper around what is described in the accepted answer but something else on top of that. Leaving this as a note for everyone who is only looking for the barest solution to the problem, thanks though!
    – Simon Repp
    Jun 1, 2020 at 13:28
1

See https://www.bjornjohansen.com/encrypt-file-using-ssh-key. The idea is to generate a single-use symmetric key that is short enough to be encrypted using SSH public key. Then, you use the symmetric key to enrypt your text, and send both the encrypted text and the encrypted key to the recipient.

Improve this answer
0

NecroThreading a bit, but I had the same issue and catacomb did not quite cover it, so I ended up making my own variation. Also, I found that dealing with file redirects a bit confusing for my end-users, and the need to download the script beforehand a bit tedious, so my version wraps itself to make an auto-extractible file so the end-user has the easiest time getting the file.

It can be found at https://github.com/BaptisteRichard/rsaCrypt

Please advise that my users are on gitlab and not github so I tweaked that a bit, but it could easily be retrofitted. MR are welcome

Improve this answer
-3

Why not do this the super obvious way that doesn't require rolling your own crypto.

Alice sftps to alice@bobserver.com which is setup to only allow public key authentication for the account alice. The properties of ssh nicely ensure that only alice can authemticate. Even a man in the middle attack fails since (assuming you disable ssh1 and insist on the right settings) the initial communication using DH creates a value known to both alice and bob but not to any man in the middle and this can be used to authenticate that no reply or MITM attack can see the contents of the communicatino.

So have alice sftp into your box and download the file.

Improve this answer
5
  • 14
    How is using openssl rolling your own crypto?
    – cmc
    Apr 3, 2014 at 13:06
  • As an example, using RSA to encrypt a 1024 character string would fail because of message size. To overcome this problem the implementer is in a precarious situation, especially if the messages are repeated. It is safer to use RSA to encrypt a new symmetric cipher key and initialization vector which would be unlikely to repeat, so so generate unique cipher text for ever message sent, and gain the symmetric cipher speed, and reduce the amount of cipher and plain text to attack the RSA key with. Hope that makes sense. :)
    – Sam
    Jun 1, 2017 at 4:56
  • This method requires Bob to trust Alice, or to lock down bobserver.com so that Alice can't do anything malicious.
    – mwfearnley
    Dec 6, 2017 at 12:57
  • Its rolling your own in the sense that alice has to go throw a considerable amount of unusual operations to decrypt not in the sense of the underlying math being roll your own. As this was asked in terms of command line utilities rather than an API or theoretical perspective assumed the individual actually wanted to transfer some concrete information not piggyback a new protocol on top of ssh. As such practically sftp seemed far easier and yes it does require either looking down the server, trusting Alice or wiping the server afterward.
    – Peter Gerdes
    Dec 19, 2017 at 11:16
  • Seems to me that in the above one is actually vulnerable to someone intercepting the email in which you explain to alice exactly how she can decrypt this unusual message and giving her a sequence of commands that instead safely decrypt Charlie's MITM message (openssl commands are like magic incantations to most) while the server idea avoids all this in favor of standard commands many are familiar with and if bob runs it from the computer he is encrypting on he is trusting it anyway. Obviously the best answer depends on the threat model but from q context this likely would serve them better.
    – Peter Gerdes
    Dec 19, 2017 at 11:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.