https://crypto.stackexchange.com/questions/31807/why-does-my-ssh-private-key-still-work-after-changing-some-bytes-in-the-file Stack Exchange Network Stack Exchange network consists of 181 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers. Visit Stack Exchange [ ] Loading... 1. + Tour Start here for a quick overview of the site + Help Center Detailed answers to any questions you might have + Meta Discuss the workings and policies of this site + About Us Learn more about Stack Overflow the company + Business Learn more about our products 2. 3. current community + Cryptography help chat + Cryptography Meta your communities Sign up or log in to customize your list. more stack exchange communities company blog 4. 5. Log in 6. Sign up Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up. Sign up to join this community [ano] Anybody can ask a question [ano] Anybody can answer [an] The best answers are voted up and rise to the top Cryptography 1. Home 2. 1. Public 2. Questions 3. Tags 4. Users 5. Companies 6. Unanswered 3. 1. Teams Stack Overflow for Teams - Start collaborating and sharing organizational knowledge. [teams-illo-free-si] Create a free Team Why Teams? 2. Teams 3. Create free Team Teams Q&A for work Connect and share knowledge within a single location that is structured and easy to search. Learn more about Teams Why does my SSH private key still work after changing some bytes in the file? Ask Question Asked 6 years, 11 months ago Modified today Viewed 42k times 131 $\begingroup$ I (for a test) just randomly altered a private RSA key by opening it up in Vim and changing a few bytes. It is the private part of an SSH key pair used for logging in on a remote system. Puzzlingly, it still allows me to login. I did some research and found that it is a Base64-encoded ASN.1 container, so I pulled all the relevant integers out with OpenSSL and it seems only $d$, the private exponent, has changed (and only slightly at that). Is it possible the additional cached values are therefore being used to decrypt the value sent from the server, in order to still allow me to log in? The public key can (as expected) still be derived due to the other integers in the ASN.1 still being the same. As I'm an encryption doofus, I'd appreciate some guidance on how the above is possible. I've found that when I modify the key in Vim by larger amounts it rejects me as expected. * rsa * public-key * authentication * ssh Share Improve this question Follow edited 8 hours ago Matthias Braun's user avatar Matthias Braun 17766 bronze badges asked Jan 9, 2016 at 19:15 PhilPotter1987's user avatar PhilPotter1987PhilPotter1987 94322 gold badges77 silver badges66 bronze badges $\endgroup$ 3 * $\begingroup$ Changing the d , private exponent without changing other parameters, you will lose the original properties of the whole key pair. Check how is the d argument generated. Anyway quite interesting topic. Can you share the keys (or create similar) to reproduce the case? $\endgroup$ - Jakuje Jan 9, 2016 at 19:33 * $\begingroup$ Are you sure that this key was used? Check with ssh -v host. Isn't there a DSA-key too by chance? $\endgroup$ - ott-- Jan 10, 2016 at 7:20 * $\begingroup$ It was definitely the RSA key. $\endgroup$ - PhilPotter1987 Jan 10, 2016 at 20:11 Add a comment | 1 Answer 1 Sorted by: Reset to default [Highest score (default) ] 186 $\begingroup$ An ASN.1-encoded SSH private key contains the following integers in order: * The public modulus $n$ and exponent $e$; * The private exponent $d$; * The prime factors $p$ and $q$ of $n$; * The "reduced" private exponents $d_p=d\bmod(p-1)$ and $d_q=d\bmod (q-1)$; * The "CRT coefficient" $q_{\text{inv}}=q^{-1}\bmod p$. The observation that the value of $d$ in such a key may be irrelevant is due to the following: To speed up exponentiation modulo $n$ by a factor of about $4$, the Chinese Remainder Theorem can be utilized to compute the result modulo $p$ and $q$ separately and subsequently combine them to obtain the "real" result modulo $n$. With this optimization, the values of $n$, $e$ and $d$ are not required, hence are ignored by typical implementations whenever $p$, $q$, $d_p$, $d_q$ and $q_{\text{inv}}$ are available*. This is why changing some characters in the middle of the key need not necessarily destroy it, depending on which of the components you change. [*) at least for OpenSSH, they do not have to be present: setting $p= q=1$ and $d_p=d_q=q_{\text{inv}}=0$ makes the implementation use $n$ and $d$.] To visualize the arrangement of the individual components, I created the following graphic from a typical 4096-bit RSA private key file: RSA private key with highlightning of the encoded numbers The grey part right in the beginning is ASN.1 header data (encoding the fact that a sequence is about to follow, etc), followed by the integers forming the key as described above. The ASN.1 header data associated to each component (mostly a length field) is colored slightly brighter than the data representing the integer itself. Note that the pictured subdivision is not 100% accurate as one Base64 character encodes roughly $3/4$ raw bytes, hence some boundaries should actually run strictly within a single character. Share Improve this answer Follow edited Apr 27, 2016 at 17:19 e-sushi's user avatar e-sushi 17.5k1212 gold badges7979 silver badges221221 bronze badges answered Jan 9, 2016 at 20:10 yyyyyyy's user avatar yyyyyyyyyyyyyy 11.6k44 gold badges4545 silver badges6565 bronze badges $\endgroup$ 4 * 2 $\begingroup$ Related question: crypto.stackexchange.com/ questions/6593/... (formerly linked from my answer, which I deleted as otherwise redundant to this one). $\endgroup$ - Ilmari Karonen Jan 9, 2016 at 21:24 * 11 $\begingroup$ @yyyyyyy: Meta question: I like your colorization. What programs did you use? $\endgroup$ - StackzOfZtuff Jan 11, 2016 at 8:37 * 12 $\begingroup$ @StackzOfZtuff Thank you! Unfortunately I am not aware of any convenient program for things like this: My "toolchain" consisted of a horrible mixture of OpenSSL, Python, LaTeX, and GIMP, along with a non-negligible amount of manual work. $\endgroup$ - yyyyyyy Jan 11, 2016 at 12:12 * 1 $\begingroup$ Re: "at least for OpenSSH, they do not have to be present: setting $p=q=1$ and $d_p=d_q=q_{\text{inv}}=0$ makes the implementation use $n$ and $d$." The same appears to hold true for OpenSSL as well: I just tested a certificate constructed with these parameters against Node.js's crypto.privateDecrypt and it worked without errors. $\endgroup$ - Stuart P. Bentley May 10, 2017 at 5:56 Add a comment | Your Answer [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] Thanks for contributing an answer to Cryptography Stack Exchange! * Please be sure to answer the question. Provide details and share your research! But avoid ... * Asking for help, clarification, or responding to other answers. * Making statements based on opinion; back them up with references or personal experience. Use MathJax to format equations. MathJax reference. To learn more, see our tips on writing great answers. Draft saved Draft discarded [ ] Sign up or log in Sign up using Google Sign up using Facebook Sign up using Email and Password Submit Post as a guest Name [ ] Email Required, but never shown [ ] Post as a guest Name [ ] Email Required, but never shown [ ] Post Your Answer Discard By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy Not the answer you're looking for? Browse other questions tagged * rsa * public-key * authentication * ssh or ask your own question. * The Overflow Blog * Remote work is killing big offices. Cities must change to survive * You should be reading academic computer science papers * Featured on Meta * Navigation and UI research starting soon Linked 1 Do RSA keys contain a checksum mechanism? 26 What data is saved in RSA private key? 6 compact rsa private key format 2 Understanding ransomware - What makes plain-text-attacks or brute-forcing so hard? 1 What purpose does an SSH private key passphrase serve? 0 What are the integers in an RSA PEM file? 0 Why if i change some characters of a Public key on authorizedKeys the login still works Related 4 How to avoid a chicken and egg scenario with encrypting passwords? 5 Is it safe to derive a password from a signature provided by ssh-agent? 3 How does authentication work for SSH login with a public key? 1 how does AES GCM in SSH work? 2 Can an altered RSA private key still work as the original? 1 What purpose does an SSH private key passphrase serve? Hot Network Questions * Where does e come from in this problem about dice? * What kind of nebulae was the Sun formed from? * My supervisor worked so hard to get a research opportunity for me, but now I want to quit. How to handle this situation? * Must RSA exponent and modulus be odd * Basic "mate in one move" puzzle - what am I missing? * How do I turn off an LTC4359 using the SHDN pin? * What are these outlets, and can they be used to connect Ethernet-like cable? * During spacecraft reentry why is heatshield side down the most stable orientation? * Are there algorithms to cluster Graphs, not just cluster nodes in a graph? * Is it possible to specify the size of the length and width of a plot separately? * Was Andrew Tate raided by police because of a pizza box revealing that he is in Romania? * Is 2.4 GHz Wi-Fi band shared across routers? * How many qubits can break NIST P-521 ECC? * Visa Debit card support in Japan * Hidden city ticketing with stopovers instead of layovers * Are Donations Enough to Validate Trademark? * Open-Source code made proprietary by someone else without proper attribution (Apache License 2.0) * How is Dian Yuan *actually* written and pronounced? * What was so hard about the washer nuts on the JWST? * How did the X-Men game for Sega Genesis have its state survive a console reset? * Teenage boy transported to Medieval Ukraine * Hash dictionaries with same keys in Python * Is it okay to have 2 definitions of the same term? * Does a general purpose optocoupler such as CNY17-4 support clean 25kHz PWM? more hot questions Question feed Subscribe to RSS Question feed To subscribe to this RSS feed, copy and paste this URL into your RSS reader. [https://crypto.stack] * Cryptography * Tour * Help * Chat * Contact * Feedback Company * Stack Overflow * Teams * Advertising * Collectives * Talent * About * Press * Legal * Privacy Policy * Terms of Service * Cookie Settings * Cookie Policy Stack Exchange Network * Technology * Culture & recreation * Life & arts * Science * Professional * Business * API * Data * Blog * Facebook * Twitter * LinkedIn * Instagram Site design / logo (c) 2022 Stack Exchange Inc; user contributions licensed under CC BY-SA. rev 2022.12.21.43127 Your privacy By clicking "Accept all cookies", you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy. Accept all cookies Customize settings