Improving the security of your SSH private key files — Martin Kleppmann’s blog

Published by Martin Kleppmann on 24 May 2013. Update (July 2015): This post is now rather outdated, and the procedure for modifying your private key files is no longer recommended. A better solution is to use ssh-keygen -o. Ever wondered how those key files in ~/.ssh actually work? How secure are they actually? As you probably do too, I use ssh many times every single day — every git fetch and git

[fcicq]

openssl pkcs8 -topk8 -v2 des3 -in ~/.ssh/id_rsa.old -out ~/.ssh/id_rsa; chmod 600 ~/.ssh/id_rsa (and delete the original key)

[tmatsuu]

SSH秘密鍵は通常AES-128-CBCで暗号化、検証用ハッシュがMD5で1回のみ。どちらも簡単でストレッチ耐性低い。PKCS#8で暗号化しなおすべし。PKCS#8でもそのままsshで使える。おお、知らなかった。