Generating ED25519 SSH Key in Ruby - ruby

Question

I'm looking to generate ED25519 EC key pairs in Ruby. The OpenSSL gem does not support this particular signature scheme. There is a ED25519 gem but this does not appear to generate a key pair that I can export and use.
How would (should) I generate these types of key pairs in Ruby?

Answer 1

So, having looked, I also didn't find an obvious answer to this. But not to despair! The SSH key format is documented and boils down to a bunch of base64ed pascal-style strings. So let's do this thing!
require 'ed25519'
require 'securerandom'
require 'base64'
# PLEASE NOTE FOR SECURITY:
# the ed25519 gem and the library it is based off of are not protected against
# timing attacks. This script will generate _secure_ keys but the computing
# environment in which they are generated must also be secure and must _not_
# be a shared environment.
# rfc4253 defines the general way this is done. for older key types.
# nothing has changed except the keytypes.
# openssh's key format is
# "ssh-keytype "+(base64 (encodekey keydata))" comment"
# and keydata is either one of these two:
# numeric key types like rsa: sshstring("ssh-rsa")+sshmpint(e)+sshmpint(n)
# byte string key types like ed25519: sshstring("ssh-ed25519")+sshstring(keymatter)
# openssh's basic types are actually just different plays on pascal strings with uint32s.
# let's implement those here
def sshstring(s)
# s = s.force_encoding("ASCII-8BIT")
# s = s.b
[
s.length >> 24 & 0xff,
s.length >> 16 & 0xff,
s.length >> 8 & 0xff,
s.length & 0xff,
].pack('c*') + s
end
def sshpaddedstring(blocksize, s)
# first, add all the padding we could need. then truncate the tail.
/^(.{#{blocksize}}*)/m.match(s + Array(1..blocksize).pack('c*'))
sshstring($1)
end
def sshmpint(i)
# first, make a string of bytes
nl = []
while i > 0 do
nl << (i & 0xff);
i >>= 8;
end
sshstring(nl.pack('c*'))
end
# now that we can generate values out of strings and numbers and we know what
# order to put them in, we can make an ed25519 public key.
def public_key_innards_from_ed25519(signing_key)
sshstring("ssh-ed25519")+sshstring(signing_key.verify_key.to_bytes)
end
def public_key_from_ed25519(signing_key, comment)
"ssh-ed25519 #{[public_key_innards_from_ed25519(signing_key)].pack 'm0'} #{comment}"
end
# that was surprisingly straightforward. now for private keys
# ... l3ll3llll3l also straightforward but a lot more work :D
# these ones are really just more of the same except for a few details
def ssh_keygen_ed25519
# to start, we need a key.
signing_key = Ed25519::SigningKey.generate
# we also need a comment
comment = "this key is a real gem"
# then we need to generate the public key format used later in the file.
# these are the innards that also go in the public key wrapper format
# which will be placed in authorized_keys. we'll save them here to
# avoid generating it over and over (typing it over and over really)
public_key_innards = public_key_innards_from_ed25519(signing_key)
private_key_blob = [
# now, let's start building the key!
"openssh-key-v1\0", # first, they start with a null terminated magic string
sshstring("none"), # the cipher name or "none" if the key is not encrypted
sshstring("none"), # the KDF name or "none" if the key is not encrypted
sshstring(""), # kdf data or an empty string if the key is not encrypted
"\x00\x00\x00\x01", # pop quiz! how many keys are in this file? it's 1. it's _always_ 1.
# next is the public key in the second field format of authorized_keys but not base64ed
sshstring(public_key_innards),
sshpaddedstring(8, # this section is an embedded sshstring padded to 8 bytes.
[
(SecureRandom.random_bytes 4) * 2,
# and some random bytes for extra randominity
# jk they're for checking the encrypted vs unencrypted values.
# there are two of them so that they can be compared after decryption.
# they will appear to be random values if decryption failes.
# and, of course, if you don't encrypt at all, they're just a random uint32s repeated
public_key_innards,
# "hello",
sshstring(signing_key.seed + signing_key.verify_key.to_str), # this is just the private key and public key concatenated...
# "hell2",
# ... ... for anyone counting, yes, you counted right.
# the public key is included in the "private key" three times. so this definitely isn't
# just the private key. it also explains why the private key is enormous compared to the
# public key despite the public key and private key being the same length (32 bytes) for
# ed25519. more info about ed25519, including how to generate _that_ can be found in rfc8032.
sshstring(comment),
].join
),
].join
# the pack line means "encode as base64 with no newlines and chunk in 70 byte lines."
[
public_key_from_ed25519(signing_key, comment),
<<~EOF
-----BEGIN OPENSSH PRIVATE KEY-----
#{([private_key_blob].pack('m0').scan(/.{1,70}/m)).join("\n").chomp}
-----END OPENSSH PRIVATE KEY-----
EOF
]
end
kg = ssh_keygen_ed25519
puts "PUBLIC KEY:\n\n#{kg[0]}\n\n"
puts "PRIVATE KEY:\n\n#{kg[1]}\n"
This code is some ruby and could be made into a gem; if you can accept or mitigate the security issues in the ed25519 gem, have at it. I think it answers the question, anyway.
But for that bit of the question in parentheses, here's what I would do in reality:
require 'tmpdir'
require 'tempfile'
# first, don't let anyone else touch these.
# these files can't be opened twice but security in depth, plx
oldumask = File.umask 0077
def ssh_keygen_ed25519
Dir.mktmpdir do
|dir|
newkey = ""
newpub = ""
keyf = File.join(dir, "key")
keyfq = "'#{keyf.sub(/'/, %{'"'"'})}'" #escape the key filename for bash later
pubf = File.join(dir, "key.pub")
File.mkfifo(keyf)
File.mkfifo(pubf)
keythread = Thread.new { File.open(keyf) {|f| newkey = f.read} }
pubthread = Thread.new { File.open(pubf) {|f| newpub = f.read} }
ssh_keygen_output = `yes y | ssh-keygen -q -t ed25519 -N '' -f #{keyfq}`
keythread.join()
pubthread.join()
return newpub, newkey
end
end
puts ssh_keygen_ed25519
This creates a temp dir, creates two fifos in it to take the contents of the keys from ssh-keygen, creates two threads to read those (the threads will complete their work when ssh-keygen closes the files and the variables will be filled when the joins return), runs ssh-keygen in the main thread and says yes to the prompt for whether to overwrite the files (the fifos), then prints the contents. Nothing too fancy and you get to use the ssh-keygen you know and love.