is there a john the ripper for ssh keys

[Taulmarill]

For a while now I've been looking for a tool to audit encrypted private keys looking for ones with a weak password. I do this right now for unix shell accounts with john the ripper and am curious if someone here knows of a similar tool for analyzing and cracking ssh keys.

An open source command line tool would be preferred, but if there are only win32 tools, thats all right too.

[ls]

you mean an offline cracker right ?

what about this : http://www.securiteam.com/tools/5EP0R1FCKK.html

[Taulmarill]

Yes, offline. I have access to the encrypted private key and want to test if the password used for that is easily guessable.

That thc-ssh-crack looks like the exact functionality i was looking for, thank you.

Other suggestions?

[Sparda]

How will you know when you managed to decrypt the encrypted key? Both the encrypted and decrypted will just appear to be random data.

[LSB]

Looking at the code it doesn't seem to attempt to decrypt any data using the key, it only tries to read the key using the OpenSSL library.

For password-protected private keys, I'd imagine an attack is a simple task of iterating through a dictionary and popping out when the function returns a non-null value which will ultimately signify that the password given matches the password for the key -- which seems to be exactly what the code snippet does.

Now if I could just get the libs in the right spot to compile it.. :~(

[sablefoxx]

Crack a SSH keys,

You'll need a few hundred super computers (working together), a few thousand years (prbly more), and if your REALLY lucky you may decrypt the key!

[Taulmarill]

You'll need a few hundred super computers (working together), a few thousand years (prbly more), and if your REALLY lucky you may decrypt the key!

This is not about recovering the private key from the public key or decrypting intercepted data traffic. Did you even read the thread or just the subject?

How will you know when you managed to decrypt the encrypted key? Both the encrypted and decrypted will just appear to be random data.

I'm fuzzy on the details here, but ssh-agent and ssh-add tell me, when i mistyped my pass phrase, so there seems to be a way to verify if the attempt to decrypt was successful.