Jenkins Google Summer of Code Office Hours, 2 Jun 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: GSoC 2021 Git credentials binding 2021 06 02

Description

Git credentials binding project office hours for Jenkins Google Summer of Code 2021. Topics included passphrase protected private keys on Linux and Windows username / password credentials.

A

Welcome it's the git credentials binding project, uh and this is the 2nd of june. It's 7 30 a.m. India standard time thanks very much for being here. Remember we abide by the jenkins code of conduct so agenda topics. I had questions from the last meeting uh task to update jenkins.io with a more detailed project description and then how things are going with private key with passphrase uh how things going private key without passphrase and username password binding prototype on windows.

A

Any other topics for the.

A

A

All right so reshab you had mentioned that you had some questions. Are there specific topics you wanted to.

B

um Yes, they are around the conversion to pen format of the open, ssh private around. I I just asked you questions around this topic.

A

So by that you mean this, this material here and decode; okay, so that's probably best for harsha to answer rather than for me to attempt to answer.

C

And that should be okay. Yes, so um should I ask yes.

D

C

B

uh I was reading about um open, ssh primary key, and um so I understand that we want to convert it to a pem format.

B

Correct me, if I'm going to convert it into a pen format, because we know that uh open ssh versions are not bouncy castle. Api does not support uh different outcomes, such versions, so we want to standardize that by converting it into a pen format. Is that correct question.

E

Yeah I mean openness is a general now generates keys by default in the new format that is proprietary so, and the bouncy castle. Api only supports pem format, although there are a lot of other formats, but uh only supports pem, so the conversion part has to be specific on the pem format.

B

Okay, so um so my next question is that, uh and I'm not sure if this is the right one, but my limited knowledge with them is that I've already seen certificates uh primarily dot x, 509 certificates, the.

B

And about private keys, what we try to do here is that we want to um if we are talking about an open, ssh, encrypted private key.

E

uh No decrypting will be like uh when the uh as such private key is encrypted by a passphrase. So, okay, it will be we. What we are trying to do is encode it into another format. We won't be decrypting it decrypting would be something like uh showing the underlying structure of that key. It is in a sni dot, one something but open ssh. Don't support that.

B

So your question when I was looking at the question you had in your chat, you were saying that to convert it into pen format, you need two things, and that is the encryption algorithm and you mentioned one more thing right.

E

B

A

A

So ssh key gen does not can does not. Output cannot output, pim format.

E

No yeah mark you have written the command right it will. This command will output the format, but if we don't use the m option, then it will not it by default, it will output in a new open, ssh format.

B

That's correct I I was just. I was just trying to understand what the process is there and why we're doing that.

D

I wonder if you're asking a similar question to what I was asking uh in the doc too. My understanding is we're trying to decrypt the we're talking about a password key right.

D

C

D

So I think my understanding is the reason we want to decrypt it and then re-encrypt in another format is so that um we don't have to pass a key with a passphrase down to get cli so that we have to like do terminal dance stuff.

D

So this will convert.

C

D

Without a passphrase, and then you don't have to worry about the terminal prompts.

D

E

Get that right, yeah, that's one reason. Also we don't have to create any additional file for storing the passphrase as well as it will be decrypted. So there's only the key and there's no need to use the password.

D

Okay, yeah make sense too.

C

Yeah, I think that's that's what I need.

A

I mean I'm a little bit astonished actually that there isn't a trivial way to convert an open, ssh private key um in java, but I gather that you've searched and haven't found any way to do that.

B

Oh well, I is that it was that question for me.

A

No, no, it was for it was for uh harshit.

E

um Yeah mark I I looked in, I mean I looked for in bouncy castle, javadocs and j ca javadocs, but I couldn't find much information on that, because the format they support mean the the functionality they provide is basically around the algorithms. The first we need to know the algorithm encryption algorithm. We we have generated the key in. If we have not been able to figure that out, I mean we won't be able to perform other operations.

A

Okay yeah, I just and I see if what looks like a commercial implementation called maverick but yeah, I don't see any open source implementation.

A

So yeah I I just that's, that's really quite impressive, but I think you've you've hit it. That's.

B

So um I just wanted to share a small thing here that um I have one strike.

B

Sorry, so I have one strike: converting uh rsa encrypted private key into a pks, cs8 format, private key programmatically, and so I I I checked that code. Once I was looking at what hershey was saying that we need the algorithm as well, and I please correct yes, I um that's, but I I'm not sure if, if it requests two things, the only thing I remember to convert converted- and I am seeing my code here- is that I I need the algorithm with by which the private key the input private key is encrypted.

B

And after that um yeah. That was what I used to.

A

So so in and you say, work with rsa did it also work with? um Does it also work with uh roderi ed25.

A

Ec dsa and possibly dsa.

A

It's I'm quite interested.

A

This is the new format. You are new, only a four or five year old format used by openbsd, so the open, ssh people- and this is a predecessor I think to it- and this one is an old and, I believe, almost deprecated.

B

So so I am using the java security package and this is key factory uh which I have used to do this, but I I have to look into it more to be able to answer that question.

A

Okay, all right because if I remember correctly, oh go ahead.

E

um Yeah, I'm sorry, okay, so uh the key factory I had. I have worked on that as well. I mean there is a javadoc which tells which type of algorithms could be used in different types of classes.

E

So there I mean two three to four algorithms: are there in key factory, then there is a key generator as well and they have five to six algorithms. For that.

B

Well, yeah yeah, so the way it is working is that we have to provide the algorithm yeah and the key spec, and that key spec would be uh the the type of format we want to convert our input key into. That is what I can see if I, if I share three lines of code, which essentially capture and I'll, share them in the chat.

E

Yeah I mean key spec is not a problem because it's an interface and there is no method, implement method implementation or to override. So I have done that. I have implemented a class. I have created a class which implements the key, spec and and created method specific for our purpose. But the main problem for me is to is the algorithm and the format.

B

Okay, so I I should, I think there there are two, so I can see two implementation of those specs one is for pkcs8 and one is for x509.

B

So yes, maybe it's not for uh okay, so the x, 509, encoded key space must be for the pen format or okay. That's that is not always necessary.

A

Well, but but harsha you didn't, you said that the challenge was identifying the encryption, but isn't isn't the encryption?

A

Isn't the algorithm encoded in the heading of the private key file.

E

uh No, no, that.

A

Is what I was awesome, the dsa one which does, though rsa definitely does it says, begin rsa private key? I just looked at one of my rsa private keys.

D

A

D

If you, if you create an ed 25519, maybe even an ecdsa, I think.

F

D

Include a header that looks like this yeah also, but I think the old ones just show what you're.

A

Kind of showing there- oh, oh so these that I'm showing are not pass passphrase protected, that's correct! So these these are not passphrase protected, but yeah you're right. If I grab the one that is pass rates protected.

D

Oh and it says, begin rs yeah mine, says, begin rsa, private key, and then it continues with this.

D

I actually stole that that line from stack overflow instead of my using my own private key.

B

D

Can you choose.

B

The specific format algorithm, so I think, by default it does not um encrypt it with rsa.

D

So I I chose to pick an ed25519. In fact, github is actually changing their direction to their instructions, to use those as well.

A

Best key ever good choice.

A

The bsd people are really serious, open. Bsd people are really serious about their their crypto. I mean really serious.

D

Yeah, so you pass dash t so here's the new here's, the github guidance and you basically pass t and you specify ed25519.

D

I yeah, I guess I could have put that in the dock. Sorry.

A

If you're in the dark ages, you have to use this other thing, santos, that's the dark ages. You guessed you guess where darkness lies very.

A

Good okay! So so, but but back to the question, I thought that this heading was was a known quantity to determine the type of the algorithm used to encrypt, but harsh that you're saying it's in general. Not.

A

Whoops, why did you just change my our ed25.

D

A

Supposed to be like this- oh so picky, okay, god, I'm sorry very good. Okay,.

D

So it actually does have rsa, it doesn't say, open ssh. That's why I changed it.

A

Well: okay, so then you're using an rsa key, not a not a an ed 25, 59 255.

D

9., no I'm fairly certain. This is the 82.

D

I'm fairly certain that this is 82.519.

A

Okay, what version of openssh are you running? Well, let me check mine's 8.4 and it just calls itself begin open, ssh, private key and the next one is so. I guess harsh. What we're illustrating is that there are many many ways to do this, but your second one, your second.

D

And third line look like mine: I think that's the critical bit second and third line this one. No, no! I don't have.

A

Those lines nope, my my, but let me generate a new one, just to be sure, okay, sure yeah yeah. I can do the same. I just generated one and yeah. I just generated this one uh ed two five and I I solemnly promised never to use it, so I'm gonna paste pretty much the whole thing.

A

Okay, so here it is. This is the whoops.

A

A

A

Looks like this.

A

All one line: okay, we're gonna, do micro, font.

A

Oh okay, whereas public private, key oops.

A

Has a heading that looks like this.

A

And this is a pass-free protected key, so I'm not sure what to say about now. That's an 80 25 5 1 2 5 5 1 9 protected passphrase protected private key. Let me try the same thing with rsa.

B

So can we say that all ed25519 protected private keys are always going to be like this, because I was also under the assumption that the header would include the information about the algorithms.

A

B

Because if we can consolidate that fact, then yeah yeah.

A

I mean I can, I can certainly do checks. We've got. I've got access to lots of systems where I can do the checks to to see what format they take. So so that's that's a survey that well and actually harshit you've got access to centos. You said right, so you could. You could certainly check the boundaries you've gotten. If I remember right, you've got an ubuntu system or a debian that would be relatively modern and then centos if you've got centos 7 it's about as old as we're going to get.

D

Please feel free to laugh at me, uh you're correct, mark. um I was on the wrong machine. Oh good. I like that. Okay, that's a relief! Actually! Yes, I was like what, because I saw what you said and I was like yeah. I think he's right here. What's going on wrong machine.

A

So let me check for just okay, so ed25519, okay and then.

A

Now, even okay, so I don't see the prototype four on mine, but it may be because of my version number, my even for rsa.

D

This one, I think, is a passphrased and I don't remember which cipher I used. Okay, I may have used.

D

Yeah, I think I just used a strong um yeah.

D

Okay yeah you just use 4096 bits, probably okay,.

A

Yeah and so harshit, I'm not sure we're helping much in terms of you've got we've. We've got a challenge here. The challenge is still. How do we deal with passphrase protected private keys.

A

And I think you've is your sense that you've found a solution through the the convert to pem and then use bouncy castle, or I assume that'll require that you call ssh keygen from the command line.

E

um Yeah, I was previously doing this only, but I mean this is not. This is a tentative solution and the user might not have the ssh keys and utility or the open, ssh keygen utility they might have. You just got the private key and just pasted it in the jenkins credentials.

E

So I mean this is just a tentative solution. As such kegen.

A

Yeah, I'm I'm I'm open to eat that tentative solution even now, because it's perfectly okay for us to say you must, ha I think it's okay anyway, for us to say you need to have ssh installed on your image so that we can use it. We've got to be able, I mean. Actually I guess I I should say it differently. They already have to have ssh installed, at least enough of ssh, that that git can use ssh for transport.

A

So I think this is actually pretty safe. If even if you had to do it long term, it's not not especially pretty forking a separate process to do conversion, but we could conceivably limit the number of times we do it.

D

So is that key that ids rsa key on the convert to pem format? Is that like so, I did notice that if you use the 80 25 59 25519, it wants to store your key in id sorry yeah id underscore ed25519 as a default rather than id rsa.

A

Right and that's typo it well for 80, 25 519, you just change the file name.

A

Yeah this one, this one is the the example here I took as how to do with an rsa key you'd use the same thing, but change it to do it with with uh id ed25519.

A

Oh interesting, okay, do convert to pam can't convert on my system anyway, can't convert an open, bsd format and ed25519.

A

But it can convert an rsa.

A

Although that looks an awful lot like an rsa.

A

A

Okay, so harsha you're you're exploring the right place. This looks.

A

A

So any other questions on crypto and crypto algorithms.

E

Well, I was thinking if we cannot figure this out. We can fall back to the previous method that we are using in the client, client plugin right now,.

A

Yeah- and that was the uh answer- the terminal prompt.

A

With a separate file, that's what you're, meaning, I think, as an arshad.

E

Yes, like there will be uh now how many like three separate files for passwords projected protected keys if using it.

A

Ssh yeah, I think I think that's reasonable. We've got a you've got a plan as to how to handle it. We would prefer the simpler. We would prefer the more elegant way. If the elegant way doesn't work, then we can fall back to the the old way.

A

A

Any other topics on oh go ahead.

E

No so I mean like we are we asking the user to convert the key for us or do we have to use the click like? There is a launch command option as well in with client. I have not tested it, but using that we have to use the perform the ssh operation to convert the key into plan format.

A

I assume that the plugin would do the conversion, because the user already has private keys stored in their system.

E

Yes, so the conversion will be using ssh keygen.

F

A

And the problem is ssh keygen for certain key.

F

A

Fails for fails with.

A

For ed ed25519.

A

So it can't do a convert to pem and I assume that may be, because there isn't a pem format to support the openbsd format.

A

A

Next steps, then, for you harshit: what's what's your plan next.

E

Currently I was holding this back and I was working on the I mean the good user password credential binding for windows.

A

ah Okay, so that's a good one to report on. Should we go there and hear how that's how that's doing so.

A

Username password binding on windows share with us how it's going.

E

um I have a lot um like. I have just read the what I have not started that much like. I have just read the git implementation of windows, credenti in the windows credentials and I'm like figuring it out right now,.

A

A

Great all right.

E

I mean, like I spent two days working on that only so, and.

E

On the yeah, the assistant binding.

A

Well, and and that's there, it's obviously a complicated area. So yes,.

A

A

Okay, any any other questions or topics we need to discuss today.

A

We we did have this topic that we need to before end of community bonding period. I think we want you to get an updated description of the project onto jenkins.io.

A

See if I can find the pages where those go.

E

I mean I will uh we will update the dock. Only after when I have figured out that the bouncy castle api is working, fine.

A

Okay, I I just my thought: was it's probably good for you to to post something there sooner uh well, I would think before we conclude community bonding on the seventh that be good just to show hey here's, the progress we've made so far, um here's what we've got, but that's still six days away. So you are five days away. So you've still got time.

E

What changes do I have to make in that.

A

uh Well, I think I think the goal would be share either your design document or your ideas of or the results of, your exploring. You know, basically, it's a a post to describe here. Let me look and see just I've got to see what others are doing. Just a minute: github jenkins, dot io. I think we.

C

A

A

No, where is it.

A

No, that's not it aki dash, seven! Okay, so maybe I'm mistaken, let's see so what have we got here.

D

Yeah so oleg had pr, I think.

D

A version of the new sites.

A

Oh yes, here it was update the gsoc 2021 remote monitoring project page. So here's the example right and this one is the projects page showing. Oh okay, that's a fairly simple update. So this is not a large scale update.

A

A

Also, pretty simple: okay, good all right, so none of these are huge harshed.

A

All these two updates did was correct: minor errors in the original pages.

A

So let me paste a link to those as examples.

D

Yeah and then kind of for the rest of the project, you'll kind of keep that up to date with timelines, and that's where we'll post, like your blog post, updates and stuff like that.

A

A

uh Likewise, probably on a plan for a demo after first demonstration, after first release or after you know at at some progress point, I those have typically been in jenkins online meetups. If I remember right and usually as a group, multiple multiple projects present in a single meetup.

A

10 to 15 minutes each what's.

F

Happening about.

B

The phase one evaluations or is.

A

It before that is this, I think I think this is probably at the end of phase one is where I'm guessing for sure it will be at the end of phase two.

A

Yeah, these are absolutely this is later. So maybe what we should say here is phase phase one end or possible or phase two end.

A

And possibly earlier.

A

We'll need a blog post and demonstration and because did rashad didn't last year. We have you, do two different demonstrations. There were two points where we had to do join a meeting and show.

B

I actually we have. We had three, um I think evaluations last time, phase one and then the final one.

A

Right and certainly phase evaluations, I wasn't sure, did we do a demonstration at each of the phases.

B

A

ah Okay, so then you should plan the same. That phase one end demonstration and 10 to 15 minute with a demo in a 10 to 15 minute talk.

A

And same for phase two.

A

A

A

And her you're, okay with that.

E

E

A

Any other topics we should be sure we discuss today.

B

If there is none, I want to come back to the pem file. Conversion from the key factory thing.

B

So my if so my my question is that or what I'm seeing is that um the pem format is essentially a base64 translation of x509 keys.

B

So if, if I'm not wrong about that, then um I can see that so what was talking about the key spec and the algorithm required for us to convert it into pem. So let's say we know the algorithm. um I can see that there are two default implementations for the key spec one is for the pkcs8 format. The other one is uh for the x509 format, key spec. If we're able to do that and then we um encode it with base64, will we reach with the pem format?

B

Private key is something I I want to. I don't know explore, or am I saying something wrong there.

B

um Okay, so I guess I I just want to ask: is that? Is there a conceptual mistake, I'm making when I'm saying all of this.

A

I I didn't hear any conceptual mistake, but I'm not a not a crypto expert say it again.

B

So what I mean is that uh this, the code I shared here is is is a way where, where I converted the rsa encoded private key into a pkcs encoded key, which was then I used that to store it into a keystroke. That is how I used it now. What I'm saying is that um it requires two things for for the conversion. The first is the algorithm which I I haven't shared, but it was essentially rsa in my case. I knew that it was always going to be the same case.

B

Let's say we know the algorithm. um We are sure that we can understand which algorithm is used to encrypt the input key we will have. The second thing is about the key spec and both of those things are used to generate a private key programmatically using the key factory.

B

So I can see two default implementations in the java security package for the key spec. The first is for the pkcs8 format and the second one is the x509 format.

B

So uh from what I know about pen format, it is a base, 64 translation of the x509 uh key. If, if that is not wrong, then essentially what we have to do is to convert this using the key spec of kf x, 509 and then base 64 encoded.

B

If we do that, then do we arrive well, I I'm not sure if that is the correct hypothesis, but that's what I'm thinking that do we arrive at a time format.

B

D

Maybe I should try it first.

A

Yeah, I'm not sure so you well, okay. You were saying if, if since pem is at base64 encoded, your question was: if you convert pkcs8 to base64 encoded format, do you get pam.

F

uh Not not pkcs format but.

A

X519, oh sorry, x509. So if you convert x5 and 509 to basic and and that I do not know, yeah that's way beyond my depth,.

B

I think it's a simple experiment, considering that we already have ssh keygen uh a way to convert it. I can just use this and then compare both of them. If I'm arriving at the same conclusion, then I could be a way to programmatically convert the keys into pem format.

E

B

E

Articles explore, I could share a few links like that, will be helpful, so everyone on the same page, okay,.

F

E

So, let's see in the chat.

A

In the chat would be great or you can paste them in the document either would be fine I'll if you paste them in the chat. I promise to copy them into the.

A

A

B

Okay, so so, if we do not find a way to programmatically, do this I mean using a java library, then we are defaulting to using ssh key genre.

A

That's that's my understanding, okay, and if we can't do with ssh key gen, we have to fall back to do the the the terminal dance that is done by the git client plug-in today.

C

So we we do have uh two.

A

Yeah, so now, how should you did you have other links because there's this link from stack exchange that talks about a java implementation of ed25519?

A

However, I have no idea how good or bad that java implementation is, or it's oh, it's released to the public domain, so at least it is um available.

A

But again, no idea how strong or weak it.

C

A

Oh yeah see here is.

A

A

Okay, now now wait a sec okay, so here's another one as a question harshit. You might want to look at this one which talks about generating ed25519 private key parameters.

A

Now, I'm not sure what version of bouncy castle that requires.

A

A

A

Okay, where do I find the bouncy castle.

D

Javadoc, okay,.

A

Okay, so apparently it's not in here ed25519, oh no, there it is okay, so there is at least bouncy castle. Has the concept of.

A

It interesting okay, so so so this now, if it's got eighty two five, five one nine, I would assume it also has rsa private.

A

Key rsc private key structure.

A

Yeah so so and harsha you had investigated using bouncy castle, but it doesn't did it not? Oh wait a sec bc pro okay bc, pro.

A

I don't know which one I'm looking at so so my worry is, this may be too new.

A

Do you see a jdk8, I'm not seeing it.

A

A

Fibs, nothing in the.

A

A

Okay, but there is an rsa private key.

E

A

Okay, so so I don't I'm just I'm not helping here at all, I'm afraid, I'm just doing wild guesses excuse my distraction.

B

C

B

Worth investigating, I I'm sure harshit has investigated it uh so, but if we see um yeah.

E

E

um Sorry, for that I mean, like you, opened the java talk of bouncy castle api um was it of jenkins or the bouncy castle.

A

This was the bouncy castle api for for bouncy castle itself, and it's it's a version that I don't know what it's actually expressing here harshit and I apologize that I'm not familiar with that, but this looks like it's the bouncy castle, api for or javadoc for various versions of it, and I think I read that we're running.

A

I guess I should be able to look it up shouldn't I some place inside jenkins.

A

There will be a reference to bouncy castle.

A

Okay, it's in the bouncy castle, api plugin.

A

D

To be a 1.54, maybe okay, now how did you decode that, so I I'm looking at the plug-in.

D

Page yeah there you go yeah you're there, so this.

D

That's instance: identity modules, I'm not sure. If that's the.

A

Same yeah, so how about? If we look here inside this thing's palm, I would expect it's got a reference to bc, something or other okay yeah there. It is so it's using bck bcp kix jdk 15, o n 1.68.

A

So that is the current version.

A

A

It's worth exploring further to see if you can use.

A

Let's see ed true, five, okay.

A

A

No, this version of it doesn't seem to have it. Where did I find it was.

A

A

Oh, it's spelled wrong.

A

And this one is in b c p r, o v dash e x t whatever. That means.

A

So I'm going to speculate that bcprov this one.

A

Yeah there it is okay, so there there does seem to be a bouncy castle library that provides it. I'm just not sure if we can use it.

A

So how should I assume you're? Okay, if I embed a link to this into our into our.

A

Notes in hopes that it'll help you somehow.

B

So we can directly add bouncy castle api as a dependency to get client plugin right, so we can use our own version. Why would we.

A

We well we we can accept. I worry that that I don't know what what this one means that particular, what does prov mean in this case, is that provisional? Is that um something there's there's some concept there that I don't think I've ever seen that reference, and so that would be something just to check to be safeguarded to see. Okay did it? Does it in fact do what we want and will it can we use it?

A

Let's put the let's put the reference into the document.

B

We want to reference to the um we want to take the bouncing st api plugins dependency as a reference, because that we know has been tested within jenkins environment. You know it's safe.

A

A

But so the idea, then the question is, but that is probably not inside the.

A

A

Api plugin and that we should be able to check right just to do a quick look.

A

Okay, here, if we look at what's included in its pom file, it's only got that single library right now.

A

Now that doesn't stop us from using it that doesn't prevent it. It's just it means we've got it. Harshit would have to do some more research to be sure is. Is it okay that we include that inside jenkins and does it solve the problem? It may not solve the problem if it doesn't meet the needs, then including it in jenkins, is irrelevant, but harshad it seems worth it. If you can stand to do the exploration to do some exploration around this particular api and see if it'll.

E

E

Yeah well, this is, for specifically, uh I mean.

A

This particular one yeah, this one is is specifically for the ed25519, which is the open, ssh format and then there's our open, ssh encryption. And then there is another one for rsa oops, not that.

A

And if we keep looking here, we should see rsa private key yeah. So here's the one for rsa.

A

And I bet there is also one for dsa yeah. Here's the dsa one.

A

And I would bet there's one for ecdsa yeah here it is ecdsa public key. So so it looks like there. There is at least some representation in this in the la in this particular library bc. Pro ext jdk 15 on that might be helpful.

E

But using that won't be requiring the noise that we know the algorithm.

A

Oh no, I think I think it will require that we know the algorithm, but I think you can I'm I'm reasonably confident you can determine the algorithm by looking at the the header of the.

E

File open, ssh, keys, sorry open the keygen generate keys by headers, open sh, open ssh private key. So I am not sure if the headers could help us.

A

Yeah well, and what open ssh private key means is: that's the open, ssh format and open ssh format, uses ed25519.

B

E

In manual it says, by default it will generate keys in rsf algorithm.

A

And that is that is what's done by default until um I think openssh on on openbsd now has changed that, let me go look just to be sure.

A

That's where they do their leading their leading edge development. Oh yes, here it is okay! So now it says, ssh keygen will, by default, write keys in an open, ssh, specific format.

A

It is still possible to write them in pim.

A

No, that doesn't tell me if they're always ed, two five one, two five, five one, nine.

A

Oh- and there are even new formats dash.

A

A

Okay, so I can't tell which.

A

So by default, mine's doing an rsa key, even with the most recent open bsd.

B

And if it is an rsa key, then we would have.

B

The header would contain that information right. It would not be.

A

It would right so s is so if we do ssh key gen, minus t, rsa minus f.

A

This will generate the private key and now we're going to look at it.

A

Oh, I made a terrible mistake: that's good! Okay! Here's the begin, open, ssh, private key, that's rsa! How can it okay, so that I think I see your point harshet it just generated a key that it says is open, ssh, private key, but it's definitely not ed25519 format.

E

A

So so now I assume what we have to do is something like this, where we say.

A

Back to your, it was minus e minus m pam.

A

And now it's generated something that explicitly declares itself to be an rsa public key and now, where did the private key go? So that's yeah so more to be done. There.

E

I mean if we are able to generate into pam format, then there's no need to know the algorithm like bouncy castle, sport spam format. So it's easy for us from there.

A

Okay, all right.

A

So the complication then continues with how do we get it into pem format for all the things, and if we can't do pen format as ed25519 seems like we can't, then how do we handle those keys, and it may be that the initial okay good? I think I think I see where you're headed.

A

Any other topics for discussion today, oh our next session. Actually next session is a crucial thing. When do we want to meet next.

A

How does your friday look harshit and rishabh.

A

And justin does your thursday night at this same time work? Okay, I'm no good this thursday night! Again, okay and we don't have marky, did marky jackson talk with you uh with me. No, no okay, so marky marky jackson had expressed interest in being one of the mentors.

E

A

Yeah, I thought that would be great, but I've.

E

A

Him to this meeting and he didn't make it and he didn't make it to last friday's either. Okay, he declined today. So that's fine, but we really do need him well, it would be great to have him. He certainly got experience with yet.

A

Okay, so two days from now, then, uh okay with.

E

Everybody yeah yeah.

D

Feel free to go go ahead. Without me, um I will do the same follow-up.

A

All right, okay, and that that then I'll have one more meeting next week and then I'm offline.

A

I wonder if marky had a problem with uh with time he had said that it was okay with him, but it could.

C

A

He may have, he may have had a problem. Absolutely I mean personal schedules are what they are, so I'm going to send everybody an invitation for two days from now same time, cool all right, thanks, everybody anything else before we close.

B

um I just wanted to say that so we're going to explore okay, so we're going to explore the validate validity of the possibility of converting the different algorithms privately into pembroid or we're abandoning the idea right.

A

Now I think that harshit intends to explore converting the various algorithms to pem so that he can use bouncy castle. Harsha did I understand correctly.

E

No, that's! That's not! That's not my plan b, my plan, a is using the ssh keygen from the grid, client plugin, using launch command function or functionality that provides.

A

A

Because that's what you've got working.

E

E

I mean I did the research on working on converting the formats, but I didn't come up to a conclusion, so I think that should be for me the plan b instead of pursuing it further and maybe delaying the it will be delaying I mean it will be delaying the progress.

A

A

So ssh key gen is really the preferred path.

A

So rishab, if you've got additional data that can help harsha you're, certainly welcome to share it and, and I'm sure suggest alternatives.

B

Yeah, I think I'm going to investigate a little bit before you know saying more on that, because I I do need to look into the bouncy gas api and the possibilities, because rashid has done the investigation. I think I am just going to look around a little bit.

B

I I also want to explore the concept of using pkcs8 um format to store private keys.

D

B

Not sure if, instead using it instead of pen is something we can do. I just want to look on that.

A

All right, any other topic: oh, go ahead, not reach out no.

B

No, I was just saying yeah, that's that's what I'm trying I'll try to do and I'll report on friday. Even if I have something.

A

Great anything else.

A

Thank you all right, thanks everybody I'll post recordings uh shortly uh the recording from last session. I think I already posted, but if not my apologies, I'll try to get it done.

A

Talk to you in two days.

E