Question

我正在尝试使用python模块paramiko生成SSH密钥对。有关密钥生成的信息似乎并不多。我已经阅读了paramiko docs，但无法弄清楚什么是错误的。我可以生成没有密码加密的私钥和公钥。但是，当我尝试加密私钥时，我收到以下错误。

ValueError：IV必须长8个字节

我认为上述错误来自pycrypto。我已经查看了paramiko.pkey和pycrypto中的相关代码而没有任何运气。

这是一个小例子。

import paramiko

def keygen(filename,passwd=None,bits=1024):
    k = paramiko.RSAKey.generate(bits)
    #This line throws the error.
    k.write_private_key_file(filename,password = 'cleverpassword')
    o = open(fil+'.pub' ,"w").write(k.get_base64())

回溯

Traceback (most recent call last):
  File "/var/mobile/Applications/149E4C21-2F92-4712-BAC6-151A171C6687/Documents/test.py", line 14, in keygen
    k.write_private_key_file(filename,password = 'cleverpassword')
  File "/var/mobile/Applications/149E4C21-2F92-4712-BAC6-151A171C6687/Pythonista.app/pylib/site-packages/paramiko/rsakey.py", line 127, in write_private_key_file
    self._write_private_key_file('RSA', filename, self._encode_key(), password)
  File "/var/mobile/Applications/149E4C21-2F92-4712-BAC6-151A171C6687/Pythonista.app/pylib/site-packages/paramiko/pkey.py", line 323, in _write_private_key_file
    self._write_private_key(tag, f, data, password)
  File "/var/mobile/Applications/149E4C21-2F92-4712-BAC6-151A171C6687/Pythonista.app/pylib/site-packages/paramiko/pkey.py", line 341, in _write_private_key
    data = cipher.new(key, mode, salt).encrypt(data)
  File "/var/mobile/Applications/149E4C21-2F92-4712-BAC6-151A171C6687/Pythonista.app/pylib/site-packages/Crypto/Cipher/DES3.py", line 114, in new
    return DES3Cipher(key, *args, **kwargs)
  File "/var/mobile/Applications/149E4C21-2F92-4712-BAC6-151A171C6687/Pythonista.app/pylib/site-packages/Crypto/Cipher/DES3.py", line 76, in __init__
    blockalgo.BlockAlgo.__init__(self, _DES3, key, *args, **kwargs)
  File "/var/mobile/Applications/149E4C21-2F92-4712-BAC6-151A171C6687/Pythonista.app/pylib/site-packages/Crypto/Cipher/blockalgo.py", line 141, in __init__
    self._cipher = factory.new(key, *args, **kwargs)
ValueError: IV must be 8 bytes long

Answer 1

问题

这看起来像paramiko中的错误。

如果您查看在pkey.py中引发错误的行，则为以下行：

        data = cipher.new(key, mode, salt).encrypt(data)

现在让我们看看它之前的行，它首先选择mode来设置cipher_name。

        # since we only support one cipher here, use it
        cipher_name = list(self._CIPHER_TABLE.keys())[0]
        cipher = self._CIPHER_TABLE[cipher_name]['cipher']
        keysize = self._CIPHER_TABLE[cipher_name]['keysize']
        blocksize = self._CIPHER_TABLE[cipher_name]['blocksize']
        mode = self._CIPHER_TABLE[cipher_name]['mode']

以下是_CIPHER_TABLE的内容。

_CIPHER_TABLE = {
    'AES-128-CBC': {'cipher': AES, 'keysize': 16, 'blocksize': 16, 'mode': AES.MODE_CBC},
    'DES-EDE3-CBC': {'cipher': DES3, 'keysize': 24, 'blocksize': 8, 'mode': DES3.MODE_CBC},
}

观察评论如何与代码相矛盾。有两个密码可用，上面的行选择cipher_name假设只有一个。

根据错误，似乎选择了'DES-EDE3-CBC'。如果我们查看DES3.py中的评论，我们会看到IV的以下要求。

  IV : byte string
    The initialization vector to use for encryption or decryption.

    It is ignored for `MODE_ECB` and `MODE_CTR`.

    For `MODE_OPENPGP`, IV must be `block_size` bytes long for encryption
    and `block_size` +2 bytes for decryption (in the latter case, it is
    actually the *encrypted* IV which was prefixed to the ciphertext).
    It is mandatory.

从paramiko的来源，我们发现没有传递IV，因此我们看到错误。

解决方法

更改pkey.py中的以下行，改为对'AES-128-CBC'密码进行硬编码。

   # cipher_name = list(self._CIPHER_TABLE.keys())[1]
   cipher_name = 'AES-128-CBC'

使用Python中的paramiko生成SSH密钥对

1 个答案:

问题

解决方法