Let's say you need a 256 bit password but all you have is an SSH key. Can you securely transform the SSH key into a symmetric password via a hashing function? What would be a good choice for a hash function?

  • $\begingroup$ Ah SSH public key, or an SSH private key? $\endgroup$ – Stephen Touset Oct 20 '16 at 22:58
  • $\begingroup$ Assuming they're both secret material, does it matter which one? $\endgroup$ – Blaze Oct 20 '16 at 23:09
  • $\begingroup$ A public key isn't secret material. $\endgroup$ – Stephen Touset Oct 20 '16 at 23:56
  • $\begingroup$ It is if you don't share it with anyone :) $\endgroup$ – Blaze Oct 21 '16 at 0:09
  • $\begingroup$ What's the purpose of having an SSH keypair if you aren't going to put the public key on other machines to SSH to? And if you are putting the public key on other machines, should all of them really be able to access this password? $\endgroup$ – Stephen Touset Oct 21 '16 at 0:19

Yes... Assuming:

  • That they were generated using enough entropy (probably yes if they were generated securely)
  • That they are only used for this purpose (I'd guess you can hash private key, but then as soon as it is compromised, your key is too)
  • It isn't done using public key, if that key is then published

As for hash function, any hash that isn't broken will do.

  • 3
    $\begingroup$ I'd recommend HKDF so you can assign a unique tag to it, and because it's explicitly designed for and has security proofs aimed at this purpose. $\endgroup$ – Stephen Touset Oct 20 '16 at 23:56

Before answering the question: What is a "256 bit password"?

The term password is usually used for low entropy, poorly chosen (mostly by a user) random value, in contrast to a (cryptographic) key, where we assume it is drawn with high entropy from a uniform distribution (truely random), or alternatively created by a cryptographically secure pseudorandom functionality (for example a KDF, PRF, CSPRNG or PRG. And none of those are the same).

And then it isn't exactly clear what you mean with "transform securely", because there is not a single definition of security, there are a lot of it. A hash function is one way of such a transform, and a proper hash function (state-of-the-art, with matching output length) does work as one-way function, with the usual properties of collision resistance and preimage resistance.

But actually, a key derivation function is the concept you are looking for. One possible realization is password hashing, possibly with salts. Another one was noted in the comments by Stephen Touset already: HKDF. There are also KDFs like bcrypt or scrypt, which are designed for poorly chosen inputs (usually called "passwords"), which still give good results by scaling the computational effort for dictionary attacks up.

What would be a good choice for a hash function?

If you want a suggestion for one explicit hash function, SHA-256 is most commonly suggested. In the future this might change, once the support of SHA-3 has become more common. Hash function can be building blocks for KDFs, but I would suggest to use an implementation of those directly.

And since you didn't answer in the comments if you want to use the private or public SSH key: If you use the public key, this is insecure by default, unless your key also depends on another password or cryptographic key. Just think of the public key as a random public value, and that an attacker knows the algorithm you are applying. Assuming otherwise would be wrong, see Kerckhoff's principle.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.