How to use `openssl asn1parse` or equivalent on output files from `ssh-keygen -t rsa -b 4096`?

Question

I generate an ssh key:

~ ssh-keygen -t rsa -b 4096
Generating public/private rsa key pair.
Enter file in which to save the key (/Users/kurtostfeld/.ssh/id_rsa): rsa_key
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in rsa_key.
Your public key has been saved in rsa_key.pub.
The key fingerprint is: <snip>

If I use an empty passphrase, I can successfully parse the private key file like this:

~ openssl asn1parse -in rsa_key

If I use a non-empty passphrase. This doesn't work. How can I parse an RSA private key with a passphrase. What format is that?

Also I can't parse the public key at all. This doesn't work with or without a passphrase:

~ openssl asn1parse -in rsa_key.pub
Error: offset too large

How can I parse the RSA public key?

Answer 1

The private key is like a PKCS#8 encrypted private key. However, it misses the wrapper that indicates the type of encryption used. Instead, this information is present in the PEM header.

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,12FF93A74CD3E34DFEF8B1CF04FFEFA6

bsUb0TiyTU9RML8PteBhjd1vwdDv/MB8kR6+J1506dkS3+t1b6mEYNKDkZeQYPPt
...
mnLNzPODtVFrEeinQcfzQCCIS+VOrtTE3dJ3bklN8he3qQmnDC9+nyQsX2Q8EuUw
-----END RSA PRIVATE KEY-----

So the base 64 encoded contents of the PEM encoded private key is just the ciphertext that makes up the wrapped private key. As the ciphertext is indistinguishable from random you won't find much structure in there. To parse it you will first have to decrypt it.

As for the SSH public key, the key is in OpenSSH compatible format, which isn't specified using ASN.1 and doesn't use BER/DER encoding.

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDTYu/U8i2a+AVe0GnZJbpJCRFwPa4yN0S77x0ZTKUudzx9OXf20reuiaDarH6x+r1XMvh/9EwarRw3CquXAdEIZ4O2AZHmgvkQCJK1Q7ZRN3rpfIrMMPqjf7NLAEmUNoI/oS977jSynRtBK001NGD4YqY9uuFLyMHPqEwR9Ii
...
/yE8pvaO6qJIIzNbTQ== maartenb@Lenovo-PC

So trying to parse it using the asn1parse will obviously not work. You would need to use SSH itself for that. One way of doing that (the long way) can be found here.