[JIRA] [gerrit-trigger-plugin] (JENKINS-12690) JenkinsTrigger does not understand SSH Key with a password

[svano...@cloudbees.com (JIRA)]

Title: Message Title

Sam Van Oort commented on JENKINS-12690   Re: JenkinsTrigger does not understand SSH Key with a password I've investigated this, and it has a fairly simple root cause: unsupported decryption algorithm, in the gerrit-events library. I wrote a trivial test for gerrit-events to decrypt the attached key: @Test public void testPassphraseParsing() throws Exception { Security.addProvider(new BouncyCastleProvider()); // Get locked keyfile as file URL url = "" class="code-object" style="color: #910091">Thread.currentThread().getContextClassLoader().getResource("com/sonymobile/tools/gerrit/gerritevents/id_rsa_passphrase"); File file = new File(url.getPath()); // Fail if invalid passphrase does not fail SshUtil.checkPassPhrase(file, "wrongpassphrase"); boolean failure = SshUtil.checkPassPhrase(file, "wrongpassphrase"); assertFalse("Passphrase validation should fail!", failure); // Will fail with: Unsupported passphrase algorithm: AES-128-CBC SshPrivateKeyFile keyFile =SshPrivateKeyFile.parse(file); keyFile.toPrivateKey(PASSPHRASE); // THIS SHOULD SUCCEED AND INSTEAD IT FAILS! boolean tested = SshUtil.checkPassPhrase(file, PASSPHRASE); assertTrue("Passphrase validation failed!", tested); } (the encrypted ssh key is in the resources tet When run (with the encrypted key in id_rsa_passphrase, and PASSPHRASE = "letmein"): ??com.sshtools.j2ssh.transport.publickey.InvalidSshKeyException: Can't read key due to cryptography problems: java.security.NoSuchAlgorithmException: Unsupported passphrase algorithm: AES-128-CBC at com.sshtools.j2ssh.openssh.OpenSSHPrivateKeyFormat.decryptKeyblob(Unknown Source) at com.sshtools.j2ssh.transport.publickey.SshPrivateKeyFile.toPrivateKey(Unknown Source)?? The issue is that j2ssh ONLY supports DES-EDE3-CBC: if (!"DES-EDE3-CBC".equals(keyAlgorithm)) { throw new NoSuchAlgorithmException( "Unsupported passphrase algorithm: " + keyAlgorithm); } j2ssh-maverick is a solution for this (it DOES support AES-128-CBC), but requires some dependency changes to add. Add Comment   This message was sent by Atlassian JIRA (v6.4.2#64017-sha1:e244265) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.