Cannot clone repository with SSH private key

[genigenigeni]

When trying to clone a git repository for the first time using SSH and authentifying with an SSH key, I get the error "Unable to extract public key from private key file: Wrong passphrase or invalid/unrecognized private key file format".

I have tried transferring the passphrase using a web server, ASCII Armored QR, and iTunes file sharing. I made sure the passphrase is correct, but it does not work at all.

This happenened after I reset the app in order to clone a new password store. For almost a year, the app worked as intended. An uninstall/reinstall did not fix the problem. The key itself is good too, as I can use it on my PC.

I got this error on both an iPhone and an iPad on iOS 12.0.0.

[yishilin14]

How you import the key doesn't matter. We keep the ASCII armored key. It is possible that the key format is not supported by the upstream library that we have been using. May I ask what is your key type? I think one possible workaround is that you generate another pair of keys.

We are trying to maintain a list of supported/unsupported keys. You may check https://github.com/mssun/passforios/wiki/Supported-Unsupported-Key-Algorithms to see some keys that are definitely supported.

EDIT: It seems like you were able to clone some of you other repositories. Are you using a new ssh key now?

[fortytw2]

I'm having this exact same issue with a freshly generated ssh key from ssh-keygen -t rsa -b 2048 and an empty password. Let me know if there's anything I can do to provide more info

iOS 12.0.0 on an iPhone 6S+ here.

[nylocx]

I have the same issue with a new iPhone (IOS 12) #202 prevents me from using https with my gogs git server and now this even prevents me from using ssh. My old iPhone also running IOS 12 works fine, but I cloned with an older version of pass for ios and gogs almost a year ago over https.
I used an rsa2048 key with and without a passphrase without success.

[max-baz]

This is because newly generated keys with ssh-keygen -t rsa -b 2048 start with this string:

-----BEGIN OPENSSH PRIVATE KEY-----

While previously the same command generated a file that started with this string:

-----BEGIN RSA PRIVATE KEY-----

So, the new format is not supported.

[yishilin14]

@maximbaz Thank you.

I will put this in Supported Unsupported Key Algorithms.
And I will add a link to this document in the key setup page.

[yishilin14]

@genigenigeni Would you please check whether using more compatible PEM format, not the newer OpenSSH format solves your problem?

@yishilin14 I just tried generating a key in the old format using ssh-keygen -t rsa -b 2048 -m PEM, but it won't accept the passphrase I provide it in Pass.

[hreese]

I wasn't able to convert an existing private key, but here is a way of generating a compliant key pair

1. Get puttygen; I used the version supplied by my Linux distribution.
2. Generate a new private key: puttygen -t rsa -b 2048 -O private-openssh -o pass_for_ios.key
3. Generate a matching public key: puttygen pass_for_ios.key -C "Pass for iOS" -O public-openssh -o pass_for_ios.pub

Resolved. Thank you @hreese I followed your steps exactly and it is working now-successfully cloned into my iphone. Easy peasy lemon squeezy.

[louiskounios]

I ran into the same issue and was able resolve it by asking ssh-keygen to generate a new pair of keys in the OpenSSL PEM format.

ssh-keygen -t rsa -b 4096 -m PEM -f ~/id_rsa

From OpenSSH v7.8 onwards, ssh-keygen will write private keys in the OpenSSH format by default. By using -m PEM we ensure that the key pair is in the OpenSSL PEM format, regardless of the OpenSSH version. -m PEM can be omitted as long as the -o flag is also omitted if OpenSSH is older than v7.8.

[wpcarro]

@brortao - I also couldn't get ssh-keygen -t rsa -b 2048 -m PEM to work. Strange since it output the "supported" headers:

-----BEGIN RSA PRIVATE KEY-----

@loizoskounios I tried your incantation as well, which judging from a glance is the same as @brortao's recommendation except with a larger -b size. I couldn't get this to work either.

I also tried using @hreese's puttygen suggestion and was unsuccessful.

In all of these attempts, passforios continually prompts for the password for my SSH key. The UI does not provide feedback about whether the password is correct or incorrect.

I've tried creating SSH keys without passwords. In these cases, passforios still prompts for a password; I just submit an empty password -- assuming this is the recommendation.

Does anyone have any more insight into the underlying issue? Should we use 2048 or 4096? How can we check the OpenSSH version our ssh-keygen or puttygen is using?

For puttygen, I'm using:

puttygen: Release 0.71
Build platform: 64-bit Unix
Compiler: gcc 7.4.0
Source commit: abfc751c3ee7d57bf3f127a458c40bb4ca2b6996

[kraem]

I've also tried both @hreese (with & without passphrase) and @loizoskounios solutions but no luck.
I'm getting the "Unable to extract public key from private key file: Wrong passphrase or invalid/unrecognized private key file format".

GIT REPOSITORY URL: ssh://git@IP/home/git/.password-store.git
USERNAME: git

SOLVED
Apparently the ”.git” in the GIT REPOSITORY URL should be omitted:
GIT REPOSITORY URL: ssh://git@IP/home/git/.password-store

That, in combination with @hreese puttygen solution worked for me.

@wpcarro does your GIT REPOSITORY URL include the .git ending? Make sure it does not. Worked for me when omitting it.

I'd happily update the wiki if I had permission to do so :)

[wpcarro]

@kraem what are you using for your SSH keys if you aren't using puttygen? I'm assuming you're using:

ssh-keygen -t rsa -b 2046 -m PEM

Also, are you using a passphrase for the key?

I tried omitting .git in the URL and using both puttygen and ssh-keygen commands - both without a password. passforios continuously prompts me for a password. If I finally hit cancel, I get the following error:

Failed to clone repository from <url> to <path>
Underlying error: GTCredentialProvider failed to provide credentials.