JSch giving invalid private key errors for key pair generated by Java

Question

I am generating a keypair using Java's KeyPairGenerator for use with JGit. However, JSch (the underlying SSH implementation for JGit) keeps giving me "invalid privatekey" errors when trying to use the generated private key.

Here is the stack trace:

Caught: org.eclipse.jgit.api.errors.TransportException: ssh://git@bitbucket.hostname/~wlaw/bitbucket_upgrade_test_repo.git: invalid privatekey: [B@4650a407
org.eclipse.jgit.api.errors.TransportException: ssh://git@bitbucket.hostname/~wlaw/bitbucket_upgrade_test_repo.git: invalid privatekey: [B@4650a407
    at org.eclipse.jgit.api.FetchCommand.call(FetchCommand.java:254)
    at org.eclipse.jgit.api.CloneCommand.fetch(CloneCommand.java:306)
    at org.eclipse.jgit.api.CloneCommand.call(CloneCommand.java:200)
    at org.eclipse.jgit.api.CloneCommand.call(CloneCommand.java:1)
    at java_util_concurrent_Callable$call.call(Unknown Source)
    at Test.run(Test.groovy:95)
Caused by: org.eclipse.jgit.errors.TransportException: ssh://git@bitbucket.hostname/~wlaw/bitbucket_upgrade_test_repo.git: invalid privatekey: [B@4650a407
    at org.eclipse.jgit.transport.JschConfigSessionFactory.getSession(JschConfigSessionFactory.java:183)
    at org.eclipse.jgit.transport.SshTransport.getSession(SshTransport.java:140)
    at org.eclipse.jgit.transport.TransportGitSsh$SshFetchConnection.<init>(TransportGitSsh.java:280)
    at org.eclipse.jgit.transport.TransportGitSsh.openFetch(TransportGitSsh.java:170)
    at org.eclipse.jgit.transport.FetchProcess.executeImp(FetchProcess.java:137)
    at org.eclipse.jgit.transport.FetchProcess.execute(FetchProcess.java:123)
    at org.eclipse.jgit.transport.Transport.fetch(Transport.java:1271)
    at org.eclipse.jgit.api.FetchCommand.call(FetchCommand.java:243)
    ... 5 more
Caused by: com.jcraft.jsch.JSchException: invalid privatekey: [B@4650a407
    at com.jcraft.jsch.KeyPair.load(KeyPair.java:948)
    at com.jcraft.jsch.IdentityFile.newInstance(IdentityFile.java:46)
    at com.jcraft.jsch.JSch.addIdentity(JSch.java:442)
    at Test$1.createDefaultJSch(Test.groovy:82)
    at org.eclipse.jgit.transport.JschConfigSessionFactory.getJSch(JschConfigSessionFactory.java:335)
    at org.eclipse.jgit.transport.JschConfigSessionFactory.createSession(JschConfigSessionFactory.java:293)
    at org.eclipse.jgit.transport.JschConfigSessionFactory.createSession(JschConfigSessionFactory.java:200)
    at org.eclipse.jgit.transport.JschConfigSessionFactory.getSession(JschConfigSessionFactory.java:130)
    ... 12 more

Here is my code:

KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA")
keyGen.initialize(4096)
KeyPair pair = keyGen.generateKeyPair()

def pub = pair.public as RSAPublicKey
def priv = pair.private as RSAPrivateCrtKey

Base64.Encoder encoder = Base64.getEncoder();
def publicKeyText = "ssh-rsa " + encoder.encodeToString(keyBlob(pub.publicExponent, pub.modulus))

def id = bitbucket.post {
    request.uri.path = "/rest/ssh/1.0/keys"
    request.uri.query = [user: bitbucketUsername]
    request.body = new JsonBuilder([text: publicKeyText]).toPrettyString()
    response.success { FromServer fs, Object responseBody ->
        responseBody.id
    }
    response.failure { FromServer fs, Object responseBody ->
        println fs.statusCode
        println fs.message
        println fs.headers
        println responseBody
        null
    }
}

def privateKeyText = "-----BEGIN RSA PRIVATE KEY-----\n" +
    encoder.encodeToString(priv.getEncoded()) +
    "\n-----END RSA PRIVATE KEY-----\n"

new File("priv").text = privateKeyText
new File("pub").text = publicKeyText

SshSessionFactory sshSessionFactory = new JschConfigSessionFactory() {
    @Override
    protected void configure(OpenSshConfig.Host hc, com.jcraft.jsch.Session session) {}

    @Override
    protected JSch createDefaultJSch(FS fs) throws JSchException {
        JSch defaultJSch = super.createDefaultJSch(fs)
        defaultJSch.addIdentity("test", privateKeyText.bytes, publicKeyText.bytes, null)
    }
};

CloneCommand cloneCommand = Git.cloneRepository()
cloneCommand.setURI("ssh://git@$bitbucketHostPort/$project/${repo}.git")
cloneCommand.setTransportConfigCallback(new TransportConfigCallback() {
    @Override
    void configure(Transport transport) {
        SshTransport sshTransport = (SshTransport) transport
        sshTransport.setSshSessionFactory(sshSessionFactory)
    }
})
cloneCommand.call()

I did some debugging in the JSch source code, and found that the library is getting an ArrayIndexOutOfBoundsException on line 228 in com.jcraft.jsch.KeyPairRSA.java.

Is it something I am doing wrong with formatting the keys for JSch? Or could this be a bug in Java's implementation of a KeyPair or perhaps JSch's implementation of parsing them?

Here is an example keypair that is generated by my code:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDNPvFmy81wj3L4ndJzMcYFa9YctDzz0KvXyb9vg+UQ5622kyE255fwL4eatihL8/TrH1OOLQtSVjThLwWObx4fQ6bk25rJA0jS7G7CAfAQwbTY9JpNrcH5HHtiAhbUjEF/MXU6IlPNCmBMQPFh1eSa21aIdYie+KVgXQnUP4qN6ks1iR8XX4YHpg2KKhEoJtaVYGHp15EmpRvDYzsheqrcfyg4N5taGgG9/GzdfpeBWqCyJhrjgso85ARecGTpqCHqFNy46tXtIMR6FL36UDc/EpWifmf7oY4HVLa0DJpLq2BHmjRlUtiFFox1Jzk+shFiDZYwnCmdKnpCnlxFQ1Hv06XLgvcUx/0mkleh14Nme/b61pmJDO05v9zKho+9Q+lNgrTK+kOeC7I9PgUePyzWJteys/0MqENJxvM4g65/r9vzpcSvdEziSJ8Y3xI3qlzOa3Av1Jv5qIntgjEeAnth+AANdUP/GcpYbnCNp1QsjaZoFKFe2DcUTYM3CGzh0SFm9CeRfBV1phQ2+5gi1bH5ZiAfTNpksZz+SYIPyEsbaqNRcBk53htWfINShNVP7a/b/H7tyZs+zvMoHN2bZzsIMIUWO8Df+owpCK7ZT/EadDZzkzG2LUUUjm6aVsz2rjLFcvQtYOs0U/+suWhXNQ2dAW4psGLHkNb3NDHSzjzk7w==

Martin Prikryl · Answer 1 · 2019-09-10T07:01:58.307

1

You need to write the private key in PEM format.

For that you need BouncyCastle library.

For an example see:
Java generate RSA key pair and convert to PEM

edited Sep 10 '19 at 07:01

answered Sep 13 '18 at 06:35

Martin Prikryl

188,800
56
490
992

JSch giving invalid private key errors for key pair generated by Java

1 Answers1