Decrypting PuTTY keys protected by passphrase with umlauts fails

[beth-soptim]

Decrypting PuTTY keys protected by passphrase with umlauts fails:

JSch jSch = new JSch();
String prvkey = """
        PuTTY-User-Key-File-3: ecdsa-sha2-nistp256
        Encryption: aes256-cbc
        Comment: ecdsa-key-20260417
        Public-Lines: 3
        AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGXm6QPAlc2K
        35/WrbOK2BWAJ9rZCt1JZxN2ST4v4C5co6MT8GsGKt0SVc/tzE2sC9w85bZR9rhu
        J5cTdm/fdac=
        Key-Derivation: Argon2id
        Argon2-Memory: 8192
        Argon2-Passes: 34
        Argon2-Parallelism: 1
        Argon2-Salt: 837714b0fd5cd436fe5d5727943fbb21
        Private-Lines: 1
        sijTJ9kQFECRzS/9dHKN8r1iDvRQB4OXWAbLZJjPn+vjCm1HDlO3XcUDEtBMpdwM
        Private-MAC: 25cdb7650f2a829d743b3efa98013f5b1a2415cc4bf945704e794c3dff3d1183
        """;
Path tempFile = Files.createTempFile("test", "test");
Files.writeString(tempFile, prvkey);
jSch.addIdentity(tempFile.toAbsolutePath().toString(), "secret123äöüß");

When changing the charset from UTF-8 to e.g. ISO-8859-1 in Util.str2byte(String) it works.

Not sure what is the correct encoding for a passphrase of a PuTTY private key.

[tomaswolf]

Putty handles passwords as char * and uses GetWindowTextA on Windows to read it from the password dialog. So the encoding will be whatever the current ANSI encoding was on the Windows computer where the encrypted file was generated. ISO-8859-1 may work, but actually it's probably Windows-1252. At least in the Western world. In other areas, it may be anything else, and then ISO-8859-1 might not work.

Not sure what Putty does on Linux, but it also looks like it's using char *. No idea how that would work in a locale like de.DE_utf8; perhaps it's then the UTF-8 bytes?

Related: https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/ssh2-utf8-strings.html which says "This [not using UTF-8 but whatever the current character set is] is likely to cause trouble with passwords containing non-ASCII characters".

[norrisjeremy]

Hi @beth-soptim,

I'd recommend using the JSch.addIdentity(String prvkey, byte[] passphrase) method, which should let allow you to do something like this:

jSch.addIdentity(tempFile.toAbsolutePath().toString(), "secret123äöüß".getBytes(Charset.forName("windows-1252")));

Thanks,
jeremy

[norrisjeremy]

Hi @beth-soptim,

I believe this issue can be closed as we pointed out that the JSch.addIdentity(String prvkey, byte[] passphrase) can be used to resolve the issue.
We also officially deprecated methods that take passphrases as a String to help encourage users to switch to the versions that take passphrases as a byte[].

Thanks,
Jeremy