patterns.yml

name: RSA Keys

patterns:
  - name: Generic RSA keys
    type: generic_rsa_keys
    regex:
      version: 1.1
      pattern: |
        --BEGIN (?:[A-Z]+ )?PRIVATE KEY--+(\\r|\\n|)+[a-zA-Z0-9+/=\s]+(\\r|\\n|)+--+END (?:[A-Z]+ )?PRIVATE KEY--
    comments:
      - "Basic support for hardcoded strings in code with RSA private key"
    expected:
      - name: ssh_rsa
        start_offset: 3
        end_offset: 2631
      - name: rsa.js
        start_offset: 50
        end_offset: 924


  - name: SSH Private Keys
    type: ssh_private_keys
    regex:
      pattern: |
        --BEGIN OPENSSH PRIVATE KEY--+[a-zA-Z0-9+/=\s]+--+END OPENSSH PRIVATE KEY--
    comments:
      - "*SSH Password:* `MyPassword`"
    expected:
      - name: ssh_rsa
        start_offset: 3
        end_offset: 2631

 
  - name: GPG Private Key
    type: gpg_private_key
    regex:
      pattern: |
        --BEGIN PGP PRIVATE KEY BLOCK--+(?:[\r\n]+((Version|Comment|MessageID|Hash|Charset): [^\r\n]+[\r\n]+)+[\r\n]+)?[a-zA-Z0-9+/=\s]+--+END PGP PRIVATE KEY BLOCK--
    expected:
      - name: GeekMasher GPG.asc
        start_offset: 3
        end_offset: 6651
      - name: GeekMasher_GPG_with_headers.asc
        start_offset: 3
        end_offset: 6728


  - name: SSH Public Key
    type: ssh_public_key
    experimental: true
    regex:
      version: 0.2
      pattern: |
        ssh-rsa(\s)+[a-zA-Z0-9\/\+=]{20,}
      end: |
        \z|(\s)+[a-zA-Z0-9@-]+
    comments:
      - "SSH Public Key (not a secret)"
      - Ignores the name of the public key
    expected:
      - name: ssh_rsa.pub
        start_offset: 0
        end_offset: 552