RSA keys with large e value are not captured by sshamble

[hannob]

The current version of sshamble does not store ssh-rsa keys if they use a large public exponent value (e).

While such keys are uncommon, they are valid. This is likely caused by a design decision of the Go standard library to not support large e keys, see: https://www.imperialviolet.org/2012/03/16/rsae.html

(This is a completely reasonable decision for a production library, but it is obviously not ideal for a security research and scan tool.)

To test:

[backup ssh_host_rsa_key/ssh_host_rsa_key.pub if needed]
# some FIPS test vector keys have large e values
curl https://raw.githubusercontent.com/SecurityFail/kompromat/refs/heads/master/src/testvectors/FIPS/RSADPComponent800_56B-30.key > /etc/ssh/ssh_host_rsa_key
ssh-keygen -y -f /etc/ssh/ssh_host_rsa_key  > /etc/ssh/ssh_host_rsa_key.pub
[start sshd...]
sshamble scan 127.0.0.1/32 -o results.jsonl

The results file will not contain the ssh-rsa host keys.

[hdm]

Thanks! I'll have an update out later this week - a little behind but hopefully soon!