OpenSSH Private Key Header

Detects OpenSSH private-key armor. The fixed BEGIN line alone is discovery-only; the encoded openssh-key-v1 container magic supports medium confidence and normally wrapped near-header body lines support high confidence.

Type

regex

Engine

universal

Confidence

high

Confidence justification

High confidence: structurally constrained pattern with corroborative keyword support reduces false positive rates significantly. Added context gating and exclusion rules improve precision and reduce incidental matches.

Detection quality

Verified

Jurisdictions

global

Regulations

Criminal Code Act 1995 (Cth)

Frameworks

CIS Controls, ISO 27001, NIST CSF, PCI-DSS, SOC 2

Data categories

credentials, security

Scope

specific

Risk rating

8

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible

Pattern

-----BEGIN OPENSSH PRIVATE KEY-----

Corroborative evidence keywords

private key, secret key, key file, PEM, certificate, RSA, cryptographic, api key, api_key, apikey, access key, access token, auth token, authorization, bearer, conn str, connection string, connectionstring, cookie, credential (+38 more)

Proximity: 300 characters

Should match

• -----BEGIN OPENSSH PRIVATE KEY----- — Low-tier probe - OpenSSH armor header without key body
• -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn QQ== — Medium-tier probe - encoded openssh-key-v1 magic and body without closing armor
• -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn NhAAAAAwEAAQAAAYEAlswKGsdRkrNxMYSRY8MWnZLpaCagzxY7laz2e9py8KzeRWkHbqMV 5BP2NLG7qC6NqBXXdWPTIQt4bBRL6qPFQXSjpl7cZ2Ac7528HQUSFd4C9g9um+trhTM3c/ 4+Kx6oP4keqYyKBXlRe3kyBUhqaGDMuvxFjOISPT0WTWwfGQzBM8V2kDhKdJXg0EqpzprW jFQ72Tz7y1mbmB0KenoPy4YYWJnte9Gc2DkpZJ4Qkzcs0Qf+SSOcbPLFQHXJJ6H1CVkwpS CH/xoQsMzJNyJuL9RT2+b77scMKkmjGe7Izgs9tB0+Er9jyURqIwPK6lmpN+W65KnfwFkg -----END OPENSSH PRIVATE KEY----- — High-tier probe - realistically long OpenSSH body with footer beyond proximity

Should not match

• -----BEGIN PUBLIC KEY----- — Public key, not private
• -----BEGIN CERTIFICATE----- — Certificate, not private key
• -----BEGIN OPENSSH PRIVATE KEY----- QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB — Adversarial wrapped Base64 lacks the encoded openssh-key-v1 magic
• -----BEGIN OPENSSH PRIVATE KEY----- PLACEHOLDER -----END OPENSSH PRIVATE KEY----- — Placeholder body must not enforce
• Documentation example: -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn NhAAAAAwEAAQAAAYEAlswKGsdRkrNxMYSRY8MWnZLpaCagzxY7laz2e9py8KzeRWkHbqMV 5BP2NLG7qC6NqBXXdWPTIQt4bBRL6qPFQXSjpl7cZ2Ac7528HQUSFd4C9g9um+trhTM3c/ -----END OPENSSH PRIVATE KEY----- — Documentation quoting realistic wrapped OpenSSH data must not enforce
• -----BEGIN PRIVATE KEY----- — Sibling PKCS#8 private-key armor is not OpenSSH format

Known false positives

• PEM-encoded certificates or public keys that use similar header formats Mitigation: The pattern specifically matches the private key header text, but verify the full PEM block contains actual key material.

Collections

• Cloud Credentials & API Keys