detect_private_key: add OpenVPN shared-secret key block

Luís Ferreira · Luís Ferreira · commit 1b4e30e9aaeb · 2021-10-02T20:53:39.000+01:00
'OpenVPN Static key V1' label is often used by OpenVPN for providing hardening
security with additional HMAC signatures to the SSL/TLS handshake packets. They
are shared secrets and should be kept private.

Signed-off-by: Luís Ferreira &lt;contact@lsferreira.net&gt;
diff --git a/pre_commit_hooks/detect_private_key.py b/pre_commit_hooks/detect_private_key.py
@@ -12,6 +12,7 @@
     b'BEGIN SSH2 ENCRYPTED PRIVATE KEY',
     b'BEGIN PGP PRIVATE KEY BLOCK',
     b'BEGIN ENCRYPTED PRIVATE KEY',
+    b'BEGIN OpenVPN Static key V1',
 ]
 
 
diff --git a/tests/detect_private_key_test.py b/tests/detect_private_key_test.py
@@ -11,6 +11,7 @@
     (b'PuTTY-User-Key-File-2: ssh-rsa', 1),
     (b'---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----', 1),
     (b'-----BEGIN ENCRYPTED PRIVATE KEY-----', 1),
+    (b'-----BEGIN OpenVPN Static key V1-----', 1),
     (b'ssh-rsa DATA', 0),
     (b'ssh-dsa DATA', 0),
     # Some arbitrary binary data

Original file line number	Diff line number	Diff line change
`@@ -12,6 +12,7 @@`
`12`	`12`	`b'BEGIN SSH2 ENCRYPTED PRIVATE KEY',`
`13`	`13`	`b'BEGIN PGP PRIVATE KEY BLOCK',`
`14`	`14`	`b'BEGIN ENCRYPTED PRIVATE KEY',`
	`15`	`+ b'BEGIN OpenVPN Static key V1',`
`15`	`16`	`]`
`16`	`17`
`17`	`18`