I'm always surprized how long users can suffer from IT problem before asking for help. One employee of my company told me that it has problem with a ssh key. It uses its key to copy with scp and it works. But he cannot use Filezilla. Filezilla refuses the key without any warning. I try to use Filezilla with a newly-generated key and I successfully connect to a test server. So the problem comes from the key. Let's have a look to the keys. Both keys looks correct and contains correct header and footer:
-----BEGIN RSA PRIVATE KEY-----
[...]
-----END RSA PRIVATE KEY-----
But openssl failed to check to suspicious key:
% openssl rsa -check -in suspiciouskey_id                               
RSA key ok
140634506504080:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1199:
140634506504080:error:0D06C03A:asn1 encoding routines:ASN1_D2I_EX_PRIMITIVE:nested asn1 error:tasn_dec.c:767:
140634506504080:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:tasn_dec.c:699:Field=n, Type=RSA
140634506504080:error:04093004:rsa routines:OLD_RSA_PRIV_DECODE:RSA lib:rsa_ameth.c:121:
A deeper inspection show that the key contains extra data:
% openssl asn1parse < suspiciouskey_id 
    0:d=0  hl=4 l=1214 cons: SEQUENCE          
    4:d=1  hl=2 l=   1 prim: INTEGER           :00
    7:d=1  hl=2 l=  13 cons: SEQUENCE          
    9:d=2  hl=2 l=   9 prim: OBJECT            :rsaEncryption
   20:d=2  hl=2 l=   0 prim: NULL              
   22:d=1  hl=4 l=1192 prim: OCTET STRING      [HEX DUMP]:..
A normal key looks like:
  openssl asn1parse < good_id 
    0:d=0  hl=4 l=1189 cons: SEQUENCE          
    4:d=1  hl=2 l=   1 prim: INTEGER           :00
    7:d=1  hl=4 l= 257 prim: INTEGER           :XXXYYYYY
  268:d=1  hl=2 l=   3 prim: INTEGER           :010001
  273:d=1  hl=4 l= 256 prim: INTEGER           :XXXXXYYY
In fact, this is not a simple key as you can generate with ssh-keygen. This key contains extra information because it's a PKCS#8. By default, ssh-keygen generates a PKCS#1. So I try to convert the key:
openssl rsa -in suspiciouskey -out newkey
It works!!!
Why the original key was in PKCS#8 format? Did the sysadmin use the ssh-keygen switch -m PKCS8? 
SCP is probably smart enough to extract the key from PKCS#8 but Filezilla can't (at least with 3.42.1)




