detect_private_key: add OpenVPN shared-secret key block

'OpenVPN Static key V1' label is often used by OpenVPN for providing hardening security with additional HMAC signatures to the SSL/TLS handshake packets. They are shared secrets and should be kept private. Signed-off-by: Luís Ferreira <contact@lsferreira.net>
pre-commit · Oct 2, 2021 · 1b4e30e · 1b4e30e
1 parent ccdf02d
commit 1b4e30e
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/pre_commit_hooks/detect_private_key.py b/pre_commit_hooks/detect_private_key.py
@@ -12,6 +12,7 @@
     b'BEGIN SSH2 ENCRYPTED PRIVATE KEY',
     b'BEGIN PGP PRIVATE KEY BLOCK',
     b'BEGIN ENCRYPTED PRIVATE KEY',
+    b'BEGIN OpenVPN Static key V1',
 ]
 
 

diff --git a/tests/detect_private_key_test.py b/tests/detect_private_key_test.py
@@ -11,6 +11,7 @@
     (b'PuTTY-User-Key-File-2: ssh-rsa', 1),
     (b'---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----', 1),
     (b'-----BEGIN ENCRYPTED PRIVATE KEY-----', 1),
+    (b'-----BEGIN OpenVPN Static key V1-----', 1),
     (b'ssh-rsa DATA', 0),
     (b'ssh-dsa DATA', 0),
     # Some arbitrary binary data