The existing code for decrypting OpenSSH-format keys only allows aes256-ctr, the current ssh-keygen default. However, the default encryption scheme was aes256-cbc until relatively recently, and some of these keys are still in use. Support for aes256-cbc has been added. Fixes golang/go#37939 Change-Id: I3730347109c5dd18e4cbe61b48bbca9566ad61d2 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/224817 Reviewed-by: Filippo Valsorda <filippo@golang.org>