SSH format should ideally check more than 4 bytes for new format OpenSSH private keys

[solardiz]

For new format OpenSSH private keys, which use bcrypt-pbkdf, we check only 4 bytes. For our 4 test vectors, the decrypted data starts with:

c38767f8 c38767f8 00000013 65636473
e2e9392d e2e9392d 0000000b 7373682d
3eb37c71 3eb37c71 00000013 65636472
c785799f c785799f 0000000b 73736832

Per OpenSSH's PROTOCOL.key, the two 32-bit checkint fields are immediately followed by privatekey1, "where each private key is encoded using the same rules as used for SSH agent." So we may need to find those rules. The above looks like it's length field followed by ASCII key type id (ssh2 or ecdr), but it's better to know for sure per spec.

I also found https://coolaj86.com/articles/the-openssh-private-key-format/ which has some useful info, but is someone else figuring this out rather than an official spec.