macOS private key still looks unencrypted after added with password
There is more than one format for private key files. All of them share similar-looking packaging ("BEGIN/END" and Base64 encoding), but only one of them – PEM – uses "Proc-Type" headers to store encryption information; the other formats store it as part of the binary payload itself.
The tutorials that you've read demonstrate the key format that OpenSSH's ssh-keygen
was using at the time. That doesn't mean this is the only format nor that it will always be the same format.
OpenSSH has previously used the PEM key format, but it has various limitations in how it handles encryption as well as different key algorithms. (For example, the key derivation method is weak, and the format couldn't support Ed25519 keys at first.) If you see a BEGIN RSA PRIVATE KEY
(same for ECDSA), it's in the PEM or PKCS#1 or "OpenSSL" format.
TLS/SSL-related software (such as the openssl
tool) now more commonly use the PKCS#8 format, which looks very similar from the outside but stores encryption parameters as part of the main Base64-encoded structure. If you see a BEGIN PRIVATE KEY
header, it's in PKCS#8 format and openssl asn1parse -i
can inspect it.
Recent versions of OpenSSH use a custom "OpenSSH" key format, among other reasons to avoid a dependency on OpenSSL (which was previously used to read/write the PEM and PKCS#8 formatted keys) as well as to support key algorithms which OpenSSL didn't support at the time (at that time, no OIDs for Ed25519 had been designated yet). If you see a BEGIN OPENSSH PRIVATE KEY
header, it uses this format. The encryption parameters are again stored in the main body of the key file; if you Base64-decoded it, you'd see the words "aes128-ctr bcrypt" if it was encrypted, or "none none" if it was not.