Skip to content

ssh: fix server to accept rsa-sha2-256 and rsa-sha2-512 signatures #187

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Conversation

samiponkanen
Copy link
Contributor

This pull request fixes serverAuthenticate() to accept "rsa-sha2-256" and "rsa-sha2-512" public key algorithm names and signature format in user auth messages. Additionally this pr adds unit tests for RSA publickey authentication using rsa-sha2-256 and rsa-sha2-512 signatures.

Fixes golang/go#46569

@google-cla
Copy link

google-cla bot commented Jun 4, 2021

We found a Contributor License Agreement for you (the sender of this pull request), but were unable to find agreements for all the commit author(s) or Co-authors. If you authored these, maybe you used a different email address in the git commits than was used to sign the CLA (login here to double check)? If these were authored by someone else, then they will need to sign a CLA as well, and confirm that they're okay with these being contributed to Google.
In order to pass this check, please resolve this problem and then comment @googlebot I fixed it.. If the bot doesn't comment, it means it doesn't think anything has changed.

ℹ️ Googlers: Go here for more info.

@google-cla google-cla bot added the cla: no label Jun 4, 2021
@samiponkanen
Copy link
Contributor Author

@googlebot I fixed it.

@google-cla
Copy link

google-cla bot commented Jun 4, 2021

We found a Contributor License Agreement for you (the sender of this pull request), but were unable to find agreements for all the commit author(s) or Co-authors. If you authored these, maybe you used a different email address in the git commits than was used to sign the CLA (login here to double check)? If these were authored by someone else, then they will need to sign a CLA as well, and confirm that they're okay with these being contributed to Google.
In order to pass this check, please resolve this problem and then comment @googlebot I fixed it.. If the bot doesn't comment, it means it doesn't think anything has changed.

ℹ️ Googlers: Go here for more info.

… public key algorithm name and signature format in user auth messages
@samiponkanen samiponkanen force-pushed the topic/ssh-server-rsa-sha2-support branch from e0490ae to ab4f6d8 Compare June 4, 2021 14:43
@google-cla google-cla bot added cla: yes and removed cla: no labels Jun 4, 2021
@samiponkanen
Copy link
Contributor Author

@googlebot I fixed it.

@gopherbot
Copy link
Contributor

This PR (HEAD: ab4f6d8) has been imported to Gerrit for code review.

Please visit https://go-review.googlesource.com/c/crypto/+/325089 to see it.

Tip: You can toggle comments from me using the comments slash command (e.g. /comments off)
See the Wiki page for more info

@samiponkanen samiponkanen force-pushed the topic/ssh-server-rsa-sha2-support branch from ab4f6d8 to ded2006 Compare June 7, 2021 06:33
@gopherbot
Copy link
Contributor

This PR (HEAD: ded2006) has been imported to Gerrit for code review.

Please visit https://go-review.googlesource.com/c/crypto/+/325089 to see it.

Tip: You can toggle comments from me using the comments slash command (e.g. /comments off)
See the Wiki page for more info

@samiponkanen
Copy link
Contributor Author

I noticed the unit test had a bug: incorrect public key algorithm name was used woth rsa-sha2-* signatures. Fixed it.

@Ereski
Copy link

Ereski commented Nov 11, 2021

@samiponkanen as I understand, the server would still not advertise support for SHA2 during KEX with your PR. Is that the case?

crypto/ssh/keys.go

Lines 338 to 340 in 0c34fe9

func (r *rsaPublicKey) Type() string {
return "ssh-rsa"
}

@samiponkanen
Copy link
Contributor Author

@samiponkanen as I understand, the server would still not advertise support for SHA2 during KEX with your PR. Is that the case?

You are correct, this PR does not add support for sending the server-sig-algs extension.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

x/crypto/ssh: server does not accept rsa-sha2-256 and rsa-sha2-512 signatures
3 participants