diff options
| author | Nicola Murino <nicola.murino@gmail.com> | 2025-08-12 07:59:34 +0200 |
|---|---|---|
| committer | Nicola Murino <nicola.murino@gmail.com> | 2025-09-15 23:32:56 -0700 |
| commit | f4d47b0db5875e61dd52acdb63be800177ab48bb (patch) | |
| tree | 0c974606cbfd3f715128a0173fc6a599dd22efe9 /ssh/common.go | |
| parent | 96dc232fbd7928e9c23da42e770c8b79a2348d86 (diff) | |
| download | go-x-crypto-f4d47b0db5875e61dd52acdb63be800177ab48bb.tar.xz | |
ssh: return clearer error when signature algorithm is used as key format
ParsePublicKey now returns a more specific error when a signature
algorithm like rsa-sha2-256 is mistakenly provided as a key format
Change-Id: Ic08286a5b2b326e99dd3e61594919203f0c36791
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/695075
Reviewed-by: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Mark Freeman <markfreeman@google.com>
Reviewed-by: Michael Knyszek <mknyszek@google.com>
Diffstat (limited to 'ssh/common.go')
| -rw-r--r-- | ssh/common.go | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/ssh/common.go b/ssh/common.go index 8bfad16..36c82a7 100644 --- a/ssh/common.go +++ b/ssh/common.go @@ -312,6 +312,35 @@ func algorithmsForKeyFormat(keyFormat string) []string { } } +// keyFormatForAlgorithm returns the key format corresponding to the given +// signature algorithm. It returns an empty string if the signature algorithm is +// invalid or unsupported. +func keyFormatForAlgorithm(sigAlgo string) string { + switch sigAlgo { + case KeyAlgoRSA, KeyAlgoRSASHA256, KeyAlgoRSASHA512: + return KeyAlgoRSA + case CertAlgoRSAv01, CertAlgoRSASHA256v01, CertAlgoRSASHA512v01: + return CertAlgoRSAv01 + case KeyAlgoED25519, + KeyAlgoSKED25519, + KeyAlgoSKECDSA256, + KeyAlgoECDSA256, + KeyAlgoECDSA384, + KeyAlgoECDSA521, + InsecureKeyAlgoDSA, + InsecureCertAlgoDSAv01, + CertAlgoECDSA256v01, + CertAlgoECDSA384v01, + CertAlgoECDSA521v01, + CertAlgoSKECDSA256v01, + CertAlgoED25519v01, + CertAlgoSKED25519v01: + return sigAlgo + default: + return "" + } +} + // isRSA returns whether algo is a supported RSA algorithm, including certificate // algorithms. func isRSA(algo string) bool { |