aboutsummaryrefslogtreecommitdiff
path: root/ssh/certs.go
AgeCommit message (Collapse)Author
2025-06-30ssh: refuse to parse certificates that use a certificate as signing keyNicola Murino
According to draft-miller-ssh-cert-01, Section 2.1.1, certificates with certificate keys as signature keys are invalid Change-Id: I474524ea444deb78f2fa7c2682e47c0fd057f0b8 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/678716 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: David Chase <drchase@google.com> Auto-Submit: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Filippo Valsorda <filippo@golang.org>
2025-06-30ssh: reject certificate keys used as signature keys for SSH certsNicola Murino
As specified in draft-miller-ssh-cert-01, Section 2.1.1: Implementations MUST NOT accept certificate keys as CA keys. Change-Id: I2e559a8a58b7bceccd0d8c6b80803abdbe281067 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/678715 Reviewed-by: Filippo Valsorda <filippo@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: David Chase <drchase@google.com>
2025-05-15ssh: export supported algorithmsNicola Murino
Fixes golang/go#61537 Change-Id: If3478121e3ae445391e3faeceeb889d75e9e3214 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/531935 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Cherry Mui <cherryyz@google.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Reviewed-by: Filippo Valsorda <filippo@golang.org>
2023-09-20ssh: add MultiAlgorithmSignerNicola Murino
MultiAlgorithmSigner allows to restrict client-side, server-side and certificate signing algorithms. Fixes golang/go#52132 Fixes golang/go#36261 Change-Id: I295092f1bba647327aaaf294f110e9157d294159 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/508398 Reviewed-by: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Matthew Dempsky <mdempsky@google.com>
2022-10-05all: replace bytes.Compare with bytes.Equalcui fliter
Change-Id: I911366b91ff2a1d02d7de202a166d876fb873142 GitHub-Last-Rev: f50e00376856fb9da36bb98ed0cdfd96c2f3b304 GitHub-Pull-Request: golang/crypto#233 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/438536 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com>
2022-05-13ssh/agent: fix non-RSA certificatesFilippo Valsorda
The type of ssh.PublicKey.Type can be a certificate type, while the algorithm passed to SignWithAlgorithm is going to be an underlying algorithm. Fixes golang/go#52185 Change-Id: I0f7c46defa83d1fd64a3c1e861734650b20cca21 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/404614 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Heschi Kreinick <heschi@google.com> Reviewed-by: Roland Shoemaker <roland@golang.org> Auto-Submit: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org>
2022-03-15ssh: support rsa-sha2-256/512 for client certificatesFilippo Valsorda
The server-sig-algs logic was not working for certificate algorithms. Follow-up on CL 392394. Tested with OpenSSH 8.8 configured with PubkeyAcceptedKeyTypes -ssh-rsa-cert-v01@openssh.com Updates golang/go#39885 For golang/go#49952 Change-Id: Ic230dd6f98e96b7938acbd0128ab37d33b70abe5 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392974 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-03-14ssh: don't advertise rsa-sha2 algorithms if we can't use themFilippo Valsorda
The server implementation looks at the HostKeys to advertise and negotiate host key signature algorithms. A fundamental issue of the Signer and AlgorithmSigner interfaces is that they don't expose the supported signature algorithms, so really the server has to guess. Currently, it would guess exclusively based on the PublicKey.Type, regardless of whether the host key implemented AlgorithmSigner. This means that a legacy Signer that only supports ssh-rsa still led the server to negotiate rsa-sha2 algorithms. The server would then fail to find a suitable host key to make the signature and crash. This won't happen if only Signers from this package are used, but if a custom Signer that doesn't support SignWithAlgorithm() but returns "ssh-rsa" from PublicKey().Type() is used as a HostKey, the server is vulnerable to DoS. The only workable rules to determine what to advertise seems to be: 1. a pure Signer will always Sign with the PublicKey.Type 2. an AlgorithmSigner supports all algorithms associated with the PublicKey.Type Rule number two means that we can't add new supported algorithms in the future, which is not great, but it's too late to fix that. rsaSigner was breaking rule number one, and although it would have been fine where it's used, I didn't want to break our own interface contract. It's unclear why we had separate test key entries for rsa-sha2 algorithms, since we can use the ssh-rsa key for those. The only test that used them, TestCertTypes, seemed broken: the init was actually failing at making the corresponding signers rsaSigners, and indeed the test for the SHA-256 signer expected and checked a SHA-512 signature. Pending CVE For golang/go#49952 Change-Id: Ie658eefcadd87906e63fc7faae8249376aa96c79 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392355 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-03-14ssh: deprecate and replace SigAlgo constantsFilippo Valsorda
RFC 8332, Section 2 sets up two overlapping namespaces: public key formats and public key algorithms. * The formats are what we currently have KeyAlgo constants for, and they appear in PublicKey.Type. * The algorithms are the set of both KeyAlgo and SigAlgo constants, and they appear in Signature.Format (amongst other places). This is incoherent, because that means Signature.Format can be both a KeyAlgo (like KeyAlgoECDSA256) or a SigAlgo (like SigAlgoRSASHA2256). One solution would be to duplicate all the KeyAlgo constants into the SigAlgo namespace, but that would be confusing because applications are currently using KeyAlgos where they'd be supposed to use the new SigAlgos (while we can't deprecate the KeyAlgos because they are still necessary for the PublicKey.Type namespace). Instead, drop the separate namespaces, and use KeyAlgos throughout. There are simply some KeyAlgos that can't be a PublicKey.Type. Take the opportunity to fix the stuttering SHA22565/SHA2512 names. It's totally ok to call those hashes SHA-256 and SHA-512 without the family infix. For golang/go#49952 Change-Id: Ia1fce3912a7e60aa70a88f75ed311be331fd19d5 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392354 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2021-11-15ssh: support RSA SHA-2 (RFC8332) signaturesHans Nielsen
This change adds support for RSA SHA-2 based signatures for host keys and certificates. It also switches the default certificate signature algorithm for RSA to use SHA-512. This is implemented by treating ssh.Signer specially when the key type is `ssh-rsa` by also allowing SHA-256 and SHA-512 signatures. Fixes golang/go#37278 Change-Id: I2ee1ac4ae4c9c1de441a2d6cf1e806357ef18910 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/220037 Trust: Jason A. Donenfeld <Jason@zx2c4.com> Run-TryBot: Jason A. Donenfeld <Jason@zx2c4.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com> Reviewed-by: Roland Shoemaker <roland@golang.org>
2020-04-27ssh: improve docs on Certificate.SignCertLily Chung
Document the fact that SignCert sets the Nonce field. This makes it clear that callers need not set it themselves. Original change by Jakob Weisblat <jakobw@mit.edu> in CL 57051. Fixes golang/go#21384 Change-Id: I161e0909ba6c8d07be5f8e68dc6e0f0392bea63f Reviewed-on: https://go-review.googlesource.com/c/crypto/+/230212 Reviewed-by: Filippo Valsorda <filippo@golang.org>
2019-12-02ssh: add sk-ecdsa-sha2-nistp256 and sk-ed25519Sebastian Kinne
This adds server-side support for the newly introduced OpenSSH keytypes sk-ecdsa-sha2-nistp256@openssh.com and sk-ed25519@openssh.com (including their corresponding certificates), which are backed by U2F/FIDO2 tokens. Change-Id: I53d5ed3d0457ae4758ee986055e187ee5787a2d1 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/208017 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2018-10-29ssh: support SSH agent signature flags and custom extensionsIan Haken
This commit implements two new features. To preserve backwards compatibility the new methods are added to an `ExtendedAgent` interface which extends `Agent`. The client code implements `ExtendedAgent` (which extends Agent) so you can call these additional methods against SSH agents such as the OpenSSH agent. The ServeAgent method still accepts Agent but will attempt to upcast the agent to `ExtendedAgent` as needed, so if you supply an ExtendedAgent implementation you can implement these additional methods (which keyring does). The first feature is supporting the standard flags that can be passed to SSH Sign requests, requesting that RSA signatures use SHA-256 or SHA-512. See section 4.5.1 of the SSH agent protocol draft: https://tools.ietf.org/html/draft-miller-ssh-agent-02 The second feature is supporting calling custom extensions from clients and implementing custom extensions from servers. See section 4.7 of the SSH agent protocol draft: https://tools.ietf.org/html/draft-miller-ssh-agent-02 Change-Id: I0f74feb893762c27e921ec37604d3a46434ee6ef GitHub-Last-Rev: 2e23fd01c0e95b664e8507682f0bd5bd61d4c146 GitHub-Pull-Request: golang/crypto#53 Reviewed-on: https://go-review.googlesource.com/c/123955 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2018-02-08ssh: clarify how to parse out CertificatesHan-Wen Nienhuys
Fixes golang/go#22046 Change-Id: I9a9aff37ba0fd0ca1f5fa1a212c66b812f6b9f70 Reviewed-on: https://go-review.googlesource.com/88895 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2017-12-28crypto/ssh: fix typo in error message in certs.goMansour Rahimi
Fixes golang/go#23266 Change-Id: I8da14425ed69c44a7b0c56b1aa0ea951fe297608 Reviewed-on: https://go-review.googlesource.com/85595 Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com> Run-TryBot: Emmanuel Odeke <emm.odeke@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-11-28all: run gofmt -s on source codeKevin Burke
Per the description, the "-s" file issues slight simplifications to the source code. Change-Id: I77395d763f5eafb48653902dcedfa56b150b2d67 Reviewed-on: https://go-review.googlesource.com/80138 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2017-05-23x/crypto/ssh: fix host certificate principal evaluation to check for ↵Adam Eijdenberg
hostname only SSH host certificates are expected to contain hostnames only, not "host:port" format. This change allows Go clients to connect to OpenSSH servers that use host certificates. Note, this change will break any clients that use ssh.NewClientConn() with an `addr` that is not in `host:port` format (they will see a "missing port in address" error). Fixes bug 20273. Change-Id: I5a306c6b7b419a737e1f0f9c5ca8c585e21a45a4 Reviewed-on: https://go-review.googlesource.com/43475 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-05-02ssh/knownhosts: add IsHostAuthority.Peter Moody
This is a breaking change. This adds a new hostkey callback which takes the hostname field restrictions into account when validating host certificates. Prior to this, a known_hosts file with the following entry @cert-authority *.example.com ssh-rsa <example.com public key> would, when passed to knownhosts.New() generate an ssh.HostKeyCallback that would accept all host certificates signed by the example.com public key, no matter what host the client was connecting to. After this change, that known_hosts entry can only be used to validate host certificates presented when connecting to hosts under *.example.com This also renames IsAuthority to IsUserAuthority to make its intended purpose more clear. Change-Id: I7188a53fdd40a8c0bc21983105317b3498f567bb Reviewed-on: https://go-review.googlesource.com/41751 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-03-30ssh: require host key checking in the ClientConfigHan-Wen Nienhuys
This change breaks existing behavior. Before, a missing ClientConfig.HostKeyCallback would cause host key checking to be disabled. In this configuration, establishing a connection to any host just works, so today, most SSH client code in the wild does not perform any host key checks. This makes it easy to perform a MITM attack: * SSH installations that use keyboard-interactive or password authentication can be attacked with MITM, thereby stealing passwords. * Clients that use public-key authentication with agent forwarding are also vulnerable: the MITM server could allow the login to succeed, and then immediately ask the agent to authenticate the login to the real server. * Clients that use public-key authentication without agent forwarding are harder to attack unnoticedly: an attacker cannot authenticate the login to the real server, so it cannot in general present a convincing server to the victim. Now, a missing HostKeyCallback will cause the handshake to fail. This change also provides InsecureIgnoreHostKey() and FixedHostKey(key) as ready made host checkers. A simplistic parser for OpenSSH's known_hosts file is given as an example. This change does not provide a full-fledged parser, as it has complexity (wildcards, revocation, hashed addresses) that will need further consideration. When introduced, the host checking feature maintained backward compatibility at the expense of security. We have decided this is not the right tradeoff for the SSH library. Fixes golang/go#19767 Change-Id: I45fc7ba9bd1ea29c31ec23f115cdbab99913e814 Reviewed-on: https://go-review.googlesource.com/38701 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-05-12x/crypto/ssh: add support for ed25519 keysMartin Garton
Added support for parsing the "new" openssh private key format. (ed25519 keys only in this format for now) Signing and verifying functions now work with ed25519 keys. ed25519 can now be accepted by the server to authenticate a client. ed25519 can now be accepted by a client as a server host key. Related documentation used: https://www.ietf.org/archive/id/draft-bjh21-ssh-ed25519-02.txt Change-Id: I84385f24d666fea08de21f980f78623f7bff8007 Reviewed-on: https://go-review.googlesource.com/22512 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
2015-06-22ssh: Add explicit type in comparison with constant to make go-fuzz happyTaru Karttunen
Currently using go-fuzz with code using golang.org/x/crypto/ssh fails because it passes CertTimeInfinity to an interface{} and automatically tries to use an int, which overflows and results in a compile error. This change adds a no-op type conversion inside the function which makes things compile with go-fuzz. Change-Id: Iade0c0df7e20cbac4928480fad3e44c831e1e00a Reviewed-on: https://go-review.googlesource.com/11285 Reviewed-by: Adam Langley <agl@golang.org>
2015-05-04crypto/ssh: fix encoding of ssh certs with critical optionsDmitry Savintsev
Attention - BREAKING change for the certificates generated with the previous versions of crypto/ssh! Need to regenerate certificates with a version of crypto/ssh library including this fix. [PROTOCOL.cerkeys] requires two length fields for non-empty values of critical options (or extensions - but those are currently always empty) - see https://bugzilla.mindrot.org/show_bug.cgi?id=2389. Add SSH-conform handling of such composite values in marshalTuples and parseTuples and related test (TestParseCertWithOptions) parsing a certificate created with ssh-keygen which includes critical options. Fixes #10569 Change-Id: Iecbfca67a66668880635141c72bc5fc370a9c112 Reviewed-on: https://go-review.googlesource.com/9375 Reviewed-by: Adam Langley <agl@golang.org> Run-TryBot: Adam Langley <agl@golang.org>
2014-04-09go.crypto/ssh: import gosshnew.Adam Langley
See https://groups.google.com/d/msg/Golang-nuts/AoVxQ4bB5XQ/i8kpMxdbVlEJ R=hanwen CC=golang-codereviews https://golang.org/cl/86190043
2013-10-23go.crypto/ssh: Implement CertTime to properly handle the "infinite" timeJonathan Pittman
value ^0, which would become negative when expressed as int64. R=agl, dave, jpsugar, hanwen CC=golang-dev https://golang.org/cl/15520047
2013-10-22go.crypto/ssh: Add certificate verification, step up support for authorized keysJonathan Pittman
R=agl, hanwen, jpsugar, dave CC=golang-dev https://golang.org/cl/14540051
2013-10-09go.crypto/ssh: fix certificate parsing/marshaling.JP Sugarbroad
The change to add the PublicKey interface accidentally caused certificate handling to expect an extra copy of the private key algorithm name in the binary representation. This change adapts a suitable parsing API and adds a test to ensure that cert handling isn't easily broken in the future. R=agl, hanwen, jmpittman CC=golang-dev https://golang.org/cl/13272055
2013-09-19go.crypto/ssh: introduce Signer method, an abstraction ofHan-Wen Nienhuys
private keys. R=agl, jpsugar, jonathan.mark.pittman CC=golang-dev https://golang.org/cl/13338044
2013-09-13go.crypto/ssh: introduce PublicKey interface type.Han-Wen Nienhuys
Public functions affected: -AgentKey.Key -AgentClient.SignRequest -ClientKeyring.Key -MarshalPublicKey -ParsePublicKey R=agl, jpsugar, jmpittman CC=golang-dev https://golang.org/cl/13642043
2013-09-05go.crypto/ssh: remove misleading marshalPrivRSA.Han-Wen Nienhuys
Properly capitalize publicKey throughout. R=golang-dev CC=agl, dave, golang-dev, jpsugar https://golang.org/cl/13415046
2013-08-28go.crypto/ssh: implement ECDH.Han-Wen Nienhuys
Implement elliptic-curve Diffie-Hellman, including host key signature verification. Moves host key cryptographic verification to ClientConn.handshake(), so RSA host keys are also verified. Fixes golang/go#6158. R=dave, agl CC=golang-dev https://golang.org/cl/13021045
2012-12-16go.crypto/ssh: some cleanupJonathan Pittman
Simplify MarshalAuthorizedKey by using the algoName func. Make the algoName func be very specific about supported key types in openssh certs. Generalize some of the commentary that previously mentioned specific key types. R=agl, dave CC=golang-dev https://golang.org/cl/6938067
2012-12-14go.crypto/ssh: Miscellaneous changes up for discussion.Jonathan Pittman
Export key and certificate algorithm names. Switch from string literals over to using the constants for any key/cert algorithm references. Make URL references visible in the godoc web display. Standardize url reference names with surrounding []. R=dave, agl, jonathan.mark.pittman CC=golang-dev https://golang.org/cl/6944047
2012-12-14go.crypto/ssh: Add support for ECDSA keys and certs.Jonathan Pittman
R=agl, dave CC=golang-dev https://golang.org/cl/6873060
2012-04-26go.crypto/ssh: prevent concurrent reads and concurrent writes over the same ↵Jonathan Pittman
agent connection minor fix for v01 cert parsing when algo is not supported R=golang-dev, agl, dave CC=golang-dev https://golang.org/cl/6116052
2012-04-20ssh: cosmetic cleanupsAdam Langley
These are the cosmetic cleanups from the bits of code that I rereviewed. 1) stringLength now takes a int; the length of the string. Too many callers were allocating with stringLength([]byte(s)) and stringLength only needs to call len(). 2) agent.go now has sendAndReceive to remove logic that was duplicated. 3) We now reject negative DH values 4) We now reject empty packets rather than crashing. R=dave, jonathan.mark.pittman CC=golang-dev https://golang.org/cl/6061052
2012-02-24go.crypto/ssh: add client support for OpenSSH certificatesJonathan Pittman
Refactor key parsing, marshaling, and serialization to be a bit more flexible R=agl, dave, djm CC=golang-dev https://golang.org/cl/5650067
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 06:32:14 +0000