aboutsummaryrefslogtreecommitdiff
path: root/ssh/client_auth.go
AgeCommit message (Collapse)Author
2026-03-23ssh: respect signer's algorithm preference in pickSignatureAlgorithmNicola Murino
Previously, pickSignatureAlgorithm constructed the list of candidate algorithms by iterating over the static list returned by algorithmsForKeyFormat. This caused the Signer's preference order to be ignored in favor of the library's default internal order. This change inverts the filtering logic to iterate over the signer's supported algorithms first. This ensures that if a MultiAlgorithmSigner explicitly prefers a specific algorithm (e.g., rsa-sha2-512 over rsa-sha2-256), that preference is preserved and respected during the handshake negotiation. Fixes golang/go#78248 Change-Id: I48a0aac720be7f973963342b82047ce32fc96699 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/746020 Reviewed-by: Lonny Wong <lonnywang.cn@gmail.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Nicola Murino <nicola.murino@gmail.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Filippo Valsorda <filippo@golang.org> Reviewed-by: Carlos Amedee <carlos@golang.org>
2025-09-15ssh: remove custom contains, use slices.ContainsNicola Murino
Change-Id: If4784469e7285675bdd51399a76bdc16f0036a2e Reviewed-on: https://go-review.googlesource.com/c/crypto/+/703635 Reviewed-by: Mark Freeman <markfreeman@google.com> Reviewed-by: Sean Liao <sean@liao.dev> Reviewed-by: Michael Knyszek <mknyszek@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-07-09ssh: add AlgorithmNegotiationErrorNicola Murino
Fixes golang/go#61536 Change-Id: Id38cc6d46879dbe2bdea04dec061596387ec6cfe Reviewed-on: https://go-review.googlesource.com/c/crypto/+/559056 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Filippo Valsorda <filippo@golang.org> Reviewed-by: David Chase <drchase@google.com> Auto-Submit: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Carlos Amedee <carlos@golang.org>
2024-10-16ssh: return unexpected msg error when server fails keyboard-interactive auth ↵samiponkanen
early Seems the OpenSSH server running on windows fails keyboard-interactive auth this way without sending any prompt to client. In such case the golang ssh client should not retry keyboard-interactive auth when the auth method is wrapped in a RetryableAuthMethod(). Rather the auth method should be immediately marked as tried&failed and the client auth process should move on to next available and acceptable auth method. Fixes golang/go#67855 Change-Id: I6c64ae58ff8325774e37af716601b112f8833d8f GitHub-Last-Rev: 7fafc4d1c81284b31000d7d6ccadd934dda26d24 GitHub-Pull-Request: golang/crypto#297 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/590956 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Nicola Murino <nicola.murino@gmail.com>
2024-06-04ssh: fail client auth immediately on receiving disconnect messagesamiponkanen
Fixes golang/go#66991 Change-Id: I60dd8a807578f162fda0e49bcd6fbf289d444396 GitHub-Last-Rev: f88329d35712873d0d7e3b39b9b11e7bfbc28e71 GitHub-Pull-Request: golang/crypto#293 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/581075 Reviewed-by: Cherry Mui <cherryyz@google.com> Reviewed-by: Roland Shoemaker <roland@golang.org> Auto-Submit: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Nicola Murino <nicola.murino@gmail.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-05-03ssh: validate key type in SSH_MSG_USERAUTH_PK_OK responseNicola Murino
According to RFC 4252 Section 7 the algorithm in SSH_MSG_USERAUTH_PK_OK should match that of the request but some servers send the key type instead. OpenSSH checks for the key type, so we do the same. Fixes golang/go#66438 Fixes golang/go#64785 Fixes golang/go#56342 Fixes golang/go#54027 Change-Id: I2f733f0faece097e44ba7a97c868d30a53e21d79 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/573360 Auto-Submit: Nicola Murino <nicola.murino@gmail.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Run-TryBot: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Joedian Reid <joedian@google.com>
2023-11-23ssh: fix certificate authentication with OpenSSH 7.2-7.7Nicola Murino
OpenSSH 7.2-7.7 advertises support for rsa-sha2-256 and rsa-sha2-512 in the "server-sig-algs" extension but doesn't support these algorithms for certificate authentication, so if the server rejects the key try to use the obtained algorithm as if "server-sig-algs" had not been implemented. Fixes golang/go#58371 Change-Id: Id49960d3dedd32a21e2c6c2689b1696e05398286 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/510155 Reviewed-by: Filippo Valsorda <filippo@golang.org> Run-TryBot: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Nicola Murino <nicola.murino@gmail.com>
2023-09-20ssh: add MultiAlgorithmSignerNicola Murino
MultiAlgorithmSigner allows to restrict client-side, server-side and certificate signing algorithms. Fixes golang/go#52132 Fixes golang/go#36261 Change-Id: I295092f1bba647327aaaf294f110e9157d294159 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/508398 Reviewed-by: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Matthew Dempsky <mdempsky@google.com>
2022-03-15ssh: support rsa-sha2-256/512 for client certificatesFilippo Valsorda
The server-sig-algs logic was not working for certificate algorithms. Follow-up on CL 392394. Tested with OpenSSH 8.8 configured with PubkeyAcceptedKeyTypes -ssh-rsa-cert-v01@openssh.com Updates golang/go#39885 For golang/go#49952 Change-Id: Ic230dd6f98e96b7938acbd0128ab37d33b70abe5 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392974 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-03-14ssh: support rsa-sha2-256/512 for client authenticationFilippo Valsorda
CL 220037 had implemented support for host authentication using rsa-sha2-256/512, but not client public key authentication. OpenSSH disabled the SHA-1 based ssh-rsa by default in version 8.8 (after pre-announcing it in versions 8.2, 8.3, 8.4, 8.5, 8.6, and 8.7) although some distributions re-enable it. GitHub will start rejecting ssh-rsa for keys uploaded before November 2, 2021 on March 15, 2022. https://github.blog/2021-09-01-improving-git-protocol-security-github/ The server side already worked, as long as the client selected one of the SHA-2 algorithms, because the signature flowed freely to Verify. There was however nothing verifying that the signature algorithm matched the advertised one. The comment suggested the check was being performed, but it got lost back in CL 86190043. Not a security issue because the signature had to pass the callback's Verify method regardless, and both values were checked to be acceptable. Tested with OpenSSH 8.8 configured with "PubkeyAcceptedKeyTypes -ssh-rsa" and no application-side changes. The Signers returned by ssh/agent (when backed by an agent client) didn't actually implement AlgorithmSigner but ParameterizedSigner, an interface defined in an earlier version of CL 123955. Updates golang/go#49269 Fixes golang/go#39885 For golang/go#49952 Change-Id: I13b41db8041f1112a70f106c55f077b904b12cb8 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392394 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2022-03-14ssh: send (and rename) keyboard-interactive name field to the clientFilippo Valsorda
The server side implementation was not actually populating the SSH_MSG_USERAUTH_INFO_REQUEST field with the KeyboardInteractiveChallenge argument, although the client side was deserializing it and passing it to the KeyboardInteractiveChallenge callback. Anyway, the first field of SSH_MSG_USERAUTH_INFO_REQUEST is "name", not "user". Maybe the confusion was due to the first field of SSH_MSG_USERAUTH_REQUEST being the user. RFC 4256, Section 3.3, says this about it One possibility is to use the name field (possibly prefixed with the application's name) as the title of a dialog window in which the prompt(s) are presented. and examples include "CRYPTOCard Authentication", "Password Authentication", and "Password Expired". Co-authored-by: Kevin Wallace <kevin@pentabarf.net> Change-Id: Ic6ec0dfea2122704603c44f42898a980689a15c9 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/372234 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2020-10-16ssh: improve error message for KeyboardInteractiveChallengeAidan Coyle
Fixes golang/go#41823 Change-Id: I4653f23239bdf2ab472d3d15c6653b89ebf7ccd4 GitHub-Last-Rev: 179b3ee0efc7b4733da9fbbd8e5ec73a72ef8156 GitHub-Pull-Request: golang/crypto#158 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/259902 Trust: Roland Shoemaker <roland@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org>
2020-06-22ssh: Make error message deterministicJulian Kornberger
By using a slice instead of a map for tried authentication methods the order is always the same. Small slices are also faster than maps. Before the change sometimes I get the error: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain and sometimes: ssh: handshake failed: ssh: unable to authenticate, attempted methods [publickey none], no supported methods remain Change-Id: I06507d57e9eef497ff05bce088d52607e69dde3e GitHub-Last-Rev: 3a46aae4c6e3e5f52ca4b04384b3cc4efc039aa6 GitHub-Pull-Request: golang/crypto#142 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/239171 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-05-10ssh/gss: support kerberos authentication for ssh server and clientyanweizhi
Change-Id: I20e3356476dc50402dd34d2b39ad030c1e63a9ef Reviewed-on: https://go-review.googlesource.com/c/crypto/+/170919 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2018-02-08ssh: fix support for partial success authentication responses in clientSami Pönkänen
The existing client side authentication does not handle correctly the partial success flag in SSH_MSG_USERAUTH_FAILURE authentication responses. This commit fixes two problems in ssh library: 1) RetryableAuthMethod() now breaks out from the retry loop and returns when underlying auth method fails with partial success set to true. 2) Book keeping of tried (and failed) auth methods in clientAuthenticate() does not mark an auth method failed if it fails with partial success set to true. Fixes golang/go#23461 Change-Id: Ib2e1a1d54bfe2549496199bb2f66ebbce58d130d Reviewed-on: https://go-review.googlesource.com/88035 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
2017-11-13ssh: add support for bannersTugdual Saunier
According to RFC 4252 section 5.4, the banner is sent between the ssh-connection request and responding to user authentication. Original support for server sending banner by joshua stein <jcs@jcs.org> Fixes golang/go#19567 Change-Id: I729b3c8e5fd2c0068609d1590b61e92f40d87ea4 Reviewed-on: https://go-review.googlesource.com/71790 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2017-10-23Revert "ssh: add support for banners"Han-Wen Nienhuys
This reverts commit ed5229da99e3a6df35c756cd64b6982d19505d86. Reason for revert: missing language tag in banner message breaks auth against other implementations. Change-Id: I18ac5b3fe3b4693688b82ff4b0db02dab739c45b Reviewed-on: https://go-review.googlesource.com/72381 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-10-18ssh: add support for bannersTugdual Saunier
According to RFC 4252 section 5.4, the banner is sent between the ssh-connection request and responding to user authentication. Original support for server sending banner by joshua stein <jcs@jcs.org> Fixes golang/go#19567 Change-Id: I68944a7f4711c0623759f6a59023e8e45a8781aa Reviewed-on: https://go-review.googlesource.com/65271 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
2017-09-15all: fix article typosnamusyaka
a -> an Change-Id: I95a940df64cb825887b75a80eadc822095b49781 Reviewed-on: https://go-review.googlesource.com/63991 Run-TryBot: Alex Vaghin <ddos@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Alex Vaghin <ddos@google.com>
2017-04-03ssh: improve client public key authenticationJames Myers
Previously, the public key authentication for clients would send an enquiry to the remote for every key specified before attempting to authenticate with the server. Now, we immediately try to authenticate once a valid key is found. This results in exchanging fewer packets if the valid key is near the top of the list. If all keys fail, then the number of packets exchanged by the client and server is unaffected. For OpenSSH daemon, an enquiry into the validity of a key without authentication is still recorded as an authentication attempt, so any clients with more than MaxAuthTries public keys would not be able to authenticate using the previous implementation. This change will allow clients to succeed authentication if the successful key is at the start of the list of keys. Change-Id: I8ea42caf40c0864752218c3f6934e86b12f5b81a Reviewed-on: https://go-review.googlesource.com/38890 Reviewed-by: Adam Langley <agl@golang.org>
2017-01-16ssh: rewrite (re)keying logic.Han-Wen Nienhuys
Use channels and a dedicated write loop for managing the rekeying process. This lets us collect packets to be written while a key exchange is in progress. Previously, the read loop ran the key exchange, and writers would block if a key exchange was going on. If a reader wrote back a packet while processing a read packet, it could block, stopping the read loop, thus causing a deadlock. Such coupled read/writes are inherent with handling requests that want a response (eg. keepalive, opening/closing channels etc.). The buffered channels (most channels have capacity 16) papered over these problems, but under load SSH connections would occasionally deadlock. Fixes #18439. Change-Id: I7c14ff4991fa3100a5d36025125d0cf1119c471d Reviewed-on: https://go-review.googlesource.com/35012 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2016-07-04x/crypto/ssh: Add support for retryable authenticationJamie Beverly
Adds a new AuthMethod called "RetryableAuthMethod" which decorates any other authmethod, allowing it to be retried up to maxTries before aborting. Fixes #16077 Change-Id: Ie310c24643e53dca4fa452750a69936674906484 Reviewed-on: https://go-review.googlesource.com/24156 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-03-29x/crypto/ssh: interpret disconnect message as error in the transport layer.Han-Wen Nienhuys
This ensures that higher level parts (e.g. the client authentication loop) never have to deal with disconnect messages. Fixes https://github.com/coreos/fleet/issues/565. Change-Id: Ie164b6c4b0982c7ed9af6d3bf91697a78a911a20 Reviewed-on: https://go-review.googlesource.com/20801 Reviewed-by: Anton Khramov <anton@endocode.com> Reviewed-by: Adam Langley <agl@golang.org>
2014-05-13go.crypto/ssh: fix authentication after all public keys are rejected by a ↵Adam Langley
server. Validating a public key doesn't return any remaining methods so, if all public keys were rejected, a nil slice would be returned for the remaining methods and authentication would stop. We could have validateKey return methods, but that wouldn't solve the problem of what to do if the callback returns no keys. In that case we don't have any keys to test. So this change makes it possible for an AuthMethod to return a nil slice for the remaining methods (meaning "reuse the last list"). It also fixes a scoping bug. Fixes golang/go#7787. LGTM=hanwen R=hanwen CC=golang-codereviews https://golang.org/cl/94350043
2014-05-12go.crypto/ssh: try authentication methods in ClientConfig order.Han-Wen Nienhuys
LGTM=jpsugar, agl R=agl, jpsugar CC=golang-codereviews https://golang.org/cl/92240045
2014-04-09go.crypto/ssh: import gosshnew.Adam Langley
See https://groups.google.com/d/msg/Golang-nuts/AoVxQ4bB5XQ/i8kpMxdbVlEJ R=hanwen CC=golang-codereviews https://golang.org/cl/86190043
2013-10-26go.crypto/ssh: cosmetic: unnest signing code for public key auth.Han-Wen Nienhuys
R=dave CC=golang-dev https://golang.org/cl/15930044
2013-10-25go.crypto/ssh: in {Server,Client}Conn, read session ID fromHan-Wen Nienhuys
transport layer. R=agl, dave CC=golang-dev https://golang.org/cl/15870044
2013-10-25go.crypto/ssh: ensure {Server,Client}Conn do not expose io.ReadWriterDave Cheney
Transport should not be a ReadWriter. It can only write packets, i.e. no partial reads or writes. Furthermore, you can currently do ClientConn.Write() while the connection is live, which sends raw bytes over the connection. Doing so will confuse the transports because the data is not encrypted. As a consequence, ClientConn and ServerConn stop being a net.Conn Finally, ensure that {Server,Client}Conn implement LocalAddr and RemoteAddr methods that previously were exposed by an embedded net.Conn field. R=hanwen CC=golang-dev https://golang.org/cl/16610043
2013-10-10go.crypto/ssh: cosmetic only spelling fixesJonathan Pittman
R=agl, hanwen CC=dave, golang-dev, jpsugar https://golang.org/cl/14430055
2013-09-24go.crypto/ssh: separate kex algorithms into kexAlgorithm class.Han-Wen Nienhuys
Adds readPacket() to conn, and renames conn to packetConn. Key exchanges operate on packetConn, so they can be unittested. R=agl, jpsugar, dave CC=golang-dev https://golang.org/cl/13352055
2013-09-13go.crypto/ssh: introduce PublicKey interface type.Han-Wen Nienhuys
Public functions affected: -AgentKey.Key -AgentClient.SignRequest -ClientKeyring.Key -MarshalPublicKey -ParsePublicKey R=agl, jpsugar, jmpittman CC=golang-dev https://golang.org/cl/13642043
2013-09-09go.crypto/ssh: Begin adding server side support for more than RSA for client ↵Jonathan Pittman
key auth R=agl, dave, hanwen CC=ekg, golang-dev https://golang.org/cl/13528044
2013-09-05go.crypto/ssh: remove misleading marshalPrivRSA.Han-Wen Nienhuys
Properly capitalize publicKey throughout. R=golang-dev CC=agl, dave, golang-dev, jpsugar https://golang.org/cl/13415046
2013-08-27crypto/ssh: Handle msgUserAuthBanner during keyboard-interactive auth.JP Sugarbroad
R=agl, golang-dev CC=golang-dev https://golang.org/cl/12983046
2013-06-21go.crypto/ssh: add hook for host key checking.Han-Wen Nienhuys
R=dave, agl CC=gobot, golang-dev https://golang.org/cl/9922043
2013-06-10go.crypto: revert 7f5a59ff6b43.Adam Langley
This change reverts https://golang.org/cl/10113043/ because some folks are stuck on 1.0 till 1.1.1 comes out. R=golang-dev CC=golang-dev https://golang.org/cl/10151043
2013-06-07go.crypto: remove unreachable code.Adam Langley
I ran go vet over all of go.crypto and removed lots of panic("unreachable") that are no longer needed. R=golang-dev, r, dgryski CC=golang-dev https://golang.org/cl/10113043
2013-06-06go.crypto/ssh: implement keyboard-interactive auth (RFC 4256), bothHan-Wen Nienhuys
on client and server-side. R=dave, agl CC=gobot, golang-dev https://golang.org/cl/9853050
2013-06-06go.crypto/ssh: add a error return to decode(), and avoid casting decode() ↵Han-Wen Nienhuys
output. R=dave, kardianos, agl CC=gobot, golang-dev https://golang.org/cl/9738053
2012-12-15go.crypto: gofmt -w -sMikio Hara
R=golang-dev, dave CC=golang-dev https://golang.org/cl/6948057
2012-12-10go.crypto/ssh: run gofmtAdam Langley
gofmt got better at removing trailing whitespace. R=golang-dev, rsc CC=golang-dev https://golang.org/cl/6929044
2012-06-29go.crypto/ssh: add ClientAuthAgentGary Burd
ClientAuthAgent adapts a *AgentClient to a ClientAuth. R=golang-dev, agl CC=golang-dev https://golang.org/cl/6352056
2012-04-20ssh: cosmetic cleanupsAdam Langley
These are the cosmetic cleanups from the bits of code that I rereviewed. 1) stringLength now takes a int; the length of the string. Too many callers were allocating with stringLength([]byte(s)) and stringLength only needs to call len(). 2) agent.go now has sendAndReceive to remove logic that was duplicated. 3) We now reject negative DH values 4) We now reject empty packets rather than crashing. R=dave, jonathan.mark.pittman CC=golang-dev https://golang.org/cl/6061052
2012-04-01go.crypto/ssh: improve error message when no authentication methods remainDave Cheney
R=golang-dev CC=golang-dev https://golang.org/cl/5960044
2012-02-23ssh: use *rsa.PublicKey or *dsa.PublicKey in interfaces.Adam Langley
Everywhere else in the code base, when we have an interface{} which is a stand in for a public key, we use *foo.PublicKey rather than foo.PublicKey. This change makes ssh reflect that. R=dave, r CC=golang-dev https://golang.org/cl/5686067
2012-01-25go.crypto: initial codeRuss Cox
Manual edits to README. Moved from main Go repository, deleted Makefiles, ran gofix -r go1rename. Tested with: go test code.google.com/p/go.crypto/... R=golang-dev, bradfitz CC=golang-dev https://golang.org/cl/5564059
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 05:51:42 +0000