x/crypto/ssh: rsa-sha2-256/rsa-sha2-512 tracking issue

[FiloSottile]

OpenSSH migrated the ssh-rsa key type, which historically used the ssh-rsa signature algorithm based on SHA-1, to the new rsa-sha2-256 and rsa-sha2-512 signature algorithms.

x/crypto/ssh was not ready for the key type / signature algorithm mismatch, so it needs a few changes. Moreover, OpenSSH implemented a few mechanisms at the same time to enable the rollout, which we need to assess and expose.

This is a tracking issue for the effort in general. Here's a list of not-duplicate related issues:

• x/crypto/ssh: support RSA SHA-2 host key signatures #37278
  • Fixed by https://golang.org/cl/220037
• x/crypto/ssh: server does not accept rsa-sha2-256 and rsa-sha2-512 signatures #46569
• x/crypto/ssh: support for server-sig-algs extension (RFC8308) #49269
• x/crypto/ssh: publicKeyCallback cannot handshake using ssh-rsa keys signed using the ssh-rsa-sha2-256 algorithm #39885
• x/crypto/ssh: Consider relaxing public key and signature matching for RSA keys in SSH_MSG_USERAUTH_REQUEST #53391
• x/crypto/ssh: cannot sign certificate with different algorithm #36261
  • x/crypto/ssh: add MultiAlgorithmSigner #52132

We'll also need some tests against OpenSSH proper, like the crypto/tls recorded tests against OpenSSL, since https://golang.org/cl/220037 turned out to be a partial fix.

[owenthereal]

👋 I ran into this issue with my project: owenthereal/upterm#93 (comment). I'm wondering whether there is anything I could help.

[gopherbot]

Change https://go.dev/cl/392355 mentions this issue: ssh: don't advertise rsa-sha2 algorithms if we can't use them

[gopherbot]

Change https://go.dev/cl/392354 mentions this issue: ssh: deprecate and replace SigAlgo constants

[gopherbot]

Change https://go.dev/cl/392394 mentions this issue: ssh: support rsa-sha2-256/512 for client authentication (client-side)

[pete-woods]

Should this issue (and others), be marked resolved now?

[FiloSottile]

Almost but not quite, we should also implement server-sig-algs on the server side before we can claim we're done.

Then we can open follow-up issues for adding OpenSSH recorded tests, extending the AlgorithmSigner interface (with another interface upgrade) to allow advertising specific supported algorithms and their preference order, and finally to disable SHA-1 by default throughout (making sure it's possible to turn it back on at least for a bit, which will be complex).

[gopherbot]

Change https://go.dev/cl/392974 mentions this issue: ssh: support rsa-sha2-256/512 for client certificates

[FiloSottile]

Server-side support for rsa-sha2-256/512 is now in master, and available as version v0.2.1-0.20221112162523-6fad3dfc1891.

@golang/release, can we get a v0.2.1 tag, since this fixes compatibility with a wide range of clients?

[heschi]

If v0.3.0 is okay, I can use it as a chance to test http://go.dev/cl/445955. If you want exactly v0.2.1 some code changes will be necessary.

[FiloSottile]

@heschi sure, v0.3.0, test away :)

[heschi]

Something has gone wonky and some builders haven't run on the release branches for the crypto repository. I'll look harder tomorrow if they don't clean themselves up overnight.

[heschi]

Tagging is blocked because the latest commit encountered a data race: https://build.golang.org/log/08e983d39cbf137a9609419873f7a32e8f354d8f. It'll probably tag the next commit, whatever that happens to be. (Perhaps a fix for that race...?)

[idcmp]

Just for tracking purposes, this doesn't fix the client-half regression mentioned in #56342

[heschi]

Tagged.

[drakkan]

I think this issue can be closed, now we should support everything related to rsa-sha-2 and since version 0.16.0 we have also fixed all known regressions.

[kzhui125]

config := ssh.ClientConfig{
  User: user,
  Auth: []ssh.AuthMethod{
	  ssh.PublicKeys(signer),
  },
  HostKeyCallback:   ssh.FixedHostKey(hostKey),
  HostKeyAlgorithms: []string{"ssh-rsa"},
}

"ssh-rsa" is parsed using known_hosts file

"ssh: handshake failed: ssh: no common algorithm for host key; client offered: [ssh-rsa], server offered: [rsa-sha2-512 rsa-sha2-256]"

maybe this should be well documented for HostKeyAlgorithms, or support [rsa-sha2-512 rsa-sha2-256] with [ssh-rsa]

[drakkan]

@kzhui125 the ssh-rsa key type supports the old and insecure ssh-rsa signature algorithm (SHA-1 based) and also rsa-sha2-256, rsa-sha2-512. HostKeyAlgorithms sets the accepted signature algorithms.
With the above configuration you are asking the SSH client to only use the ssh-rsa signature algorithm.
The known_hosts file contains the key type not the signature algorithm.

More details