The parameter is incorrect error when connecting to SFTP

[Sergisoft]

Had a service working perfectly for SSH.NET version 2020.0.2 which was able to connect to some SFTP using certificate.

After upgrading to SSH.NET version 2024.2.0 one of my connections stopped working.

The exception details are:

El parámetro no es correcto. (ENG: The parameter is not correct)

   en System.Security.Cryptography.NCryptNative.ImportKeXy(SafeNCryptProviderHandle provider, Byte[] keyBlob, String format)
   en System.Security.Cryptography.CngKey.Import(Byte[] keyBlob, String curveName, CngKeyBlobFormat format, CngProvider provider)
   en System.Security.Cryptography.DSACng.ImportParameters(DSAParameters parameters)
   en Renci.SshNet.Security.DsaKey.LoadDSA()
   en Renci.SshNet.Security.DsaKey..ctor(SshKeyData publicKeyData)
   en Renci.SshNet.ConnectionInfo.<>c.<.ctor>b__132_15(Byte[] data)
   en Renci.SshNet.Security.KeyExchange.ValidateExchangeHash(Byte[] encodedKey, Byte[] encodedSignature)
   en Renci.SshNet.Security.KeyExchangeEC.ValidateExchangeHash()
   en Renci.SshNet.Security.KeyExchange.Finish()
   en Renci.SshNet.Security.KeyExchangeECCurve25519.Finish()
   en Renci.SshNet.Security.KeyExchangeECCurve25519.Session_KeyExchangeEcdhReplyMessageReceived(Object sender, MessageEventArgs`1 e)
   en Renci.SshNet.Session.OnKeyExchangeEcdhReplyMessageReceived(KeyExchangeEcdhReplyMessage message)
   en Renci.SshNet.Messages.Transport.KeyExchangeEcdhReplyMessage.Process(Session session)
   en Renci.SshNet.Session.MessageListener()

I have very basic undestanding of certificates but this was working on the previous version so I wonder what could be wrong now?

[mus65]

Looks like this a DSA key? Maybe this regressed by #1458 . But considering that the next SSH.NET version will drop support for DSA completely, you may want to switch to a new key with a more modern algorithm. See #1558 .

[Sergisoft]

@mus65 thanks for your help!

I would say it is a DSA key. When I open the pem file with notepad it has a header saying "BEGIN DSA PRIVATE KEY"... so most likely you are right.

In case I want to switch to a new algorithm, is this something that needs to be done on both, server and client side, or is this something I can changes on client side only?

As you can see from my questions I'm very rookie on certificates... :)

[Sergisoft]

@mus65 hi again

I downgraded from SSH.NET version 2024.2.0 to SSH.NET version 2024.1.0 and it works again.

Also, it seems the reasons that pushed me to upgrade to 2024.2.0 are also fixed on 2024.1.0.

I hope I can glue to this version for a long time, but I will consider the reasons to discontinue DSA in future.

Thanks for you help!

[mus65]

Looking at the stack trace again, I think it actually fails because of a DSA host key, not because of your key (your DSA key is also an issue though).

So you would have to generate a new private/public key pair, but in order to authenticate, the server needs your new public key. The server would also need to provide a non-DSA host key.

I guess you are talking to a very old SSH server, DSA hat been disabled by default for 10 years. See also https://lwn.net/Articles/958048/