openssh unix dev - Apr 2019 - 1024 RSA keys failing at mm_answer_keyverify

Hi,
I am trying to debug why, when I use 1024 size RSA keys, ssh from client
fails. The keys are copied fine. Permissions looks good. 2048 to 8192 sized
keys work fine.

I tried enabling logs, however, I am not able to understand the below
error. Attaching sshd_config and snipped log files.

auth.debug: Apr 26 18:48:21 vm1 sshd[2442]: debug1: Client protocol version
2.0; client software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.8
auth.debug: Apr 26 18:48:21 vm1 sshd[2442]: debug1: match: OpenSSH_7.2p2
Ubuntu-4ubuntu2.8 pat OpenSSH* compat 0x04000000
auth.debug: Apr 26 18:48:21 vm1 sshd[2442]: debug1: Local version string
SSH-2.0-OpenSSH_7.6
<snip>
auth.debug: Apr 26 18:48:21 vm1 sshd[2442]: debug3: mm_request_send
entering: type 23
auth.debug: Apr 26 18:48:21 vm1 sshd[2442]: debug3: mm_sshkey_verify
entering [preauth]
auth.debug: Apr 26 18:48:21 vm1 sshd[2442]: debug3: mm_request_send
entering: type 24 [preauth]
auth.debug: Apr 26 18:48:21 vm1 sshd[2442]: debug3: mm_sshkey_verify:
waiting for MONITOR_ANS_KEYVERIFY [preauth]
auth.debug: Apr 26 18:48:21 vm1 sshd[2442]: debug3:
mm_request_receive_expect entering: type 25 [preauth]
auth.debug: Apr 26 18:48:21 vm1 sshd[2442]: debug3: mm_request_receive
entering [preauth]
auth.debug: Apr 26 18:48:21 vm1 sshd[2442]: debug3: mm_request_receive
entering
auth.debug: Apr 26 18:48:21 vm1 sshd[2442]: debug3: monitor_read: checking
request 24
*auth.debug: Apr 26 18:48:21 vm1 sshd[2442]: debug3: mm_answer_keyverify:
publickey 0x7f4120b43cd0 signature unverified*

Thanks,
Manju

On Mon, Apr 29, 2019 at 12:19:15PM -0700, Manju Prabhu
wrote:
> Hi,
> I am trying to debug why, when I use 1024 size RSA keys, ssh from client
> fails. The keys are copied fine. Permissions looks good. 2048 to 8192 sized
> keys work fine.
[...]
> *auth.debug: Apr 26 18:48:21 vm1 sshd[2442]: debug3: mm_answer_keyverify:
> publickey 0x7f4120b43cd0 signature unverified*
That ultimately ends up in ssh-rsa.c:ssh_rsa_verify(), but the debug
message does not include the return code.  This adds a bit more
debugging, what does it report?

diff --git a/monitor.c b/monitor.c
index 60e529444..f2f875732 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1431,8 +1431,8 @@ mm_answer_keyverify(struct ssh *ssh, int sock, struct
sshbuf *m)
 
 	ret = sshkey_verify(key, signature, signaturelen, data, datalen,
 	    sigalg, ssh->compat);
-	debug3("%s: %s %p signature %s", __func__, auth_method, key,
-	    (ret == 0) ? "verified" : "unverified");
+	debug3("%s: %s %p signature %s (%s)", __func__, auth_method, key,
+	    (ret == 0) ? "verified" : "unverified", ssh_err(ret));
 	auth2_record_key(authctxt, ret == 0, key);
 
 	free(blob);
diff --git a/ssh-rsa.c b/ssh-rsa.c
index 9b14f9a9a..378db0300 100644
--- a/ssh-rsa.c
+++ b/ssh-rsa.c
@@ -248,7 +248,7 @@ ssh_rsa_verify(const struct sshkey *key,
 {
 	const BIGNUM *rsa_n;
 	char *sigtype = NULL;
-	int hash_alg, want_alg, ret = SSH_ERR_INTERNAL_ERROR;
+	int bits, hash_alg, want_alg, ret = SSH_ERR_INTERNAL_ERROR;
 	size_t len = 0, diff, modlen, dlen;
 	struct sshbuf *b = NULL;
 	u_char digest[SSH_DIGEST_MAX_LENGTH], *osigblob, *sigblob = NULL;
@@ -258,9 +258,12 @@ ssh_rsa_verify(const struct sshkey *key,
 	    sig == NULL || siglen == 0)
 		return SSH_ERR_INVALID_ARGUMENT;
 	RSA_get0_key(key->rsa, &rsa_n, NULL, NULL);
-	if (BN_num_bits(rsa_n) < SSH_RSA_MINIMUM_MODULUS_SIZE)
+	bits = BN_num_bits(rsa_n);
+	if (bits < SSH_RSA_MINIMUM_MODULUS_SIZE) {
+		debug3("%s: key smaller than minimum %d bits vs %d", __func__,
+		    bits, SSH_RSA_MINIMUM_MODULUS_SIZE);
 		return SSH_ERR_KEY_LENGTH;
-
+	}
 	if ((b = sshbuf_from(sig, siglen)) == NULL)
 		return SSH_ERR_ALLOC_FAIL;
 	if (sshbuf_get_cstring(b, &sigtype, NULL) != 0) {

-- 
Darren Tucker (dtucker at dtucker.net)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA (new)
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.