Displaying 20 results from an estimated 2000 matches similar to: "RSA Signatures using SHA2 provided by different ssh-agent are not properly verified"
2017 Jul 21
15
[Bug 2746] New: RFE: Allow to disable SHA1 signatures for RSA
https://bugzilla.mindrot.org/show_bug.cgi?id=2746
Bug ID: 2746
Summary: RFE: Allow to disable SHA1 signatures for RSA
Product: Portable OpenSSH
Version: 7.5p1
Hardware: Other
OS: Linux
Status: NEW
Severity: enhancement
Priority: P5
Component: ssh
Assignee: unassigned-bugs at
2018 Oct 11
2
no mutual signature algorithm with RSA user certs client 7.8, server 7.4
On Thu, Oct 11, 2018 at 10:41 AM Damien Miller <djm at mindrot.org> wrote:
> On Wed, 10 Oct 2018, Adam Eijdenberg wrote:
> > We see this error on the client side:
> >
> > debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
> > ...
> > debug1: Offering public key: RSA-CERT SHA256:xxx /path/to/key
> > debug1: send_pubkey_test: no
2017 Jan 26
4
Server accepts key: pkalg rsa-sha2-512 vs ssh-rsa
Hi,
I'm doing some test with a pkcs11 token that can only sign short messages.
When connecting to one server, that reports pkalg rsa-sha2-512 blen
151, it fails to sign the pubkey because it is 83 bytes long. (sshd:
OpenSSH_7.3p1)
A older server that reports pkalg ssh-rsa blen 151, works perfectly as
the pubkey signature required is only 35 bytes long. (sshd:
OpenSSH_6.7p1)
I am not sure
2020 Jun 01
3
"ssh -Q key" does not list rsa-sha2 algorithms
With the upcoming deprecation of ssh-rsa I was trying to see what keys my
version of OpenSSH ( 7.8p1 ) supports. I noticed that "ssh -Q key" does not
actually list the suggested algorithms to transition to ( rsa-sha2-256 and
rsa-sha2-512 ) even though they are supported. Looking through the code, it
looks like an issue with the arguments passed to sshkey_alg_list in ssh.c
where it should
2016 May 11
23
[Bug 2568] New: ssh fails to authenticate using RSA keys when agent does not support sha256/512 signatures
https://bugzilla.mindrot.org/show_bug.cgi?id=2568
Bug ID: 2568
Summary: ssh fails to authenticate using RSA keys when agent
does not support sha256/512 signatures
Product: Portable OpenSSH
Version: -current
Hardware: Other
URL: https://github.com/connectbot/connectbot/issues/397
OS: Linux
2020 Jun 01
5
"ssh -Q key" does not list rsa-sha2 algorithms
On Tue, 2 Jun 2020 at 06:12, Christian Weisgerber <naddy at mips.inka.de> wrote
> On 2020-06-01, Ethan Rahn <ethan.rahn at gmail.com> wrote:
>
> > With the upcoming deprecation of ssh-rsa I was trying to see what keys my
> > version of OpenSSH ( 7.8p1 ) supports. I noticed that "ssh -Q key" does not
> > actually list the suggested algorithms to
2016 Dec 23
5
[Bug 2650] New: UpdateHostKeys ignores RSA keys if HostKeyAlgorithms=rsa-sha2-256
https://bugzilla.mindrot.org/show_bug.cgi?id=2650
Bug ID: 2650
Summary: UpdateHostKeys ignores RSA keys if
HostKeyAlgorithms=rsa-sha2-256
Product: Portable OpenSSH
Version: 7.4p1
Hardware: All
OS: All
Status: NEW
Severity: trivial
Priority: P5
Component: ssh
2018 Oct 10
2
no mutual signature algorithm with RSA user certs client 7.8, server 7.4
Hi,
One of our users who is running an OS (I think it's the latest beta
macOS 10.14.1) with ssh version "OpenSSH_7.8p1, LibreSSL 2.7.3" is
unable to use our user SSH RSA certificates to authenticate to our
servers (which are running "OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan
2017").
We see this error on the client side:
debug1: kex_input_ext_info:
2018 Oct 11
3
no mutual signature algorithm with RSA user certs client 7.8, server 7.4
On Thu, 11 Oct 2018, Damien Miller wrote:
> On Thu, 11 Oct 2018, Adam Eijdenberg wrote:
>
> > Thanks for looking into. I wasn't able to get the patch to apply
> > cleanly to the portable source for whatever reason, so I manually made
> > the changes and got a little further. I now get past the "no mutual
> > signature algorithm" client message, and get
2020 Jul 21
11
[RFC PATCH 0/4] PAM module for ssh-agent user authentication
Hi,
The main (and probably the only) use case of this PAM module is to let
sudo authenticate users via their ssh-agent, therefore without having
to type any password and without being tempted to use the NOPASSWD sudo
option for such convenience.
The principle is originally implemented by an existing module [0][1]
and many pages that explain how to use it for such purpose can be
found online.
2015 Dec 11
16
[Bug 2515] New: Implement diffie-hellman-group{14,15,16)-sha256
https://bugzilla.mindrot.org/show_bug.cgi?id=2515
Bug ID: 2515
Summary: Implement diffie-hellman-group{14,15,16)-sha256
Product: Portable OpenSSH
Version: -current
Hardware: All
OS: All
Status: ASSIGNED
Severity: enhancement
Priority: P3
Component: ssh
Assignee: dtucker at
2024 Feb 07
3
[Bug 3665] New: publickey RSA signature unverified: error in libcrypto to RHEL9 sshd (with LEGACY crypto policy enabled)
https://bugzilla.mindrot.org/show_bug.cgi?id=3665
Bug ID: 3665
Summary: publickey RSA signature unverified: error in libcrypto
to RHEL9 sshd (with LEGACY crypto policy enabled)
Product: Portable OpenSSH
Version: 8.7p1
Hardware: ix86
OS: Linux
Status: NEW
Severity: major
2018 Oct 11
2
no mutual signature algorithm with RSA user certs client 7.8, server 7.4
On Thu, 11 Oct 2018, Adam Eijdenberg wrote:
> On Thu, Oct 11, 2018 at 12:13 PM Damien Miller <djm at mindrot.org> wrote:
> > Could you try this?
> >
> > diff --git a/sshconnect2.c b/sshconnect2.c
> > index f104408..1d2906f 100644
> > --- a/sshconnect2.c
> > +++ b/sshconnect2.c
> > @@ -1080,7 +1080,8 @@ key_sig_algorithm(struct ssh *ssh, const
2013 May 15
2
Support for "ssh-rsa-sha256" and "ssh-dss-sha256" ?
Functionality request for supporting Digital Signatures for RSA and DSS
Public Key Algorithms in alignment with NIST SP800-131A.
I
assume this has been asked before, but I could not find in the
archives. Support of "ssh-rsa-sha256" and "ssh-dss-sha256" public key
algorithms for OpenSSH? I know Suite B Algorithms and x509 SSH
Extension Algorithms are supported, but not a
2020 Jun 02
2
"ssh -Q key" does not list rsa-sha2 algorithms
On Tue, 2 Jun 2020 at 18:48, Brian Candler <b.candler at pobox.com> wrote:
[about ssh -Q ssh_config_keyword]
> There is also "-Q key-sig" in recent versions (not sure exactly how recent, but 7.6 doesn't have it)
Added in the same commit (Feb this year), first released in 8.3:
https://github.com/openssh/openssh-portable/commit/d4d9e1d40514e2746f9e05335d646512ea1020c6
--
2020 Sep 16
2
ssh-ed25519 and ecdsa-sha2-nistp256 host keys
Hello.
I am running OpenSSH 7.9p1 on my client and server. ssh-keyscan shows
the server has ssh-rsa, ssh-ed25519, and ecdsa-sha2-nistp256 host
keys. My /etc/ssh/ssh_known_hosts file contains the server's
ssh-ed25519 host key. When I try to SSH to the server I get this
error:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!
2020 Sep 16
2
ssh-ed25519 and ecdsa-sha2-nistp256 host keys
Here you go:
OpenSSH_7.9p1, OpenSSL 1.1.1d 10 Sep 2019
debug1: Reading configuration data /home/ryantm/.ssh/config
debug1: /home/ryantm/.ssh/config line 4: Applying options for *
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 13: Applying options for *
debug2: resolving "{REDACTED}" port 22
debug2: ssh_connect_direct
debug1: Connecting to
2013 Apr 05
1
Using hmac-sha2-256 in OpenSSH 6.2p1
Hi,
I could not use hmac-sha2-256 in OpenSSH 6.2p1. I tried configuring in
sshd_config file also, but the server was not starting. How can I use
hmac-sha2-256 & hmac-sha2-512 in OpenSSH server in accordance with RFC
6668?
I have installed OpenSSH in a computer with the following configuration:
Architecture: x86 32-bit
OS: RHEL AS 4 (Nahant update 4) (Linux version 2.6.9-42.EL)
Thanks and
2017 Apr 04
3
Allow SHA1 deprecation for rsa-sha
Hi,
Following the fix [1] being released on 7.5, now SHA2 RSA signature
methods work properly.
On the other hand it is still not possible to disable SHA1 RSA alone
(as an example, as SHA2-256 or SHA2-512 could also potentially be not
desirable), where it is considered insecure or undesirable.
I am proposing to add a mechanism, and happy to submit a patch, to
enable selection of the Hashes
2017 Apr 05
3
Allow SHA1 deprecation for rsa-sha
On Wed, 5 Apr 2017, Jakub Jelen wrote:
> Disabling SHA-1 for signatures sounds like a good idea these days (and was the
> main reason why the extension created if I read it right [1]).
> This leaves me confused if the use case without SHA1 was missed from the draft
> or it was left as an implementation detail, that was not implemented in
> OpenSSH.
The reasons we didn't