ed25519 cert support?

[bbigras]

I'm trying to add a cert. let message: Message = from_bytes(bytes)?; fails with an error like this:

error: Utf8Error {
    valid_up_to: 2,
    error_len: Some(
        1,
    ),
},

❯ ssh-add
Enter passphrase for /home/bbigras/.ssh/id_ed25519:
Bad passphrase, try again for /home/bbigras/.ssh/id_ed25519:
Identity added: /home/bbigras/.ssh/id_ed25519 (bbigras@desktop)
Certificate /home/bbigras/.ssh/id_ed25519-cert.pub (some_id) add failed: communication with agent failed

[wiktor-k]

Message needs to be a valid ssh agent message. Could you share a bigger example or link to your repo?

[bbigras]

I don't know a simpler way to get a cert yet, but you can get one with vault:

# start vault
docker run -it --rm --cap-add=IPC_LOCK -p 1234:1234 -e 'VAULT_DEV_ROOT_TOKEN_ID=myroot' -e 'VAULT_DEV_LISTEN_ADDRESS=0.0.0.0:1234' vault

export VAULT_ADDR='http://0.0.0.0:1234'

# password is "myroot"
vault login

vault secrets enable -path=ssh-client-signer ssh

vault write ssh-client-signer/config/ca generate_signing_key=true

vault write ssh-client-signer/roles/my-role -<<"EOH"
{
  "algorithm_signer": "rsa-sha2-256",
  "allow_user_certificates": true,
  "allowed_users": "*",
  "allowed_extensions": "permit-pty,permit-port-forwarding",
  "default_extensions": [
    {
      "permit-pty": ""
    }
  ],
  "key_type": "ca",
  "default_user": "ubuntu",
  "ttl": "30m0s"
}
EOH

vault write -field=signed_key ssh-client-signer/sign/my-role \
    public_key=@$HOME/.ssh/id_ed25519.pub > id_ed25519-cert.pub

Now, if I run ssh-add:

• with the normal ssh-agent, id_ed25519-cert.pub is added successfully
• with https://github.com/wiktor-k/ssh-agent-lib/blob/71ff9a09c7ffea64b163c2c7dd60f4835b2f40ac/examples/key_storage.rs , the cert is not added

[wiktor-k]

Hi,

I've generated a sample cert using this guide and reproduced your issue: yep, the SSH certs are not supported. It seems the parser logic for certs is not right.

I'll add a PR welcome label if anyone wants to tackle this issue.

[wiktor-k]

I've begun some work on this in #33 but it appears the serialization for keys with certs is not supported.

Even though I'm getting "opaque" key the serialization further fails:

running 1 test
XX
before add identity decode
after add identity decode: Other(OpaqueKeypair { public: OpaquePublicKey { algorithm: Other(AlgorithmName { id: "ssh-rsa-cert-v01@openssh.com" }), key: OpaquePublicKeyBytes([0, 0, 0, 28, 115, 115, 104, 45, 114, 115, 97, 45, 99, 101, 114, 116, 45, 118, 48, 49, 64, 111, 112, 101, 110, 115, 115, 104, 46, 99, 111, 109, 0, 0, 0, 32, 209, 0, 61, 42, 171, 32, 150, 191, 68, 88, 105, 80, 182, 20, 254, 192, 138, 11, 168, 33, 145, 99, 215, 84, 178, 250, 110, 3, 148, 218, 245, 3, 0, 0, 0, 3, 1, 0, 1, 0, 0, 1, 129, 0, 250, 255, 242, 97, 62, 94, 242, 5, 203, 83, 77, 109, 32, 30, 48, 19, 150, 140, 202, 16, 176, 230, 136, 135, 206, 95, 129, 3, 193, 203, 224, 217, 168, 37, 26, 211, 110, 241, 112, 117, 251, 76, 56, 80, 252, 83, 8, 228, 31, 176, 184, 229, 135, 205, 118, 194, 182, 191, 148, 225, 208, 112, 189, 246, 210, 210, 118, 147, 27, 178, 23, 199, 218, 12, 94, 66, 184, 226, 118, 47, 194, 32, 224, 139, 74, 162, 143, 54, 84, 251, 95, 142, 77, 91, 36, 165, 191, 133, 101, 43, 102, 54, 254, 161, 65, 20, 118, 91, 220, 209, 81, 53, 105, 0, 214, 67, 137, 50, 231, 121, 163, 25, 111, 175, 171, 139, 202, 7, 50, 127, 157, 135, 91, 78, 123, 61, 32, 58, 136, 217, 28, 168, 160, 71, 175, 237, 53, 58, 28, 89, 84, 139, 45, 135, 146, 213, 84, 93, 87, 197, 102, 54, 69, 155, 227, 236, 131, 214, 224, 211, 196, 196, 216, 164, 87, 211, 190, 122, 13, 200, 31, 13, 45, 118, 75, 17, 114, 206, 145, 213, 165, 52, 245, 45, 199, 30, 184, 201, 239, 32, 66, 6, 106, 232, 10, 106, 139, 43, 253, 87, 55, 188, 231, 55, 47, 156, 39, 16, 71, 56, 190, 37, 179, 180, 135, 245, 189, 76, 20, 106, 25, 211, 199, 76, 34, 235, 206, 139, 112, 4, 87, 183, 88, 248, 140, 35, 102, 29, 107, 136, 201, 112, 150, 42, 204, 138, 143, 207, 20, 200, 186, 10, 154, 131, 56, 167, 241, 131, 119, 23, 9, 241, 125, 61, 243, 17, 186, 237, 128, 119, 165, 92, 164, 27, 66, 249, 143, 253, 236, 159, 105, 82, 68, 145, 18, 22, 90, 77, 36, 45, 232, 105, 170, 125, 202, 236, 242, 138, 101, 122, 222, 109, 124, 41, 113, 46, 95, 252, 90, 108, 232, 76, 195, 251, 71, 88, 15, 60, 239, 168, 27, 188, 43, 251, 105, 140, 199, 232, 76, 212, 16, 114, 89, 40, 97, 195, 63, 104, 158, 236, 234, 97, 71, 58, 127, 17, 12, 0, 75, 243, 236, 109, 91, 97, 47, 170, 83, 23, 83, 29, 70, 85, 147, 160, 202, 134, 191, 147, 225, 3, 46, 220, 66, 181, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 6, 100, 97, 114, 114, 101, 110, 0, 0, 0, 10, 0, 0, 0, 6, 100, 97, 114, 114, 101, 110, 0, 0, 0, 0, 102, 14, 132, 52, 0, 0, 0, 0, 102, 14, 146, 127, 0, 0, 0, 0, 0, 0, 0, 130, 0, 0, 0, 21, 112, 101, 114, 109, 105, 116, 45, 88, 49, 49, 45, 102, 111, 114, 119, 97, 114, 100, 105, 110, 103, 0, 0, 0, 0, 0, 0, 0, 23, 112, 101, 114, 109, 105, 116, 45, 97, 103, 101, 110, 116, 45, 102, 111, 114, 119, 97, 114, 100, 105, 110, 103, 0, 0, 0, 0, 0, 0, 0, 22, 112, 101, 114, 109, 105, 116, 45, 112, 111, 114, 116, 45, 102, 111, 114, 119, 97, 114, 100, 105, 110, 103, 0, 0, 0, 0, 0, 0, 0, 10, 112, 101, 114, 109, 105, 116, 45, 112, 116, 121, 0, 0, 0, 0, 0, 0, 0, 14, 112, 101, 114, 109, 105, 116, 45, 117, 115, 101, 114, 45, 114, 99, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 51, 0, 0, 0, 11, 115, 115, 104, 45, 101, 100, 50, 53, 53, 49, 57, 0, 0, 0, 32, 212, 94, 28, 181, 255, 121, 176, 207, 181, 207, 105, 157, 9, 234, 79, 179, 182, 40, 40, 62, 33, 32, 59, 11, 155, 224, 253, 102, 46, 113, 60, 137, 0, 0, 0, 83, 0, 0, 0, 11, 115, 115, 104, 45, 101, 100, 50, 53, 53, 49, 57, 0, 0, 0, 64, 209, 6, 32, 85, 250, 17, 42, 138, 231, 182, 179, 81, 162, 35, 96, 118, 19, 73, 13, 84, 173, 210, 176, 237, 225, 72, 197, 204, 176, 32, 96, 232, 107, 94, 165, 107, 184, 75, 47, 135, 177, 187, 91, 116, 241, 188, 126, 87, 130, 20, 10, 213, 88, 176, 156, 8, 70, 245, 213, 83, 90, 47, 199, 6]) }, .. })
thread 'roundtrip::path_02_tests_messages_req_add_identity_with_cert_bin' panicked at tests/roundtrip.rs:11:19:

Given the description of cert keys in OpenSSH (
https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.certkeys#L78) I think this is yet another case where SSH protocol makes the serializer act based on the values on the bytestream.

The Opaque deserializers in ssh-key project (https://docs.rs/ssh-key/0.6.5/src/ssh_key/private/opaque.rs.html#80-89) just read a vector and that's it but my understanding at the moment is that one can't just do that.

So the fix would probably be adding the certs formats directly to ssh-key crate and then it'd be automatically supported here.

I'll CC @baloo who is knowledgable enough that he can double-check my thinking :)

So... no happy news now but maybe there's a way forward.

Thanks for your attention~! 👋

[baloo]

This should be fixed by #33, Please post a new comment if we missed something.