Add support for SSH certs

[wiktor-k]

This doesn't work but illustrates the way parsing KeyData from binary AddIdentity request with cert fails.

[jcspencer]

It appears these keys are treated differently based on the algorithm in OpenSSH, see here.

ssh-key has two different types here - I don't think you can use KeyData to store certs; instead there is a Certificate type.

Perhaps the algorithm should be read first, and used to determine if the key delivered is a certificate or a raw key - and wrap them both in an enum?

e.g.:

pub enum KeyType {
  Key(KeyData),
  Certificate(Certificate)
}

[wiktor-k]

Yep, exactly. I tried to use KeyData which seem to have support for unknown types: #3 (comment)

Your suggestion to use an enum may be exactly what's needed 👌

As I mentioned in the other comment SSH binary format is not regular and one can't parse it without knowing the schema and the specs are sometimes broken (just yesterday I found reserved values I'm restrict destination constraints that were in the source but not in the spec).

[baloo]

This last commit should fix parsing, but this requires a fix upstream to expose a function:
https://github.com/RustCrypto/SSH/compare/cb2706f118c8a26b185c951ba5818abfb1352cb6...baloo:SSH:baloo/ssh-key/fixes?expand=1

I wouldn't mind if we could put that on the back-burner, get those fixes upstream, and work slowly.

[wiktor-k]

Just FYI after merging a ton of PRs (some of them rebased) I've cleaned up this PR by basically rebasing on top of main and leaving just two commits: my, adding test vectors, and @baloo's which implements.

I wouldn't mind if we could put that on the back-burner, get those fixes upstream, and work slowly.

I think this is a good idea and thanks a lot for working on it! 🙇

[wiktor-k]

This looks just great 👌

I'll want to take a look at it on my computer but I think it's good to be merged. Great job 👏

[wiktor-k]

Okay, I've fixed a couple of small issues I've found and added test case for AddIdentityConstrained with multiple extensions (using my FIDO key and destination constraints). It seems to be working well.

I'll approve this PR and if @baloo doesn't have anything against I propose we merge it :)

Edit: I forgot formally I'm the "author" and cannot approve it... lol :)

[baloo]

ship it