kryptco/krypton-ios

Can't use signed pubkey

ppymdjr opened this issue · 1 comments

I'm trying to sign my krypton public key to SSH into a machine which trusts that certificate authority key. I can do so with a non krypton key (just a normal rsa key with the private key stored on my computer), but krypton doesn't seem to be able to authenticate the request when I try to sign my id_krypton.pub key.

I signed it like this:-
ssh-keygen -s ../temp/ca-key -I david -n root -V +1w -z 1 id_krypton.pub

Krypton on iOS reports:-
Request failed
The incoming request was invalid/
UnsupportedSSHDigestAlgorithm(). Please try again.

ssh -vvv reports
debug2: sign_and_send_pubkey: using private key "/Users/david/.ssh/id_krypton" for certificate
debug3: sign_and_send_pubkey: signing using rsa-sha2-512-cert-v01@openssh.com

It seems that rsa-sha2-512-cert-v01@openssh.com is not one of the supported digests (see extension DigestType in Krypton/Keypair+SSHFormat.swift)

What would be required to support this? Would the phone need a copy of the CA public key?

Could it be as simple as this? I'm struggling to build it it myself (missing frameworks and issues with notifications for my developer account - it's been some time since I did any Xcode dev)

--- a/Krypton/Keypair+SSHFormat.swift
+++ b/Krypton/Keypair+SSHFormat.swift
@@ -197,6 +197,8 @@ extension DigestType {
                 self = .sha256
             case "rsa-sha2-512":
                 self = .sha512
+            case "rsa-sha2-512-cert-v01@openssh.com":
+                self = .sha512
             case KeyType.Ed25519.sshHeader():
                 self = .ed25519
             case KeyType.nistP256.sshHeader():