Closed tionis closed 1 month ago
Can you provide more specific details about the precise SSH version used? In addition, would you be able to provide instructions to generate a key which produces a "faulty" key?
Sure, I'm on Arch Linux and used the following openssh version:
OpenSSH_9.8p1, OpenSSL 3.3.1 4 Jun 2024
Here's also a Dockerfile to produce a unparsable signature at /test_file.sig:
FROM debian:latest
RUN apt update
RUN apt install -y openssh-client
RUN ssh-keygen -N "" -f ~/key
RUN echo "test" > test_file
RUN ssh-keygen -Y sign -f ~/key -n file test_file
The code I've used to test it essentially just does
sig, err := sshsig.ParseSignature(sigBytes)
where sigBytes are the bytes in the signature file
Sorry for the delay!
The problem you are running into is that you are trying to parse the signature as PEM-encoded bytes using ParseSignature
. However, this function expects the signature to be in SSH wire format, which is why you are encountering an issue.
Instead, you would probably like to use Unarmor
, which does accept a PEM-encoded signature. See: https://go.dev/play/p/gjxZ6r1ly4Y
For future searchability: you are likely running into this issue if you are presented with an ssh: unmarshal error for field PublicKey of type blob
error. In this case, double-check if you use the right function for your signature bytes.
I see, thank you for looking into it and the explanation. This really helped me!
Parsing of SSH signatures of version 3 seems to fail, here's a signature produced by openssh that doesnt work:
this is the data that was signed: