Support for rsa-sha2-256 and rsa-sha2-512

[jeson1981]

Do you have plan to support for rsa-sha2-256 and rsa-sha2-512?

[ml054]

If you are looking for temporary solution it might help:

Note: it doesn't need to touch library code and uses latest version 2020.0.1 - so we need reflection to set props on PrivateKeyFile

 /// <summary>
    /// Based on https://github.com/sshnet/SSH.NET/blob/1d5d58e17c68a2f319c51e7f938ce6e964498bcc/src/Renci.SshNet/Security/Cryptography/RsaDigitalSignature.cs#L12
    ///
    /// With following changes:
    ///
    /// - OID changed to sha2-256
    /// - hash changed from sha1 to sha2-256
    /// </summary>
    public class RsaSha256DigitalSignature : CipherDigitalSignature, IDisposable
    {
        private HashAlgorithm _hash;

        public RsaSha256DigitalSignature(RsaWithSha256SignatureKey rsaKey)
            // custom OID
            : base(new ObjectIdentifier(2, 16, 840, 1, 101, 3, 4, 2, 1), new RsaCipher(rsaKey))
        {
            // custom
            _hash = SHA256.Create();
        }

        protected override byte[] Hash(byte[] input)
        {
            return _hash.ComputeHash(input);
        }

        private bool _isDisposed;

        public void Dispose()
        {
            Dispose(true);
            GC.SuppressFinalize(this);
        }

        protected virtual void Dispose(bool disposing)
        {
            if (_isDisposed)
                return;

            if (disposing)
            {
                var hash = _hash;
                if (hash != null)
                {
                    hash.Dispose();
                    _hash = null;
                }

                _isDisposed = true;
            }
        }

        ~RsaSha256DigitalSignature()
        {
            Dispose(false);
        }
    }

 /// <summary>
    /// Utility class which allows ssh.net to connect to servers using ras-sha2-256
    /// </summary>
    public static class RsaSha256Util
    {
        public static void SetupConnection(ConnectionInfo connection)
        {
            connection.HostKeyAlgorithms["rsa-sha2-256"] = data => new KeyHostAlgorithm("rsa-sha2-256", new RsaKey(), data);
        }

        /// <summary>
        /// Converts key file to rsa key with sha2-256 signature
        /// Due to lack of constructor: https://github.com/sshnet/SSH.NET/blob/bc99ada7da3f05f50d9379f2644941d91d5bf05a/src/Renci.SshNet/PrivateKeyFile.cs#L86
        /// We do that in place
        /// </summary>
        /// <param name="keyFile"></param>
        /// <exception cref="ArgumentNullException"></exception>
        public static void ConvertToKeyWithSha256Signature(PrivateKeyFile keyFile)
        {
            var oldKeyHostAlgorithm = keyFile.HostKey as KeyHostAlgorithm;
            if (oldKeyHostAlgorithm == null)
            {
                throw new ArgumentNullException(nameof(oldKeyHostAlgorithm));
            }
            var oldRsaKey = oldKeyHostAlgorithm.Key as RsaKey;
            if (oldRsaKey == null)
            {
                throw new ArgumentNullException(nameof(oldRsaKey));
            }
            
            var newRsaKey = new RsaWithSha256SignatureKey(oldRsaKey.Modulus, oldRsaKey.Exponent, oldRsaKey.D, oldRsaKey.P, oldRsaKey.Q,
                oldRsaKey.InverseQ);

            UpdatePrivateKeyFile(keyFile, newRsaKey);
        }

        private static void UpdatePrivateKeyFile(PrivateKeyFile keyFile, RsaWithSha256SignatureKey key)
        {
            var keyHostAlgorithm = new KeyHostAlgorithm(key.ToString(), key);
            
            var hostKeyProperty = typeof(PrivateKeyFile).GetProperty(nameof(PrivateKeyFile.HostKey));
            hostKeyProperty.SetValue(keyFile, keyHostAlgorithm);

            var keyField = typeof(PrivateKeyFile).GetField("_key", BindingFlags.NonPublic | BindingFlags.Instance);
            keyField.SetValue(keyFile, key);
        }
    }

public class RsaWithSha256SignatureKey : RsaKey
    {
        public RsaWithSha256SignatureKey(BigInteger modulus, BigInteger exponent, BigInteger d, BigInteger p, BigInteger q,
            BigInteger inverseQ) : base(modulus, exponent, d, p, q, inverseQ)
        {
        }

        private RsaSha256DigitalSignature _digitalSignature;

        protected override DigitalSignature DigitalSignature
        {
            get
            {
                if (_digitalSignature == null)
                {
                    _digitalSignature = new RsaSha256DigitalSignature(this);
                }

                return _digitalSignature;
            }
        }

        public override string ToString()
        {
            return "rsa-sha2-256";
        }
    }

Usage:

 [Fact]
        public void CanConnectUsingRsaKeyAndSha256Signature()
        {
            var user = "ml054";
            var host = "192.168.2.154";

            var regularKey = File.ReadAllBytes("c:\\temp\\my_rsa_key");
            var pkRsa = new PrivateKeyFile(new MemoryStream(regularKey));

            RsaSha256Util.ConvertToKeyWithSha256Signature(pkRsa);

            using (var authenticationMethodRsa = new PrivateKeyAuthenticationMethod(user, pkRsa))
            {
                var conn = new ConnectionInfo(host, user, authenticationMethodRsa);
                RsaSha256Util.SetupConnection(conn); // adds rsa-sha2-256

                using (var sshClient = new SshClient(conn))
                {
                    sshClient.Connect();
                    using (var command = sshClient.RunCommand("ls"))
                    {
                        Console.WriteLine(command.Result);
                    }
                }
            }
        }

[ml054]

Didn't check that - however if you manage to find out - please share with others on github.

…

On Wed, Jun 1, 2022 at 2:08 PM jhonson27 ***@***.***> wrote: If you are looking for temporary solution it might help: Note: it doesn't need to touch library code and uses latest version 2020.0.1 - so we need reflection to set props on PrivateKeyFile /// <summary> /// Based on https://github.com/sshnet/SSH.NET/blob/1d5d58e17c68a2f319c51e7f938ce6e964498bcc/src/Renci.SshNet/Security/Cryptography/RsaDigitalSignature.cs#L12 /// /// With following changes: /// /// - OID changed to sha2-256 /// - hash changed from sha1 to sha2-256 /// </summary> public class RsaSha256DigitalSignature : CipherDigitalSignature, IDisposable { private HashAlgorithm _hash; public RsaSha256DigitalSignature(RsaWithSha256SignatureKey rsaKey) // custom OID : base(new ObjectIdentifier(2, 16, 840, 1, 101, 3, 4, 2, 1), new RsaCipher(rsaKey)) { // custom _hash = SHA256.Create(); } protected override byte[] Hash(byte[] input) { return _hash.ComputeHash(input); } private bool _isDisposed; public void Dispose() { Dispose(true); GC.SuppressFinalize(this); } protected virtual void Dispose(bool disposing) { if (_isDisposed) return; if (disposing) { var hash = _hash; if (hash != null) { hash.Dispose(); _hash = null; } _isDisposed = true; } } ~RsaSha256DigitalSignature() { Dispose(false); } } /// <summary> /// Utility class which allows ssh.net to connect to servers using ras-sha2-256 /// </summary> public static class RsaSha256Util { public static void SetupConnection(ConnectionInfo connection) { connection.HostKeyAlgorithms["rsa-sha2-256"] = data => new KeyHostAlgorithm("rsa-sha2-256", new RsaKey(), data); } /// <summary> /// Converts key file to rsa key with sha2-256 signature /// Due to lack of constructor: https://github.com/sshnet/SSH.NET/blob/bc99ada7da3f05f50d9379f2644941d91d5bf05a/src/Renci.SshNet/PrivateKeyFile.cs#L86 /// We do that in place /// </summary> /// <param name="keyFile"></param> /// <exception cref="ArgumentNullException"></exception> public static void ConvertToKeyWithSha256Signature(PrivateKeyFile keyFile) { var oldKeyHostAlgorithm = keyFile.HostKey as KeyHostAlgorithm; if (oldKeyHostAlgorithm == null) { throw new ArgumentNullException(nameof(oldKeyHostAlgorithm)); } var oldRsaKey = oldKeyHostAlgorithm.Key as RsaKey; if (oldRsaKey == null) { throw new ArgumentNullException(nameof(oldRsaKey)); } var newRsaKey = new RsaWithSha256SignatureKey(oldRsaKey.Modulus, oldRsaKey.Exponent, oldRsaKey.D, oldRsaKey.P, oldRsaKey.Q, oldRsaKey.InverseQ); UpdatePrivateKeyFile(keyFile, newRsaKey); } private static void UpdatePrivateKeyFile(PrivateKeyFile keyFile, RsaWithSha256SignatureKey key) { var keyHostAlgorithm = new KeyHostAlgorithm(key.ToString(), key); var hostKeyProperty = typeof(PrivateKeyFile).GetProperty(nameof(PrivateKeyFile.HostKey)); hostKeyProperty.SetValue(keyFile, keyHostAlgorithm); var keyField = typeof(PrivateKeyFile).GetField("_key", BindingFlags.NonPublic | BindingFlags.Instance); keyField.SetValue(keyFile, key); } } public class RsaWithSha256SignatureKey : RsaKey { public RsaWithSha256SignatureKey(BigInteger modulus, BigInteger exponent, BigInteger d, BigInteger p, BigInteger q, BigInteger inverseQ) : base(modulus, exponent, d, p, q, inverseQ) { } private RsaSha256DigitalSignature _digitalSignature; protected override DigitalSignature DigitalSignature { get { if (_digitalSignature == null) { _digitalSignature = new RsaSha256DigitalSignature(this); } return _digitalSignature; } } public override string ToString() { return "rsa-sha2-256"; } } Usage: [Fact] public void CanConnectUsingRsaKeyAndSha256Signature() { var user = "ml054"; var host = "192.168.2.154"; var regularKey = File.ReadAllBytes("c:\\temp\\my_rsa_key"); var pkRsa = new PrivateKeyFile(new MemoryStream(regularKey)); RsaSha256Util.ConvertToKeyWithSha256Signature(pkRsa); using (var authenticationMethodRsa = new PrivateKeyAuthenticationMethod(user, pkRsa)) { var conn = new ConnectionInfo(host, user, authenticationMethodRsa); RsaSha256Util.SetupConnection(conn); // adds rsa-sha2-256 using (var sshClient = new SshClient(conn)) { sshClient.Connect(); using (var command = sshClient.RunCommand("ls")) { Console.WriteLine(command.Result); } } } } @ml054 <https://github.com/ml054> can something similar be used in other authentication methods ? I am having issues with host key algorithm not supported when connecting with user name and password using KeyboardInteractiveAuthenticationMethod host supports rsa-sha2-512,rsa-sha2-256 Thanks — Reply to this email directly, view it on GitHub <#825 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJRI75K7W5P6ASR23LK3ITVM5HE7ANCNFSM45BTP6LA> . You are receiving this because you were mentioned.Message ID: <sshnet/SSH. ***@***.***>

-- <https://ravendb.net/> *Marcin Lewandowski* *Team Leader / Hibernating Rhinos LTD <https://hibernatingrhinos.com/>* Sales: ***@***.*** Skype: ml054 Support: ***@***.*** <https://www.facebook.com/pages/RavenDB/265907650186374> <https://twitter.com/ravendb> <https://www.linkedin.com/groups/RavenDB-4499263>

[nicholi]

Thanks for this workaround, works great.

[superlazycoder]

Thank you so much for this. I was pulling my hair out.

Score 1 for open source.

[lcheng526]

I have implemented the workaround solution which is provided in this

Thanks for this workaround, works great.

The workaround solution does not work for me. I am getting "Key Exchange negotiation failed" exception for rsa-sha2-256.

please help me out?

[lcheng526]

The workaround solution does not work for me. I am getting "Key Exchange negotiation failed" exception for rsa-sha2-256.

please help me out?

[ml054]

@lcheng526 How about this: #971 ? Did you give a try? If it doesn't work. You can always play with debugger and try to fix by yourself. Believe me it is great adventure to play with opensource library and fix such issues. Good luck. :)