Add support for ecdsa and ed25519 style keys

[claudijd]

We support only RSA/DSA right now, let's support all the keys!

[claudijd]

According to ssh-keyscan, which is what we use to extract these keys, it does support both key styles...

https://www.systutorials.com/docs/linux/man/1-ssh-keyscan/

-t type
Specifies the type of the key to fetch from the scanned hosts. The possible values are rsa1'' for protocol version 1 and dsa'' ecdsa'' ed25519'' or rsa'' for protocol version 2. Multiple values may be specified by separating them with commas. The default is to fetch rsa'' ecdsa'' and ed25519'' keys

Though, when I try on GitHub, I get no such responses. This may be a task for bench testing unless we get a decent public repo candidate to test this with.

[claudijd]

Looks like ssh.mozilla.com supports both, and demonstrates the usage here...

$ ssh-keyscan -t ed25519 ssh.mozilla.com

ssh.mozilla.com:22 SSH-2.0-OpenSSH_7.4

ssh.mozilla.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINO+ybidO9DGOb1dDwyVvGcrCD/wILFWTYtWUQZVxXwH

$ ssh-keyscan -t ecdsa ssh.mozilla.com

ssh.mozilla.com:22 SSH-2.0-OpenSSH_7.4

ssh.mozilla.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBC4gXA5naQtjcKu90NJ7A4jQ1UgxYGdnndJyr4PSZJ59qJUzkoH3VgdTlseXbIZHwO4k2gNcFpaMq5gqVRobAwU=

So we can extract the keys, we can determine their types, but I'm not exactly sure if sshkey supports decryption of these keys, which is the next thing to figure out.

[claudijd]

I've got good news, even though sshkey claims to possess support for only RSA/DSA, it does support ecdsa...

2.4.2 :004 > SSHKey.valid_ssh_public_key? "ssh.mozilla.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBC4gXA5naQtjcKu90NJ7A4jQ1UgxYGdnndJyr4PSZJ59qJUzkoH3VgdTlseXbIZHwO4k2gNcFpaMq5gqVRobAwU="
=> true
2.4.2 :005 > SSHKey.ssh_public_key_bits "ssh.mozilla.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBC4gXA5naQtjcKu90NJ7A4jQ1UgxYGdnndJyr4PSZJ59qJUzkoH3VgdTlseXbIZHwO4k2gNcFpaMq5gqVRobAwU="
=> 520
2.4.2 :006 > SSHKey.fingerprint "ssh.mozilla.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBC4gXA5naQtjcKu90NJ7A4jQ1UgxYGdnndJyr4PSZJ59qJUzkoH3VgdTlseXbIZHwO4k2gNcFpaMq5gqVRobAwU="
=> "be:04:32:74:c6:63:fa:24:c3:c6:78:c2:cd:d2:3e:f4"
2.4.2 :007 > SSHKey.sha1_fingerprint "ssh.mozilla.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBC4gXA5naQtjcKu90NJ7A4jQ1UgxYGdnndJyr4PSZJ59qJUzkoH3VgdTlseXbIZHwO4k2gNcFpaMq5gqVRobAwU="
=> "00:67:e3:4d:78:2f:65:94:87:bf:54:5a:1e:92:af:67:0b:8d:b5:2c"
2.4.2 :008 > SSHKey.sha256_fingerprint "ssh.mozilla.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBC4gXA5naQtjcKu90NJ7A4jQ1UgxYGdnndJyr4PSZJ59qJUzkoH3VgdTlseXbIZHwO4k2gNcFpaMq5gqVRobAwU="
=> "EZe8ZoSwAzDOLR45H2PZ1aGGfnt59ZLrL5bwnjQwTUI="

This basically means, adding support for these will be trivial, I will attempt a PR of them shortly, so we can add them to our supportability list.

[claudijd]

@exploide good news ^^^

[exploide]

Awesome, you really fix all the issues quickly 😁 Thanks!

Tried it and it shows me all the info I need. Fine.

I've got good news, even though sshkey claims to possess support for only RSA/DSA, it does support ecdsa...

As far as I understood, they cannot generate them but at least validate the keys since bensie/sshkey#24 ... That's enough for us :)

One thing about the key size: ecdsa keys are reported with a size of 520 bits. According to https://security.stackexchange.com/a/188209 it should be 521. Not sure if this is correct, I haven't checked the technical details yet, but I wanted to point this out.

[claudijd]

@exploide cool, let me know what you find out about the 521, I was just using what was coming from sshkey, so if it isn't correct, I might just send a PR to sshkey repo to fix and then set a min version requirement in this project to make sure we're using the fixed release. Or, we can patch over it and make it right.

[exploide]

I believe it's indeed a bug bensie/sshkey#35