If one of both sides is slow, the first kex completes implicitly. The
first kex also produces msgNewKeys, and this must be read to ensure
that the authentication code is not confused by it.
Before this fix, the problem could be reproduced by inserting a sleep
just before the requestInitialKeyChange call.
Fixes#15198
Change-Id: I602db5dd37b2d8556c88ab4cdb693ccf90147a3d
Reviewed-on: https://go-review.googlesource.com/23137
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
Reviewed-by: Adam Langley <agl@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
3des-cbc is an insecure cipher. As such, you must explictly add it to
Config in order to use it.
Change-Id: Ifd15cde46a9908eefef1c75bae7e97b05767361d
Reviewed-on: https://go-review.googlesource.com/22770
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
Added support for parsing the "new" openssh private key format.
(ed25519 keys only in this format for now)
Signing and verifying functions now work with ed25519 keys.
ed25519 can now be accepted by the server to authenticate a client.
ed25519 can now be accepted by a client as a server host key.
Related documentation used:
https://www.ietf.org/archive/id/draft-bjh21-ssh-ed25519-02.txt
Change-Id: I84385f24d666fea08de21f980f78623f7bff8007
Reviewed-on: https://go-review.googlesource.com/22512
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
Make x/crypto/ssh tests compatible with recent OpenSSH versions.
This means not using rsa keys shorter than 1024 bits any more, and
explicitly enabling all key types in the OpenSSH config, since some
are now disabled by default.
Tested against OpenSSH_7.2p2 and now passes.
Change-Id: I607bf15f063d4833b0876393d6845a4f507f48af
Reviewed-on: https://go-review.googlesource.com/22840
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
This change “graduates” the Ed25519 package from my personal GitHub
account to x/crypto. At this point, the code and algorithm seems
sufficiently mature that it warrants more general exposure. (There seem
to be about 110 packages importing it from my GitHub repo:
https://godoc.org/github.com/agl/ed25519?importers)
Two people made changes to the code while it was living in my GitHub.
Both have signed the CLA and both have confirmed that they intended
their changes to be covered by it. (Recorded internally in b/28166583.)
The significant change from GitHub to x/crypto is that the types of
public keys, private keys and signatures have been changed from pointers
to arrays into []byte and that support for crypto.Signer has been added.
Updates golang/go#8581
Change-Id: Ia8632d2153e289363b50d76fd0662d1a7fed00f6
Reviewed-on: https://go-review.googlesource.com/22030
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Reviewed-by: Martin Garton <garton@gmail.com>
Reviewed-by: Adam Langley <agl@golang.org>
Run-TryBot: Adam Langley <agl@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
This allows the golang ssh-agent to support the full suite of keys
the library accepts.
Currently constraints are ignored.
Change-Id: I7d48c78e9a355582eb54788571a483a736c3d3ef
Reviewed-on: https://go-review.googlesource.com/21536
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
A previous fix to improve performance based on alignment
to sha3 was made in both ppc64le and ppc64, when it should
have only applied to ppc64le. This changes the build tags
so it is only done for ppc64le.
Fixesgolang/go#15392
Change-Id: Idf32a0370f3c76fc2b54a2897a668acbae5d43c5
Reviewed-on: https://go-review.googlesource.com/22323
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Some ssh-agent clients expect the server to support remove all messages
for protocols 1 & 2 and error if protocol 1 support is missing.
This adds a null-op implementation of the remove all message in similar
fashion to the existing list all message support.
Fixesgolang/go#15159
Change-Id: I9389885d89c9147f3e10850893bba6ed7d0a4e82
Reviewed-on: https://go-review.googlesource.com/21468
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
Originated from github.com/google/goacme.
This does not include goacme command line program
github.com/google/goacme/cmd/goacme. It will probably live somewhere
else.
Change-Id: I852d55c1a3673fab208e6e2aa19d22be42b8719f
Reviewed-on: https://go-review.googlesource.com/20837
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
This is done by running the key exchange and setting the session ID
under mutex. If the first exchange encounters an already set session
ID, then do nothing.
This fixes a race condition:
On setting up the connection, both sides sent a kexInit to initiate
the first (mandatory) key exchange. If one side was faster, the
faster side might have completed the key exchange, before the slow
side had a chance to send a kexInit. The slow side would send a
kexInit which would trigger a second key exchange. The resulting
confirmation message (msgNewKeys) would confuse the authentication
loop.
This fix removes sessionID from the transport struct.
This fix also deletes the unused interface rekeyingTransport.
Fixes#15066
Change-Id: I7f303bce5d3214c9bdd58f52d21178a185871d90
Reviewed-on: https://go-review.googlesource.com/21606
Reviewed-by: Adam Langley <agl@golang.org>
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
To facilitate testing of methods in other GOOSs we need plan9 to
be able to build and run the test without a errors due to
undefined methods.
Fixesgolang/go#15195
Change-Id: Ida334676f92db6fb4652af3e3a9f6bc13a96052c
Reviewed-on: https://go-review.googlesource.com/21711
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
Previously, only V4 signatures were allowed in PGP messages,
and attempts to digest a message with a V3 signature would
yield an `errors.StructuralError("LiteralData not followed by Signature")`.
This patch fixes this shortcoming, by trying to consume either
signature type and verifying accordingly.
Change-Id: I27c8ea781b75b0f7dfc42c01e7de40f3323e9579
Reviewed-on: https://go-review.googlesource.com/14794
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
When parsing a truncated clearsigned message (one that includes the
opening header but no armored data), the existing implementation of
clearsign.Decode() hangs in an infinite loop. This commit changes
Decode() to detect the end of the buffer and return as if no
clearsigned message was found.
Change-Id: Ibc85b29a08d22868470f48fe300bf8fcb4749768
Reviewed-on: https://go-review.googlesource.com/17693
Reviewed-by: Adam Langley <agl@golang.org>
Previously, OCSP errors (like “malformed request”, not “that certificate
is revoked”) were intended to result in a Response being returned with
Status set to ServerFailed. However, since an “optional” tag was missing
in the ASN.1, a parse error was actually returned.
This CL changes that behaviour so that ParseResponse will now return an
error for these responses. That error will be a ResponseError, allowing
callers to find the exact error code.
Change-Id: I4f8ae5ba39203c2c204fb1d65471d1427bf68b25
Reviewed-on: https://go-review.googlesource.com/18944
Reviewed-by: Adam Langley <agl@golang.org>
When writing keys that contain ElGamal subkeys, the openpgp
package would previously return an error.
Change-Id: I1c487f4a9cfb92b40e99e9be6aa4ed5928e36dbe
Reviewed-on: https://go-review.googlesource.com/18254
Reviewed-by: Adam Langley <agl@golang.org>
Some current uses of OCSP require extensions. In particular, Certificate
Transparency (RFC 6962) can use an OCSP extension to carry a Signed
Certificate Timestamp. This patch adds support for OCSP extensions (in
particular, singleExtensions), by adding Extensions and ExtraExtensions
fields with the same semantics as in x509.Certificate.
As a side-effect, trying to parse a response with a critical extension
will now return an error, just like parsing a certificate.
This change does not enable extensions in OCSP requests, just responses.
Change-Id: I5918f26ea1bb9d1ece96e85a6bb7691c7c017467
Reviewed-on: https://go-review.googlesource.com/18202
Reviewed-by: Adam Langley <agl@golang.org>
The Remove method for the keyring sliced the internal keys list
incorrectly when removing a key. This caused the wrong key to be removed
or sometimes multiple keys were removed. Additionally, if the key to be
removed was the last key, the method never returned.
Fixesgolang/go#13628
Change-Id: I0facbcb8f8b65709222067ce37ea26e3fb5ba8e8
Reviewed-on: https://go-review.googlesource.com/17870
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
We have clang-format these days to eliminate any worries about C-code
formatting.
Change-Id: I86433d99f786ac4091c39eb4a41422c5a18d4d4a
Reviewed-on: https://go-review.googlesource.com/16937
Reviewed-by: Andrew Gerrand <adg@golang.org>
The test for this package contains a test case (disabled by default)
that exercises the code against libotr (the reference implementation).
Since that test was written, libotr has updated to version 4 which
contains non-backwards-compatible API changes.
This change updates the test harness for version 4 of libotr.
Change-Id: Ib40c899c609cc827903ae18fd80476d179bf0a33
Reviewed-on: https://go-review.googlesource.com/16936
Reviewed-by: Andrew Gerrand <adg@golang.org>
Since the test against libotr (disabled by default) runs forever, any
errors should be fatal otherwise they'll never be noticed.
Change-Id: Idf07dd963260f140be1950afcbd04331b56bd627
Reviewed-on: https://go-review.googlesource.com/16935
Reviewed-by: Andrew Gerrand <adg@golang.org>
The OTR implementation had a bug where key slots would not be marked as
unused after a rehandshake. Since handshaking resets the key ids, some
key slots would be left over with much higher key ids. These key slots
would lead to an error when the code ran out of slots.
Fixesagl/xmpp-client#96.
Change-Id: I013bbc4eaf0616373ab52f14b7f7757c353983ca
Reviewed-on: https://go-review.googlesource.com/16934
Reviewed-by: Andrew Gerrand <adg@golang.org>
cound -> could
Also change fmt.Errorf -> errors.New for consistency.
Change-Id: I0b6900a76b70cd37ab2e8d61327868b46366ec64
Reviewed-on: https://go-review.googlesource.com/11235
Reviewed-by: Adam Langley <agl@golang.org>
* The other side is left hanging, waiting for their chance to do the
comparison.
Change-Id: I186933ebb53a30e190414c5572206851681e0a37
Reviewed-on: https://go-review.googlesource.com/15260
Reviewed-by: Adam Langley <agl@golang.org>
A bug in the PBKDF implementation in the pkcs12 package caused certain
inputs to produce the wrong output. In step 6C, we treat Ij as a big.Int
of v bytes and compute Ij + B + 1. The resulting big.Int can have
leading zero bytes, such that Ij.Bytes() produces a byte array that is
smaller than v bytes. In this case we must zero-pad the output to make
Ijb properly sized.
Change-Id: I6e672e6f6bbbd5bea419355d318db289731bb174
Reviewed-on: https://go-review.googlesource.com/16520
Reviewed-by: Adam Langley <agl@golang.org>
SymmetricKeyEncrypted cached the results of decryption so, if a bad
password was given, ReadMessage would prompt forever because a later,
correct password wouldn't override the cached decryption.
The SymmetricKeyEncrypted object can't know whether a given passphrase
is correct so it should never have been a mutable object in the first
place. This change makes it so that it doesn't cache anything.
Fixes#9315
Change-Id: Ic2b75f7f60a575e2182ac7e5c5d4198597c5d0a2
Reviewed-on: https://go-review.googlesource.com/14038
Reviewed-by: Andrew Gerrand <adg@golang.org>
Reviewed-by: Adam Langley <agl@golang.org>
280be00 introduced custom server versions; however, at least OpenSSH
clients do not accept a server version that doesn't start with a
protocol version like "SSH-2.0-"; this is not documented in this
library, and automatically adding it in case that the user did not does
no harm.
Change-Id: Iafc23b23160a8277b10cbf29778dc64a96351bd7
Reviewed-on: https://go-review.googlesource.com/14018
Reviewed-by: Adam Langley <agl@golang.org>
This adds a NewSignerFromSigner to crypto/ssh which takes a
crypto.Signer and turns it into an ssh.Signer, helpful if, e.g., your
crypto.Signer is backed by some sort of hardware device.
The interfaces are very similar - the biggest differences are that a
crypto.Signer accepts hashed data, while an ssh.Signer does not, and
some differences in encoding for DSA and ECDSA signatures.
This also adjusts NewSignerFromKey to use NewSignerFromSigner where
possible, dropping the rsaPrivateKey and ecdsaPrivateKey types in
favor of wrappedSigner. (However, because *dsa.PrivateKey is not a
crypto.Signer, we still have to keep dsaPrivateKey)
Change-Id: Ia2e20ece9c9d3844b4e5a64c1a7d997178ec8781
Reviewed-on: https://go-review.googlesource.com/10953
Reviewed-by: Adam Langley <agl@golang.org>
Han-Wen Nienhuys
Sam Hug
Martin Garton
Alex Vaghin
Artyom Pervukhin
Adam Langley
Peter Moody
Scott Bell
Lynn Boger
Mark Severson
John Schnake
Maxwell Krohn
Julian Kornberger
Jacob H. Haven
Benjamin Wester
Peter Moody
Sami Commerot
Brad Fitzpatrick
Richard Barnes
Carl Jackson
Jonathan Boulle
Arlo Breault
Cedric Staub
Paul Meyer
Lewin Bormann
Evan Broder
Reinaldo de Souza Jr