apache / apache/mina-sshd

BouncyCastleGeneratorHostKeyProvider requires BouncyCastleKeyPairResourceParser for EC keys

Open
#517 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
1.1k
Forks
400
Avg merge
5d 1h
Merged PRs (30d)
1

Description

### Version

2.12.1

### Bug description

If a BouncyCastleGeneratorHostKeyProvider is set in SshServer.setKeyPairProvider, the generated EC host key cannot be read by Mina's ECDSA PEM reader and a new key is re-generated for every start. Registering BouncyCastleKeyPairResourceParser with SecurityUtils addresses the issue.

SecurityUtils.setKeyPairResourceParser(BouncyCastleKeyPairResourceParser.INSTANCE);

I would propose to either document this clearly in JavaDoc or have a hook in KeyPairProvider to register the KeyPairResourceParser it requires. It took an annoying amount of time to find.

I have seen people asking about the same issue, but have to found a concise answer, so I had to trace this with the .java documentation.

### Actual behavior

14:40:12.598 [main] WARN org.apache.sshd.common.util.security.bouncycastle.BouncyCastleGeneratorHostKeyProvider -- resolveKeyPair(/var/folders/b0/29tsx3jx6vv_fkbw9rsqyy6w0000gn/T/key5380748753361494714pem) Failed (StreamCorruptedException) to load: Invalid DER: object is not an OID: SEQUENCE
java.io.StreamCorruptedException: Invalid DER: object is not an OID: SEQUENCE
at org.apache.sshd.common.util.io.der.ASN1Object.asOID(ASN1Object.java:233)
at org.apache.sshd.common.config.keys.loader.pem.ECDSAPEMResourceKeyPairParser.parseCurveParameter(ECDSAPEMResourceKeyPairParser.java:267)
at org.apache.sshd.common.config.keys.loader.pem.ECDSAPEMResourceKeyPairParser.parseCurveParameter(ECDSAPEMResourceKeyPairParser.java:238)
at org.apache.sshd.common.config.keys.loader.pem.ECDSAPEMResourceKeyPairParser.decodeECPrivateKeySpec(ECDSAPEMResourceKeyPairParser.java:220)
at org.apache.sshd.common.config.keys.loader.pem.ECDSAPEMResourceKeyPairParser.decodeECPrivateKeySpec(ECDSAPEMResourceKeyPairParser.java:163)

### Expected behavior

A cached host key pair should be readable after being written. If a key pair provider needs a specific key pair parser, ensure that both are set in concert or clearly document.

### Relevant log output

_No response_

### Other information

I tested 2.9.3, 2.10.0, 2.11.0, 2.12.0, 2.12.1, the issue was in ll of them. I suspect, that bouncycastle 1.78.1 has a PEM EC file format change for named curves in the last security fixes.

Contributor guide

No contributing guide indexed for this repository

Research direction

Read BouncyCastleGeneratorHostKeyProvider, SecurityUtils, and BouncyCastleKeyPairResourceParser first, then trace the cached EC host-key write and reload path that reaches ECDSAPEMResourceKeyPairParser. Confirm how parser registration is currently handled and define done as making a generated EC host key readable after restart, or documenting the required registration clearly.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.