Ability to verify openssh signatures (ssh-keygen -Y)
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 9.9k
- Forks
- 2.1k
- PR merge metrics
- No merged PRs in 30d
Description
Openssh-8.x implements ability to sign arbitrary contents using the ssh-keygen -Y set of subcommands. I think it's possible to achieve the same using the paramiko API, but I've not found an obvious way of doing so, especially considering the need to support arbitrary public key types like sk-ecdsa-sha2-nistp256@openssh.com. Is this something that is currently possible with low-level primitives like verify_ssh_sig? Would it be possible to implement an abstracted API around that (or at least around verification)?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with Paramiko's low-level verify_ssh_sig primitive and compare its capabilities with OpenSSH's ssh-keygen -Y signature verification, including arbitrary public key types such as sk-ecdsa-sha2-nistp256@openssh.com. Done means establishing whether verification is already possible and, if not, defining an abstracted verification API with the required key-type support.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100