[BUG] - SSH Certificates authentication and and ssh-agent

Are you using paramiko as a client or server?

Client

What feature(s) aren't working right?

Keys/auth

What version(s) of paramiko are you using?

3.4.0

What version(s) of Python are you using?

3.12.4

What operating system and version are you using?

Linux, Arch

If you're connecting as a client, which SSH server are you connecting to?

OpenSSH

If you're using paramiko as part of another tool, which tool/version?

No response

Expected/desired behavior

Paramiko should be able to authenticate using SSH certificates via ssh-agent without expecting to find a different identity for the certificate key.

If you add an ssh certificate to the agent using ssh-add both the certificate and the key are added:

$ ssh-add /home/nicola/ssh_certs/id_rsa
Identity added: /home/nicola/ssh_certs/id_rsa (nicola@p1)
Certificate added: /home/nicola/ssh_certs/id_rsa-cert.pub (myid)

$ ssh-add -l
3072 SHA256:bsBRHC/xgiqBJdSuvSTNpJNLTISP/G356jNMCRYC5Es nicola@p1 (RSA-CERT)
3072 SHA256:bsBRHC/xgiqBJdSuvSTNpJNLTISP/G356jNMCRYC5Es nicola@p1 (RSA)

The example reproducer will work.

But if you have only the ssh certificates in the agent like this

$ ssh-add -l
3072 SHA256:bsBRHC/xgiqBJdSuvSTNpJNLTISP/G356jNMCRYC5Es nicola@p1 (RSA-CERT)

the example reproducer will fail because it tries to use a different identify to sign the request: the identify named RSA in the ssh-add -l output.

It should work even if only the RSA-CERT identity is present in the agent. The request should not be signed using a different identity.

Actual behavior

If only RSA-CERT identity is present in the agent

$ ssh-add -l
3072 SHA256:bsBRHC/xgiqBJdSuvSTNpJNLTISP/G356jNMCRYC5Es nicola@p1 (RSA-CERT)

the example reproducer will fail.

To fix the issue I have to change this line

https://github.com/paramiko/paramiko/blob/51eb55debf2ebfe56f38378005439a029a48225f/paramiko/agent.py#L491

and replace msg.add_string(self.asbytes()) with msg.add_string(self.blob).
I see the comment in the referenced code but in my case SHA-2 is used. Is this a leftover and can we avoid using a different identity now? If so I can try to send a PR.

How to reproduce

import logging
import paramiko

logging.basicConfig()
logging.getLogger("paramiko").setLevel(logging.DEBUG)

command = "pwd"

host = "192.168.1.118"
port = 22 
username = "test_sftp_user"
password = "password"

agent = paramiko.Agent()
for key in agent.get_keys():
	print(key)
	print(key.can_sign())

client = paramiko.client.SSHClient()
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
client.connect(host, username=username, password=password, port=port, look_for_keys=False, allow_agent=True)
_stdin, _stdout,_stderr = client.exec_command(command)
print(_stdout.read().decode())
client.close()
print("OK")

Anything else?

Some old OpenSSH versions also had this bug, for example 7.2p1, but it was fixed in 2016

https://bugzilla.mindrot.org/show_bug.cgi?id=2550
https://github.com/openssh/openssh-portable/commit/c38905ba391434834da86abfc988a2b8b9b62477

Start in paramiko/agent.py around line 491 and compare the signing key data used for SSH certificate identities with the provided reproducer. Verify behavior with an ssh-agent containing only the RSA-CERT identity; done means Paramiko authenticates without looking for or signing with a different identity.