Bug 2853 - PROTOCOL document should describe deviation of public key format from RFC spec
Summary: PROTOCOL document should describe deviation of public key format from RFC spec
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: Documentation (show other bugs)
Version: 7.6p1
Hardware: All All
: P5 normal
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks: V_7_8
  Show dependency treegraph
 
Reported: 2018-04-07 13:37 AEST by Eric Brown
Modified: 2018-10-19 18:01 AEDT (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Eric Brown 2018-04-07 13:37:46 AEST
The SecureShell specification RFC 4716 documents a public key format for persisting public key files. See https://tools.ietf.org/html/rfc4716

However, the PROTOCOL documentation (https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL?annotate=HEAD) does not state how OpenSSH does not use this format.  Instead it creates public key files i n a format similar to the encoded data stated in RFC 4253.

I think a small note about the difference would be beneficial.
Comment 1 Damien Miller 2018-08-10 10:44:38 AEST
Added this section to PROTOCOL, it will be included in the openssh-7.8 release:

4. Miscellaneous changes

4.1 Public key format

OpenSSH public keys, as generated by ssh-keygen(1) and appearing in
authorized_keys files, are formatted as a single line of text consisting
of the public key algorithm name followed by a base64-encoded key blob.
The public key blob (before base64 encoding) is the same format used for
the encoding of public keys sent on the wire: as described in RFC4253
section 6.6 for RSA and DSA keys, RFC5656 section 3.1 for ECDSA keys
and the "New public key formats" section of PROTOCOL.certkeys for the
OpenSSH certificate formats.
Comment 2 Darren Tucker 2018-08-10 11:04:45 AEST
I also added a note to https://www.openssh.com/specs.html that RFC4716 is only supported bu ssh-keygen for key import and export.
Comment 3 Damien Miller 2018-10-19 17:17:28 AEDT
Close RESOLVED bugs with the release of openssh-8.0
Comment 4 Eric Brown 2018-10-19 18:01:00 AEDT
Looks like the new comment added has dead links for ssh-keygen

It links to:
http://man.openbsd.org/keygen.1

Instead of:
http://man.openbsd.org/ssh-keygen.1

And same issue appears in section 4.2 Private key format