Documentation
¶
Overview ¶
Package sshsig signs and verifies SSH signatures (SSHSIG), the format of "ssh-keygen -Y sign" and "ssh-keygen -Y verify", as specified in OpenSSH's PROTOCOL.sshsig.
Its API is exactly the one accepted for golang.org/x/crypto/ssh in proposal golang/go#68197. When x/crypto ships it, callers switch the import and this package is deleted.
Signatures are the raw SSHSIG blob. The armored form ssh-keygen writes is that blob PEM-encoded with type "SSH SIGNATURE".
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Sign ¶
Sign returns a detached SSH Signature for the provided message.
The namespace is a domain-specific identifier for the context in which the signature will be used. It must match between the Sign and Verify calls. A fully-qualified suffix is recommended, e.g. "receiptV2@example.com".
These signatures are compatible with those generated by "ssh-keygen -Y sign", and can be verified with Verify or "ssh-keygen -Y verify". The returned bytes are usually PEM encoded with encoding/pem and type "SSH SIGNATURE".
If the Signer has an RSA PublicKey, it must also implement ssh.AlgorithmSigner. If it also implements ssh.MultiAlgorithmSigner, the first algorithm returned by Algorithms will be used, otherwise "rsa-sha2-512" is used.
func Verify ¶
Verify verifies a detached SSH Signature for the provided message.
The namespace is a domain-specific identifier for the context in which the signature will be used. It must match between the Sign and Verify calls. A fully-qualified suffix is recommended, e.g. "receiptV2@example.com".
The provided signature is usually decoded from a PEM block of type "SSH SIGNATURE" using encoding/pem.
The key inside the signature must equal pub. Both "sha256" and "sha512" message hashes are accepted, and legacy "ssh-rsa" (SHA-1) signatures are rejected, as PROTOCOL.sshsig requires.
Types ¶
This section is empty.
Source Files