From: Fabian Stelzer <fs@gigacodes.de>
Date: Tue, 31 May 2022 07:34:45 GMT
Subject: Re: [PATCH] ssh signing: Support ECDSA as literal SSH keys
Message-ID: <20220531073445.iuovy634ufp5xims@fs>
In-Reply-To: <pull.1272.git.git.1653932705097.gitgitgadget@gmail.com>

On 30.05.2022 17:45, Andy Lindeman via GitGitGadget wrote:
>From: Andy Lindeman <andy@lindeman.io>
>
>Keys generated using `ssh-keygen -t ecdsa` or similar are being rejected
>as literal SSH keys because the prefix is `ecdsa-sha2-nistp256`,
>`ecdsa-sha2-nistp384` or `ecdsa-sha2-nistp521`.
>
>This was acknowledged as an issue [1] in the past, but hasn't yet been
>fixed.

Hi Andy,
thanks for your report. We have decided in the past to not explicitly cater 
to every key prefix and instead use `key::` for literal keys.
See 
https://git-scm.com/docs/git-config#Documentation/git-config.txt-usersigningKey

`For backward compatibility, a raw key which begins with "ssh-", such as 
"ssh-rsa XXXXXX identifier", is treated as "key::ssh-rsa XXXXXX identifier", 
but this form is deprecated; use the key:: form instead.`

>
>[1]: https://github.com/git/git/pull/1041#issuecomment-971425601
>
>Signed-off-by: Andy Lindeman <andy@lindeman.io>
>---
>    ssh signing: Support ECDSA as literal SSH keys
>
>    Keys generated using ssh-keygen -t ecdsa or similar will currently be
>    rejected as literal SSH keys because the prefix is ecdsa-sha2-nistp256,
>    ecdsa-sha2-nistp384 or ecdsa-sha2-nistp521.
>
>    This was acknowledged as an issue in the past, but hasn't yet been
>    fixed.
>
>    https://github.com/git/git/pull/1041#issuecomment-971425601
>
>Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-git-1272%2Falindeman%2Fecdsa-sha2-keys-v1
>Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-git-1272/alindeman/ecdsa-sha2-keys-v1
>Pull-Request: https://github.com/git/git/pull/1272
>
> gpg-interface.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/gpg-interface.c b/gpg-interface.c
>index 280f1fa1a58..086bd03b51d 100644
>--- a/gpg-interface.c
>+++ b/gpg-interface.c
>@@ -779,7 +779,7 @@ static int is_literal_ssh_key(const char *string, const char **key)
> {
> 	if (skip_prefix(string, "key::", key))
> 		return 1;
>-	if (starts_with(string, "ssh-")) {
>+	if (starts_with(string, "ssh-") || starts_with(string, "ecdsa-sha2-")) {
> 		*key = string;
> 		return 1;
> 	}
>
>base-commit: 8ddf593a250e07d388059f7e3f471078e1d2ed5c
>-- 
>gitgitgadget