x/crypto/ssh: OpenSSH 8.8 disabled RSA signatures using the SHA-1 hash algorithm

[fasmide]

What version of Go are you using (go version)?

$ go version
go version go1.16.8 linux/amd64

Does this issue reproduce with the latest release?

Though I didn't test it, I think it would reproduce, as this is most likely an issue with the ssh package and not so much golang itself.

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/fas/.cache/go-build"
GOENV="/home/fas/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/fas/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/fas/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/snap/go/8408"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/snap/go/8408/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.16.8"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/fas/github.com/fasmide/sshdtests/server/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build725442376=/tmp/go-build -gno-record-gcc-switches"

What did you do?

I tried out the ssh.NewServerConn example - and used the latest OpenSSH client (8.8p1)

Using golang.org/x/crypto v0.0.0-20210921155107-089bfa567519

What did you see instead?

# ssh -p2022 172.17.0.1
Unable to negotiate with 172.17.0.1 port 2022: no matching host key type found. Their offer: ssh-rsa

So what is this?

I think the ssh package doesn't implement RFC8332, which in turn also needs RFC8308 in order to work.

As far as I can tell, this makes it impossible for the ssh package to provide RSA based verification using stronger algorithms such as rsa-sha2-256 or rsa-sha2-512

[mpx]

This is #39885

[fasmide]

@mpx Yes it is! thanks! - I was unable to apply the necessary search terms :)