Keep using the default (ssh-rsa) signing algo for SSH handshakes

x/crypto/ssh does not support SHA2 signatures for handshakes yet. We'll
keep using SHA2 for cert signing, but handshakes have to wait.

lib/auth/init.go

@@ -790,7 +790,7 @@ func ReadTLSIdentityFromKeyPair(keyBytes, certBytes []byte, caCertsBytes [][]byt
 	return identity, nil
 }
 
-// ReadSSHIdentityFromKeyPair reads identity from initialized keypair.
+// ReadSSHIdentityFromKeyPair reads identity from initialized keypair
 func ReadSSHIdentityFromKeyPair(keyBytes, certBytes []byte) (*Identity, error) {
 	if len(keyBytes) == 0 {
 		return nil, trace.BadParameter("PrivateKey: missing private key")
@@ -814,10 +814,6 @@ func ReadSSHIdentityFromKeyPair(keyBytes, certBytes []byte) (*Identity, error) {
 	if err != nil {
 		return nil, trace.BadParameter("failed to parse private key: %v", err)
 	}
-	// Inherit the cert signature algorithm from CA signature.
-	// Whatever auth server decided to use for SSH cert signing should be used
-	// by the resulting certs for signing.
-	signer = sshutils.AlgSigner(signer, cert.Signature.Format)
 	// this signer authenticates using certificate signed by the cert authority
 	// not only by the public key
 	certSigner, err := ssh.NewCertSigner(cert, signer)

lib/client/interfaces.go

@@ -27,7 +27,6 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/native"
-	"github.com/gravitational/teleport/lib/sshutils"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
 
@@ -246,10 +245,6 @@ func (k *Key) AsAuthMethod() (ssh.AuthMethod, error) {
 	if signer, err = ssh.NewCertSigner(keys[0].Certificate, signer); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	// Inherit the cert signature algorithm from CA signature.
-	// Whatever auth server decided to use for SSH cert signing should be used
-	// by the resulting certs for signing.
-	signer = sshutils.AlgSigner(signer, keys[0].Certificate.Signature.Format)
 	return NewAuthMethodForCert(signer), nil
 }
 

lib/client/keyagent.go

@@ -435,12 +435,11 @@ func (a *LocalKeyAgent) AuthMethods() (m []ssh.AuthMethod) {
 	}
 	// for every certificate create a new "auth method" and return them
 	m = make([]ssh.AuthMethod, 0)
-	for _, s := range signers {
+	for i := range signers {
 		// filter out non-certificates (like regular public SSH keys stored in the SSH agent):
-		crt, ok := s.PublicKey().(*ssh.Certificate)
+		_, ok := signers[i].PublicKey().(*ssh.Certificate)
 		if ok {
-			s = sshutils.AlgSigner(s, crt.Signature.Format)
-			m = append(m, NewAuthMethodForCert(s))
+			m = append(m, NewAuthMethodForCert(signers[i]))
 		}
 	}
 	return m

lib/reversetunnel/cache.go

@@ -27,7 +27,6 @@ import (
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/defaults"
 	"github.com/gravitational/teleport/lib/sshca"
-	"github.com/gravitational/teleport/lib/sshutils"
 
 	"github.com/gravitational/trace"
 	"github.com/gravitational/ttlmap"
@@ -163,10 +162,6 @@ func (c *certificateCache) generateHostCert(principals []string) (ssh.Signer, er
 	if !ok {
 		return nil, trace.BadParameter("not a certificate")
 	}
-	// Inherit the cert signature algorithm from CA signature.
-	// Whatever auth server decided to use for SSH cert signing should be used
-	// by the resulting certs for signing.
-	privateKey = sshutils.AlgSigner(privateKey, cert.Signature.Format)
 
 	// return a ssh.Signer
 	s, err := ssh.NewCertSigner(cert, privateKey)

lib/service/service.go

@@ -625,9 +625,7 @@ func NewTeleport(cfg *Config) (*TeleportProcess, error) {
 			precomputeCount = 0
 		}
 		var err error
-		cfg.Keygen, err = native.New(process.ExitContext(),
-			native.PrecomputeKeys(precomputeCount),
-		)
+		cfg.Keygen, err = native.New(process.ExitContext(), native.PrecomputeKeys(precomputeCount))
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}

lib/sshutils/signer.go

@@ -43,10 +43,6 @@ func NewSigner(keyBytes, certBytes []byte) (ssh.Signer, error) {
 	if !ok {
 		return nil, trace.BadParameter("expected SSH certificate, got %T ", pubkey)
 	}
-	// Inherit the cert signature algorithm from CA signature.
-	// Whatever auth server decided to use for SSH cert signing should be used
-	// by the resulting certs for signing.
-	keySigner = AlgSigner(keySigner, cert.Signature.Format)
 
 	return ssh.NewCertSigner(cert, keySigner)
 }