Add support for ECDSA and Ed25519 SSH keys

[Pim Vullers]

When I wanted to add my ECDSA SSH2 key I got the message that the key was invalid. This is probably caused because those keys use a different key identifier structure than the RSA and DSA keys. Please improve the detection to also add support for the newest kind of SSH keys.

The key I tried to add:
ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBISztakMuof8TXWJMb9IpHdntowby/QVs6flRj7BiWwQQF5LNC0ByGHb53T2fWKYF8Jig4l70D3j4t1vJ6FZQ3g= pim@chaos

[Unit 193 (unit193)]

This is currently blocked by https://twistedmatrix.com/trac/ticket/5350 which could be partially fixed by http://twistedmatrix.com/trac/ticket/7413, except Ed25519 which would still need https://github.com/pyca/cryptography/issues/856.

http://twistedmatrix.com/trac/ticket/7693 would also be needed for the pyCA support.

[Damien Cassou (cassou)]

There has been update on http://twistedmatrix.com/trac/ticket/7413. Please update launchpad to take into account ecdsa keys. And it would be nice to also support Ed25519. Thanks

[Colin Watson (cjwatson)]

Don't get too excited. The movement on Twisted #7413 is a necessary prerequisite, but Twisted Conch still doesn't actually have concrete support for ECDSA keys, and Ed25519 is complicated further by the linked cryptography issue.

[Sami Olmari (olmari)]

ED25519 key I'd like to use too, so I'm just making noise here :)

[Bert JW Regeer (bregeer-ctl)]

OpenSSH on OS X sends ed25519 before rsa, this causes an hang until timeout:

https://bugs.launchpad.net/turnip/+bug/1621238

[Unit 193 (unit193)]

http://twistedmatrix.com/trac/ticket/8798 is progress towards both keys, and looks like ECDSA got support with http://twistedmatrix.com/trac/ticket/8828, now just Ed25519 is in https://twistedmatrix.com/trac/ticket/8966 (Though, http://twistedmatrix.com/trac/ticket/8854 might hold things up a tad.)

Still, there's progress and that's good.

[lszyba1 (szybalski)]

Hello,
Could somebody that is handling this ticket change the importance to major.
I'm unable to use launchpad without that key support.
My work requires it:
.ssh/id_ed25519.pub

I was hoping to convert some of the my bzr repo to git, and start using launchpad again and test drive the new git repo features in launchpad.

Please let me know who do I need to contact to get this enabled?
Thank you
Lucas

[Colin Watson (cjwatson)]

There's not much point arguing about the formal Importance of this bug. The reality is that we have the following chain of dependencies before we can fix this:

 1) upgrade Launchpad production to xenial (in progress)
 2) convert Launchpad build system to pip, so that we're no longer blocked on upgrading Twisted by conflicts between zc.buildout and pbr
 3) wait for a version of Twisted to be released that supports ED25519 keys
 4) upgrade to that version of Twisted

We already consider 1) and 2) to be high-priority, but 3) is out of our hands for the time being. Debating the value of the Importance field isn't going to speed anything up.

[Colin Watson (cjwatson)]

Update: we finished upgrading Launchpad production to xenial earlier this year; I just landed the conversion of our build system to pip; and I have a branch in progress to upgrade us to Twisted 16.5.0.

The upstream Twisted work doesn't seem to have finished yet, so we may be near the point where we've done everything we can for the time being. Versions of Twisted newer than 16.5.0 remove gmpy integration, so we'll need to take some care to avoid regressing performance on new connections, but that's doable.