vngx/vngx-jsch — Issue #5: bug on DSA signature in user autentication
Author: samuel-aubin
Created: 2011-11-01 16:52:43+00:00
State: open

Bug : during user authentication with a DSA key, the signature of the request sent to the ssh server is not valid, making impossible to open a ssh connection with a user DSA key.
Resolution : I spent a couple of days investigating this issue for my friend David (https://github.com/joval) who needed to support DSA authentication for his software.
I used OpenSSH openssh-5.9p1-dev and the HEAD of totaam fork (https://github.com/totaam/vngx-jsch)
It appears that JSch doesn't decode correctly the signature returned by sun.security.provider.DSA$SHA1withDSA(DSA).engineSign() line: 267
in org.vngx.jsch.algorithm.SignatureDSAImpl.sign() line: 75

I made a patch for this bug (and sent a mail to totaam):
$ less 0001-bug-fix-for-decoding-DSA-signature-from-JDK.patch
From d9db47308221d02cf1f8243704a9a40771830486 Mon Sep 17 00:00:00 2001
From: samuel aubin
Date: Tue, 1 Nov 2011 11:56:37 -0400
Subject: [PATCH] bug fix for decoding DSA signature from JDK

---
.../org/vngx/jsch/algorithm/SignatureDSAImpl.java | 6 ++++--
1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/main/java/org/vngx/jsch/algorithm/SignatureDSAImpl.java b/src/main/java/org/vngx/jsch/algorithm/SignatureDSAImpl.java
index 7bb3906..c46f98c 100644
--- a/src/main/java/org/vngx/jsch/algorithm/SignatureDSAImpl.java
+++ b/src/main/java/org/vngx/jsch/algorithm/SignatureDSAImpl.java
@@ -75,10 +75,12 @@ public final class SignatureDSAImpl implements SignatureDSA {
Buffer signature = new Buffer(_signature.sign());
// signature is in ASN.1
// SEQUENCE::={ r INTEGER, offset INTEGER }
- signature.setOffSet(3);
+ signature.setOffSet(3); // skip DER-sequence type, seq length and DER bytearray type (1 byte each)
+
byte[] r = signature.getBytes(new byte[signature.getByte()]);
+ signature.getByte(); // skip DER bytearray type
byte[] s = signature.getBytes(new byte[signature.getByte()]);
-
+
// result must be 40 bytes, but length of r and offset may not be 20 bytes
byte[] result = new byte[40];
System.arraycopy(r, (r.length > 20) ? 1 : 0,
--
1.7.1