[Cryptography-dev] Generate a signed SSH user authorized key

[John Walstra via Cryptography-dev]

I’m trying to use cryptography to generate a SSH authorized key that is use 
when the SSH server is set up with TrustedUserCAKeys.

On the Linux command line, the keys are setup as follows

$ ssh-keygen -t rsa -b 2048 -f test
$ ssh-keygen -s /path/to/trusted_user_ca_pk -I test -V +52w test.pub

That will create a test-cert.pub

$ cat test-cert.pub
ssh-rsa-cert-...@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNz... 
K8v+ESbFDSmb+Z9YIE7owjQ2m92s= test@test.local <mailto:xxx@xxxx.local>

$ ssh-keygen -L -f test-cert.pub
test-cert.pub:
        Type: ssh-rsa-cert-...@openssh.com user certificate
        Public key: RSA-CERT SHA256:pXIIcD3P9mD7BLzYYKlx70kNE4y4pkEuJmFsRuUrpFc
        Signing CA: RSA SHA256:a16H80IMdKLq9WZfaMqAEB9kYx7zFzmbwQP3cOeELPI 
(using rsa-sha2-512)
        Key ID: "test"
        Serial: 0
        Valid: from 2023-09-19T23:08:00 to 2024-09-17T23:09:25
        Principals: (none)
        Critical Options: (none)
        Extensions:
                permit-X11-forwarding
                permit-agent-forwarding
                permit-port-forwarding
                permit-pty
                permit-user-rc


Since this appears to be a certificate, I was trying to use x509 to generate 
the certificate.

subject = Name([
    x509.NameAttribute(NameOID.COMMON_NAME, oid),
])
csr = x509.CertificateSigningRequestBuilder().subject_name(
    subject
).sign(private_key, hashes.SHA256(), default_backend())

# Sign the CSR with the CA private key. The ( ) allows
user_certificate = (
    x509.CertificateBuilder()
    .subject_name(csr.subject)
    .issuer_name(subject)
    .public_key(csr.public_key())
    .serial_number(x509.random_serial_number())
    .not_valid_before(datetime.datetime.utcnow())
    .not_valid_after(datetime.datetime.utcnow() + datetime.timedelta(days=days))
    .sign(ca_private_key, hashes.SHA256(), default_backend())
)
authorized_key = user_certificate.public_bytes(
    encoding=serialization.Encoding.PEM,
)
The only encoding that is allowed is PEM, and no formatting is allowed. 
I’ve tried getting the public_key() from user_certificate, and formatting it 
with public_bytes(), but that just gave me a ssh-rsa algorithm key (no cert).
If this is the correct path to get what I want, how do I get this into an 
encoding/format for OpenSSH?

Thanks,
John


_______________________________________________
Cryptography-dev mailing list
Cryptography-dev@python.org
https://mail.python.org/mailman/listinfo/cryptography-dev