Repository navigation
Pad RSA signatures which have leading zeroes removed - #1855
Merged
Merged
Conversation
The BCL (at least the Windows crypto provider) seems to expect signatures matching the modulus size and fails verification even if the difference is just leading zeroes. So add them if needed. This is basically the same as sshnet#1388 in the opposite direction. I believe this fixes one of the issues reported in sshnet#1799 that has roughly 1% or 2% failure rate (lines up with the upper byte of the signature being roughly uniform in [0, 255]).
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
A null signature now causes a NullReferenceException during padding instead of the previous ArgumentNullException, changing public argument-validation behavior and bypassing callers’ argument-error handling.
What changed in this PR
This PR improves SSH.NET’s compatibility with servers that omit leading zeroes from RSA signatures, addressing a possible cause of the intermittent host-key verification failures reported in #1799.
Changes:
- Pad incoming RSA signatures to the modulus size before verification.
- Extend regression coverage to verify shortened signatures, reject corrupted signatures, and preserve leading zeroes when signing.
| File | Description |
|---|---|
test/Renci.SshNet.Tests/Classes/Security/Cryptography/RsaDigitalSignatureTest.cs |
Expands leading-zero regression tests with valid and corrupted shortened signatures. |
src/Renci.SshNet/Security/Cryptography/RsaDigitalSignature.cs |
Pads RSA signatures before passing them to the platform verifier. |
Review effort: Balanced
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This was referenced Nov 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The BCL (at least the Windows crypto provider) seems to expect signatures matching the modulus size and fails verification even if the difference is just leading zeroes. So add them if needed. This is basically the same as #1388 in the opposite direction.
I believe this fixes one of the issues reported in #1799 that has roughly 1% or 2% failure rate (lines up with the upper byte of the signature being roughly uniform in [0, 255]).