Class SshKeySigner

Namespace

SshSharp

Assembly

SshSharp.dll

Signs with a private key that SshSharp never sees: one in Azure Key Vault or AWS KMS, in an HSM behind PKCS#11, on a smart card. Derive from it, then pass it to FromSigner(SshKeySigner, string?) to use the key like any other (for public key authentication, with a certificate, or for SSH signatures). For a key that .NET's RSA or ECDsa already holds, including non-exportable Windows CNG keys, use FromRsa(RSA, string?) or FromECDsa(ECDsa, string?).

public abstract class SshKeySigner

Inheritance

object

SshKeySigner

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Every signature is checked against PublicKey before it is used, so a signature in the wrong format, or from another key, fails at once with a CryptographicException rather than as an authentication failure on the server.

Key types: Ed25519, ECDSA (P-256, P-384, P-521) and RSA (2048 bits or more).

Constructors

SshKeySigner(ReadOnlyMemory<byte>)

Creates a signer for the key whose public half is publicKey.

Properties

EcdsaSignatureFormat

How SignAsync(SshSignRequest, CancellationToken) returns an ECDSA signature: r || s at the curve's width (IeeeP1363FixedFieldConcatenation, as .NET's SignData(byte[], HashAlgorithmName) does) by default, or DER (Rfc3279DerSequence), as many key services and PKCS#11 tokens answer. Ignored for other key types.

KeyType

The key type: ssh-ed25519, ecdsa-sha2-nistp256 (or 384, 521) or ssh-rsa.

PublicKey

The public key in SSH wire format.

SignatureAlgorithms

The SSH signature algorithms this signer can sign with, most preferred first: ssh-ed25519, the key's own ecdsa-sha2-*, or rsa-sha2-512 then rsa-sha2-256 for RSA (never SHA-1 ssh-rsa). Override to offer fewer, for a service that signs only with SHA-256, for example. Read once, by FromSigner(SshKeySigner, string?).

Methods

SignAsync(SshSignRequest, CancellationToken)

Signs Data with Algorithm, one of SignatureAlgorithms; the algorithm fixes the hash, and a service that signs a digest hashes the data first. Purpose says what the signature is for (logging in, or an SSH signature with its Namespace), so the signer can refuse what its policy does not allow by throwing.