Class SshSignature

Namespace

SshSharp

Assembly

SshSharp.dll

An SSH signature over a file or a message (OpenSSH's SSHSIG format, ssh-keygen -Y sign), as git uses for signed commits with gpg.format=ssh. Make one with SignAsync(SshPrivateKey, ReadOnlyMemory<byte>, string, string, CancellationToken) (any key, an agent's too), write it with ToString(), and read one with Parse(string).

public sealed class SshSignature

Inheritance

object

SshSignature

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

Remarks

Verify(ReadOnlySpan<byte>, string) proves only that the holder of PublicKey signed the message; whether that key belongs to whom it claims is a separate question, answered by SshAllowedSigners (ssh-keygen -Y verify). The namespace (git, file, or your application's own, such as backup@example.com) keeps a signature made for one purpose from being accepted for another.

Properties

Certificate

The signer's certificate, when it signed with one.

Fingerprint

The SHA-256 fingerprint of the signer's key (of the certified key, for a certificate), as ssh-keygen prints it.

HashAlgorithm

The hash of the message that was signed: sha512 (the default) or sha256.

KeyType

The signer's key type, for example ssh-ed25519 (or ssh-ed25519-cert-v01@openssh.com for a certificate).

Namespace

What the signature is for, for example git or file; it must match when verifying.

PublicKey

The signer's public key in SSH wire format, or its certificate when it signed with one.

Methods

Parse(string)

Parses an armored signature (-----BEGIN SSH SIGNATURE-----), as ssh-keygen -Y sign writes to .sig files.

SignAsync(SshPrivateKey, Stream, string, string, CancellationToken)

Signs what message reads to its end, as ssh-keygen -Y sign signs a file.

SignAsync(SshPrivateKey, ReadOnlyMemory<byte>, string, string, CancellationToken)

Signs message, as ssh-keygen -Y sign -n namespace does.

ToString()

The armored signature, as ssh-keygen -Y sign writes it (base64 in lines of 70 characters).

Verify(ReadOnlySpan<byte>, string)

Whether this is a valid signature over message by PublicKey, for namespace. It does not say whether to trust the key: check that with SshAllowedSigners, or compare PublicKey with the key you expect.

VerifyAsync(Stream, string, CancellationToken)

Like Verify(ReadOnlySpan<byte>, string), over what message reads to its end.