ccssh 1.0.0__py3-none-any.whl

ccssh/gcm.py

@@ -0,0 +1,87 @@
+"""
+ AES-GCM for SSH, RFC 5647. Live-verified against OpenSSH.
+
+ Layout: PT = padding_length || payload || padding (multiple of 16),
+ AAD = packet_length (4 bytes, sent in the clear),
+ nonce12 = fixed4 (from KDF) || counter8BE, where the counter STARTS at the
+ KDF-derived value (proven by offline brute force against a live sshd;
+ starting at zero fails interop).
+ Wire: packet_length || CT || AT(16). Keys from KDF letters C/D, IV from A/B.
+"""
+from __future__ import annotations
+import os
+import struct
+
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+
+from ccssh.crypto import kdf, HASH_sha256, pad_len_aad
+
+GCM_SPECS = {
+    "aes128-gcm@openssh.com": {"key_len": 16},
+    "aes256-gcm@openssh.com": {"key_len": 32},
+}
+IV_LEN = 12
+TAG_LEN = 16
+
+
+def derive_gcm_keys(K_encoded: bytes, H: bytes, session_id: bytes, cipher: str, hashfn=None) -> dict[str, bytes]:
+    # Production callers must pass the KEX hash; the SHA-256 fallback exists
+    # only for unit tests / legacy callers (RFC 5647: KDF hash comes from KEX).
+    if hashfn is None:
+        hashfn = HASH_sha256
+    try:
+        kl = GCM_SPECS[cipher]["key_len"]
+    except KeyError as e:
+        raise ValueError(f"unsupported gcm cipher {cipher}") from e
+    hf = hashfn
+    return {
+        "iv_c2s": kdf(hf, K_encoded, H, session_id, b"A", IV_LEN),
+        "iv_s2c": kdf(hf, K_encoded, H, session_id, b"B", IV_LEN),
+        "enc_c2s": kdf(hf, K_encoded, H, session_id, b"C", kl),
+        "enc_s2c": kdf(hf, K_encoded, H, session_id, b"D", kl),
+    }
+
+
+class AesGcmCtx:
+    """One direction. Never share an instance between directions or resets."""
+
+    def __init__(self, cipher: str, enc_key: bytes, iv12: bytes):
+        try:
+            want = GCM_SPECS[cipher]["key_len"]
+        except KeyError as e:
+            raise ValueError(f"unsupported gcm cipher {cipher}") from e
+        if len(enc_key) != want or len(iv12) != IV_LEN:
+            raise ValueError("lengths must be: key 16/32, iv 12")
+        self.fixed = iv12[:4]
+        self._aead = AESGCM(enc_key)
+        self._counter = int.from_bytes(iv12[4:], "big")
+
+    def _nonce(self) -> bytes:
+        if self._counter >= 0xFFFFFFFFFFFFFFFF:
+            raise ValueError("GCM nonce exhausted: rekey required")
+        n = self.fixed + struct.pack(">Q", self._counter)
+        self._counter = (self._counter + 1) & 0xFFFFFFFFFFFFFFFF
+        return n
+
+    def seal(self, payload: bytes) -> bytes:
+        pad = pad_len_aad(len(payload), 16)
+        pt = bytes([pad]) + payload + os.urandom(pad)
+        aad = struct.pack(">I", 1 + len(payload) + pad)
+        ct_at = self._aead.encrypt(self._nonce(), pt, aad)
+        return aad + ct_at # packet_length in the clear + CT + AT
+
+    def open(self, wire: bytes) -> bytes:
+        """
+         Returns the raw PT (padding_length || payload || padding); the
+         transport strips padding. Raises InvalidTag/ValueError.
+        """
+        if len(wire) < 4 + 1 + TAG_LEN:
+            raise ValueError("wire packet too short")
+        aad, ct_at = wire[:4], wire[4:]
+        (pl,) = struct.unpack(">I", aad)
+        if pl < 16 or pl > 35000 or pl % 16 != 0 or len(ct_at) != pl + TAG_LEN:
+            raise ValueError(f"bad packet_length {pl}")
+        pt = self._aead.decrypt(self._nonce(), ct_at, aad) # raises InvalidTag
+        if pt[0] < 4 or 1 + pt[0] > pl:
+            raise ValueError("bad padding")
+        return pt

ccssh/hostcheck.py

@@ -0,0 +1,217 @@
+"""
+ Shared host-key checking for the sync and async clients.
+
+ Policies: strict (must be in known_hosts or @cert-authority), accept-new
+ (appends plain keys; certificates are only verified, never written),
+ off (accepts everything; lab use only).
+"""
+from __future__ import annotations
+import base64
+import hashlib
+import hmac
+import os
+
+from ccssh import hostkeys as HK
+
+
+class HostKeyError(Exception):
+    pass
+
+
+def _match_host(patterns: str, host: str, port: int) -> bool:
+    """Match plain lists (host or [host]:port) and hashed |1| entries."""
+    for pat in patterns.split(","):
+        pat = pat.strip()
+        if pat.startswith("|1|"):
+            try:
+                _, salt_b64, hash_b64 = pat.split("|")[1:]
+                salt = base64.b64decode(salt_b64)
+                want = base64.b64decode(hash_b64)
+            except Exception:
+                continue
+            if hmac.compare_digest(
+                    hmac.new(salt, host.encode(), hashlib.sha1).digest(), want):
+                return True
+            if port != 22 and hmac.compare_digest(
+                    hmac.new(salt, f"[{host}]:{port}".encode(), hashlib.sha1).digest(), want):
+                return True
+        elif pat == host or (port != 22 and pat == f"[{host}]:{port}"):
+            return True
+    return False
+
+
+def _revoked_match(lines: list[str], host: str, port: int, blob_b64: str) -> bool:
+    """
+     True if a @revoked line pins this exact key blob to this host.
+
+     Revocation is fail-closed under every policy: checked before any
+     trust decision, including accept-new (a revoked key must never be
+     re-learned).
+    """
+    for ln in lines:
+        s = ln.strip()
+        if not s.startswith("@revoked"):
+            continue
+        p = s.split()
+        if len(p) < 4:
+            continue
+        if p[3] == blob_b64 and _match_host(p[1], host, port):
+            return True
+    return False
+
+_RSA_FAMILY = {"ssh-rsa", "rsa-sha2-256", "rsa-sha2-512"}
+
+MAX_KNOWN_HOSTS_SIZE = 1 << 20
+MAX_KNOWN_HOSTS_LINES = 20000
+
+
+def _split_known_hosts(known_hosts: str | list[str] | None) -> list[str]:
+    """
+     One path or many (OpenSSH splits UserKnownHostsFile on whitespace;
+     commas accepted too). The magic name `none` disables file use.
+    """
+    if known_hosts is None:
+        return [os.path.expanduser("~/.ssh/known_hosts")]
+    if isinstance(known_hosts, str):
+        parts = [p for p in known_hosts.replace(",", " ").split() if p]
+        return [os.path.expanduser(p) for p in parts] or [os.path.expanduser("~/.ssh/known_hosts")]
+    return [os.path.expanduser(p) for p in known_hosts]
+
+
+def _read_known_hosts(kh: str) -> list[str]:
+    if kh == "/dev/null" or os.path.basename(kh).lower() == "none":
+        return []
+    if os.path.getsize(kh) > MAX_KNOWN_HOSTS_SIZE:
+        raise HostKeyError(f"{kh} too large, refusing to parse")
+    with open(kh, encoding="utf-8") as f:
+        lines = f.readlines()
+    if len(lines) > MAX_KNOWN_HOSTS_LINES:
+        raise HostKeyError(f"{kh} has too many entries")
+    return lines
+
+
+def _append_known_host(kh: str, host: str, port: int, inner_alg: str, want: str) -> None:
+    """Append a TOFU entry with symlink/permission hardening."""
+    if kh == "/dev/null" or os.path.basename(kh).lower() == "none":
+        return
+    if os.path.islink(kh):
+        raise HostKeyError(f"{kh} is a symlink, refusing to append (possible hijack)")
+    parent = os.path.dirname(kh)
+    if parent:
+        if os.path.islink(parent):
+            raise HostKeyError(f"{parent} is a symlink, refusing to append (possible hijack)")
+        os.makedirs(parent, mode=0o700, exist_ok=True)
+        try:
+            os.chmod(parent, 0o700)
+        except OSError:
+            pass
+    entry = f"{host} {inner_alg} {want}\n" if port == 22 else f"[{host}]:{port} {inner_alg} {want}\n"
+    # O_NOFOLLOW is POSIX-only; on Windows the flag is 0 (no symlink
+    # protection there - the islink() check above still applies).
+    flags = os.O_WRONLY | os.O_CREAT | os.O_APPEND | getattr(os, "O_NOFOLLOW", 0)
+    fd = os.open(kh, flags, 0o600)
+    try:
+        try:
+            os.fchmod(fd, 0o600)
+        except (OSError, AttributeError):
+            pass
+        with os.fdopen(fd, "a", encoding="utf-8") as f:
+            f.write(entry)
+    except Exception:
+        try:
+            os.close(fd)
+        except Exception:
+            pass
+        raise
+
+
+def check_hostkey(host: str, port: int, Ks: bytes, alg: str, *, policy: str, known_hosts: str | list[str] | None, ask_callback=None) -> None:
+    if policy not in ("strict", "accept-new", "off", "ask"):
+        raise HostKeyError(f"bad host policy {policy!r} (must be strict|accept-new|ask|off)")
+    if policy == "off":
+        return
+    if not host or any(c.isspace() or ord(c) < 32 for c in host):
+        raise HostKeyError(f"bad host name {host!r}")
+    try:
+        inner_alg, _ = HK.parse_host_blob(Ks)
+    except Exception as e:
+        raise HostKeyError(f"malformed K_S: {e}") from e
+    if inner_alg != alg and not (inner_alg in _RSA_FAMILY and alg in _RSA_FAMILY):
+        raise HostKeyError(f"host key type {inner_alg!r} != negotiated {alg!r}")
+    paths = _split_known_hosts(known_hosts)
+    # (path, lineno, text) so CHANGED errors cite the offending entry.
+    entries: list[tuple[str, int, str]] = []
+    for kh in paths:
+        try:
+            for lineno, text in enumerate(_read_known_hosts(kh), 1):
+                entries.append((kh, lineno, text))
+        except FileNotFoundError:
+            continue
+        except HostKeyError:
+            raise
+        except OSError as e:
+            # An unreadable file fails closed under every policy: treating
+            # it as empty would hand a MitM a learning window.
+            raise HostKeyError(f"cannot read {kh}: {e}") from e
+    lines = [text for _, _, text in entries]
+    want = base64.b64encode(Ks).decode()
+    if _revoked_match(lines, host, port, want):
+        raise HostKeyError(f"host key for {host} is REVOKED")
+    if inner_alg.endswith("-cert-v01@openssh.com") or inner_alg.endswith("-cert"):
+        from ccssh import certs as CERT
+        cas = CERT.load_ca_keys(paths, host, port)
+        if not cas:
+            raise HostKeyError(f"no @cert-authority for {host} in {','.join(paths)}")
+        try:
+            c = CERT.verify_cert(Ks, expected_principal=host, is_host=True, ca_blobs=cas)
+        except CERT.CertError as e:
+            raise HostKeyError(f"host certificate rejected: {e}") from e
+        ca_b64 = base64.b64encode(c["sig_key"]).decode()
+        if _revoked_match(lines, host, port, ca_b64):
+            raise HostKeyError(f"host certificate CA for {host} is REVOKED")
+        return
+    for kh, lineno, raw in entries:
+        ln = raw.strip()
+        if not ln or ln.startswith("#") or ln.startswith("@"):
+            continue
+        p = ln.split()
+        if len(p) < 3:
+            continue
+        if p[2] == want and _match_host(p[0], host, port):
+            return
+        same = (p[1] == inner_alg) or (p[1] in _RSA_FAMILY and inner_alg in _RSA_FAMILY)
+        if p[2] != want and _match_host(p[0], host, port) and same:
+            try:
+                old_fp = HK.fingerprint(base64.b64decode(p[2]))
+            except Exception:
+                old_fp = "<unparseable>"
+            try:
+                new_fp = HK.fingerprint(Ks)
+            except Exception:
+                new_fp = "<unparseable>"
+            raise HostKeyError(
+                f"HOST KEY CHANGED for {host} (possible MitM!)\n"
+                f"Offending key in {kh}:{lineno}\n"
+                f"Old {p[1]} fingerprint: {old_fp}\n"
+                f"New {inner_alg} fingerprint: {new_fp}\n"
+                f"Remove the old key with: ssh-keygen -R {host} "
+                f"(verify the new fingerprint out-of-band first!)")
+    if policy == "strict":
+        raise HostKeyError(f"{host} not in {','.join(paths)} (strict)")
+    if policy == "ask":
+        # Unknown host under ask: prompt (ssh-like). Changed keys above
+        # always fail, even under ask. Non-interactive callers pass
+        # ask_callback=None and fail closed like strict.
+        if ask_callback is None:
+            raise HostKeyError(f"{host} not in {','.join(paths)} (strict: no prompt available)")
+        try:
+            answer = ask_callback(
+                f"The authenticity of host '{host}' can't be established. "
+                f"{inner_alg} key fingerprint is {want[:44]}... "
+                f"Are you sure you want to continue connecting (yes/no)? ")
+        except Exception as e:
+            raise HostKeyError(f"host key prompt aborted: {e}") from e
+        if str(answer).strip().lower() not in ("yes", "y"):
+            raise HostKeyError(f"{host} not trusted (answer was not yes)")
+    append_to = next((kh for kh in paths if kh != "/dev/null" and os.path.basename(kh).lower() != "none"), paths[0] if paths else os.path.expanduser("~/.ssh/known_hosts"))
+    _append_known_host(append_to, host, port, inner_alg, want)

ccssh/hostkeys.py

@@ -0,0 +1,250 @@
+"""
+ Host keys and userauth signatures: ssh-ed25519, ssh-mldsa44-ed25519,
+ ecdsa-sha2-nistp*, rsa-sha2-256/512, ssh-dss (legacy: disabled by default,
+ explicit opt-in only), plus *-cert variants.
+
+ Certificate blobs are parsed structurally here; CA trust (authorities,
+ principals, validity) lives in certs.py / hostcheck.py.
+"""
+from __future__ import annotations
+
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.asymmetric import ec, padding, rsa
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature, encode_dss_signature
+
+from ccssh import mlkem
+from ccssh import wire as W
+from ccssh.mldsa import KeyPair as MldsaKeyPair
+from ccssh.sk import SkKey
+
+EC_HASH = {"ecdsa-sha2-nistp256": hashes.SHA256, "ecdsa-sha2-nistp384": hashes.SHA384, "ecdsa-sha2-nistp521": hashes.SHA512}
+EC_CURVE = {"ecdsa-sha2-nistp256": ec.SECP256R1(), "ecdsa-sha2-nistp384": ec.SECP384R1(), "ecdsa-sha2-nistp521": ec.SECP521R1()}
+EC_SIZE = {"ecdsa-sha2-nistp256": 32, "ecdsa-sha2-nistp384": 48, "ecdsa-sha2-nistp521": 66}
+
+
+def fingerprint(blob: bytes) -> str:
+    """OpenSSH-style key fingerprint: ``SHA256:<base64-without-padding>``."""
+    import base64 as _b64
+    import hashlib as _hl
+    digest = _hl.sha256(blob).digest()
+    return "SHA256:" + _b64.b64encode(digest).decode().rstrip("=")
+
+
+def parse_host_blob(blob: bytes) -> tuple[str, dict]:
+    r = W.Reader(blob)
+    alg = r.string().decode()
+    if alg == "ssh-ed25519":
+        pub = r.string()
+        if len(pub) != 32 or r.rest():
+            raise ValueError("bad ed25519 key length")
+        return alg, {"pub": pub}
+    if alg in EC_CURVE:
+        curve_name = r.string().decode()  # e.g. "nistp256"
+        q = r.string()
+        exp = {"ecdsa-sha2-nistp256": "nistp256", "ecdsa-sha2-nistp384": "nistp384", "ecdsa-sha2-nistp521": "nistp521"}[alg]
+        if curve_name != exp:
+            raise ValueError(f"curve mismatch: {alg} carries {curve_name!r}")
+        if r.rest():
+            raise ValueError("trailing bytes in ecdsa host key")
+        return alg, {"curve_name": curve_name, "q": q}
+    if alg == "ssh-rsa":
+        e, n = r.mpint(), r.mpint()
+        if r.rest():
+            raise ValueError("trailing bytes in ssh-rsa host key")
+        return alg, {"e": e, "n": n}
+    if alg == "ssh-dss":
+        # Legacy algorithm (1024-bit DSA, removed from OpenSSH 10.x): parsed
+        # and verified when explicitly forced, never offered by default.
+        p, q, g, y = r.mpint(), r.mpint(), r.mpint(), r.mpint()
+        if r.rest():
+            raise ValueError("trailing bytes in ssh-dss host key")
+        return alg, {"p": p, "q": q, "g": g, "y": y}
+    if alg in ("ssh-mldsa44-ed25519",):
+        from ccssh import mldsa as _ML
+        pub = r.string()
+        if len(pub) != _ML.PK_LEN or r.rest():
+            raise ValueError("bad mldsa pub length")
+        return alg, {"pub": pub}
+    if alg.endswith("-cert-v01@openssh.com") or alg.endswith("-cert"):
+        return alg, {"cert_blob": blob}  # opaque; see certs.py / cert_inner_plain
+    raise ValueError(f"unknown host key {alg!r}")
+
+
+def _ec_pubkey(alg: str, q: bytes):
+    from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePublicKey
+    curve = EC_CURVE[alg]
+    return EllipticCurvePublicKey.from_encoded_point(curve, q)
+
+
+def _dss_pubkey(p: int, q: int, g: int, y: int):
+    from cryptography.hazmat.primitives.asymmetric import dsa as _dsa
+    nums = _dsa.DSAPublicNumbers(y, _dsa.DSAParameterNumbers(p, q, g))
+    return nums.public_key()
+
+
+def cert_inner_plain(Ks: bytes) -> tuple[str, bytes]:
+    """
+     Extract (inner_alg, plain_pub_blob) from a certificate blob.
+
+     CA trust is NOT checked here; see certs.py.
+    """
+    from ccssh import certs as CERT
+    c = CERT.parse_cert(Ks)
+    kt = c["keytype"]
+    # ssh-keygen writes "ssh-ed25519-cert-v01@openssh.com" or bare "-cert" (mldsa)
+    if kt.endswith("-cert-v01@openssh.com"):
+        base = kt[:-len("-cert-v01@openssh.com")]
+    elif kt.endswith("-cert"):
+        base = kt[:-len("-cert")]
+    else:
+        raise ValueError(f"not a certificate type {kt!r}")
+    pub = c["pub"]
+    if base == "ssh-ed25519":
+        blob = W.enc_string(b"ssh-ed25519") + W.enc_string(pub["pub"])
+    elif base == "ssh-mldsa44-ed25519":
+        blob = W.enc_string(b"ssh-mldsa44-ed25519") + W.enc_string(pub["pub"])
+    elif base in EC_CURVE:
+        curve_ssh = {"ecdsa-sha2-nistp256": b"nistp256", "ecdsa-sha2-nistp384": b"nistp384", "ecdsa-sha2-nistp521": b"nistp521"}[base]
+        blob = W.enc_string(base.encode()) + W.enc_string(curve_ssh) + W.enc_string(pub["q"])
+    elif base == "ssh-rsa":
+        blob = W.enc_string(b"ssh-rsa") + W.enc_mpint(pub["e"]) + W.enc_mpint(pub["n"])
+    elif base == "ssh-dss":
+        blob = (W.enc_string(b"ssh-dss") + W.enc_mpint(pub["p"]) + W.enc_mpint(pub["q"]) + W.enc_mpint(pub["g"]) + W.enc_mpint(pub["y"]))
+    else:
+        raise ValueError(f"unsupported certificate inner key {base!r}")
+    return base, blob
+
+
+def verify_host_signature(Ks: bytes, host_alg: str, Hh: bytes, sig_outer: bytes) -> bool:
+    """
+     Verify a KEX signature. ``host_alg`` is the negotiated algorithm.
+
+     For certificates the KEX signature is checked against the INNER key;
+     CA trust is verified separately by hostcheck/certs. Never raises.
+    """
+    try:
+        r = W.Reader(sig_outer)
+        sig_alg = r.string().decode()
+        sig_blob = r.string()
+    except Exception:
+        return False
+    try:
+        alg, parts = parse_host_blob(Ks)
+    except Exception:
+        return False
+    if alg.endswith("-cert-v01@openssh.com") or alg.endswith("-cert"):
+        try:
+            alg, Ks = cert_inner_plain(Ks)
+            parts = parse_host_blob(Ks)[1]
+        except Exception:
+            return False
+    try:
+        if alg == "ssh-ed25519":
+            if sig_alg != "ssh-ed25519":
+                return False
+            return mlkem.verify_exchange_hash(parts["pub"], Hh, W.enc_string(b"ssh-ed25519") + W.enc_string(sig_blob))
+        if alg in EC_CURVE:
+            if sig_alg != alg:
+                return False
+            try:
+                rr = W.Reader(sig_blob)
+                r_int, s_int = rr.mpint(), rr.mpint()
+                rr.assert_end()
+            except Exception:
+                return False
+            der = encode_dss_signature(r_int, s_int)
+            _ec_pubkey(alg, parts["q"]).verify(der, Hh, ec.ECDSA(EC_HASH[alg]()))
+            return True
+        if alg == "ssh-rsa":
+            if host_alg in ("rsa-sha2-256", "rsa-sha2-512"):
+                if sig_alg != host_alg:
+                    return False
+            elif sig_alg not in ("rsa-sha2-256", "rsa-sha2-512", "ssh-rsa"):
+                return False
+            h = hashes.SHA256() if sig_alg == "rsa-sha2-256" else (hashes.SHA512() if sig_alg == "rsa-sha2-512" else hashes.SHA1())
+            pub = rsa.RSAPublicNumbers(parts["e"], parts["n"]).public_key()
+            # SSH omits leading zeroes of s - pad back to modulus length.
+            # Longer-than-modulus signatures are rejected (no silent truncation).
+            k = (pub.key_size + 7) // 8
+            if len(sig_blob) > k:
+                return False
+            sig = sig_blob.rjust(k, b"\x00")
+            pub.verify(sig, Hh, padding.PKCS1v15(), h)
+            return True
+        if alg == "ssh-mldsa44-ed25519":
+            if sig_alg != "ssh-mldsa44-ed25519":
+                return False
+            from ccssh import mldsa as _ML
+            blob = W.enc_string(b"ssh-mldsa44-ed25519") + W.enc_string(parts["pub"])
+            return _ML.verify_nested(blob, Hh, sig_outer)
+        if alg == "ssh-dss":
+            # Legacy: 1024-bit DSA with SHA-1. Verified only when forced.
+            if sig_alg != "ssh-dss":
+                return False
+            if len(sig_blob) != 40:
+                return False
+            r_int = int.from_bytes(sig_blob[:20], "big")
+            s_int = int.from_bytes(sig_blob[20:], "big")
+            der = encode_dss_signature(r_int, s_int)
+            try:
+                _dss_pubkey(parts["p"], parts["q"], parts["g"], parts["y"]).verify(der, Hh, hashes.SHA1())
+            except Exception:
+                return False
+            return True
+    except Exception:
+        return False
+    return False
+
+
+def sign_userauth(priv, alg: str, data: bytes) -> bytes:
+    """
+     Sign a userauth blob. Returns the nested buffer as sshkey_sign does:
+     string(alg) + string(sigblob). The caller wraps it into the signature
+     string field. Raises ValueError for unsupported key types.
+    """
+    if isinstance(priv, MldsaKeyPair):
+        if alg != "ssh-mldsa44-ed25519":
+            raise ValueError(f"mldsa key with alg {alg}")
+        return priv.sign_nested(data)
+    if isinstance(priv, SkKey):
+        if alg != priv.alg:
+            raise ValueError(f"sk key with alg {alg}")
+        return priv.sign_nested(data)
+    if isinstance(priv, Ed25519PrivateKey):
+        sig = priv.sign(data)
+        if len(sig) != 64:
+            raise ValueError("bad ed25519 signature length")
+        return W.enc_string(b"ssh-ed25519") + W.enc_string(sig)
+    if isinstance(priv, ec.EllipticCurvePrivateKey):
+        try:
+            hash_cls = EC_HASH[alg]
+        except KeyError:
+            raise ValueError(f"unsupported EC user key {alg}") from None
+        der = priv.sign(data, ec.ECDSA(hash_cls()))
+        r_int, s_int = decode_dss_signature(der)
+        return W.enc_string(alg.encode()) + W.enc_string(W.enc_mpint(r_int) + W.enc_mpint(s_int))
+    if isinstance(priv, rsa.RSAPrivateKey):
+        sigtype = "rsa-sha2-256" if alg in ("rsa-sha2-256", "ssh-rsa") else "rsa-sha2-512"
+        h = hashes.SHA256() if sigtype == "rsa-sha2-256" else hashes.SHA512()
+        sig = priv.sign(data, padding.PKCS1v15(), h)
+        k = (priv.key_size + 7) // 8
+        if len(sig) < k:
+            sig = sig.rjust(k, b"\x00")
+        return W.enc_string(sigtype.encode()) + W.enc_string(sig)
+    try:
+        from cryptography.hazmat.primitives.asymmetric import dsa as _dsa_mod
+        _dsa_types = (_dsa_mod.DSAPrivateKey,)
+    except Exception:
+        _dsa_types = ()
+    if _dsa_types and isinstance(priv, _dsa_types):
+        # Legacy user key: raw 40-byte r||s (RFC 4253 section 6.6), SHA-1.
+        if alg != "ssh-dss":
+            raise ValueError(f"dss key with alg {alg}")
+        der = priv.sign(data, hashes.SHA1())
+        r_int, s_int = decode_dss_signature(der)
+        raw = r_int.to_bytes(20, "big") + s_int.to_bytes(20, "big")
+        if len(raw) != 40:
+            raise ValueError("bad dss signature length")
+        return W.enc_string(b"ssh-dss") + W.enc_string(raw)
+    raise ValueError(f"unsupported private key type {type(priv)}")