Adding RSA Support to swift-nio-ssh

LogRaker needed RSA authentication in swift-nio-ssh because some Amazon EC2 instances still rely on older PKCS#1 RSA keys, which clients cannot replace. Since the library has no extension point for adding key types, the developers vendored a fork and edited eight files. The key technical challenge is that an RSA public-key blob is labeled “ssh-rsa,” while modern authentication must identify the signature algorithm as “rsa-sha2-256” or “rsa-sha2-512.” The fork uses rsa-sha2-512, avoiding the SHA-1-based ssh-rsa signature that current OpenSSH servers reject. It also writes the same signature-algorithm name into both the transmitted authentication message and the data being signed; any mismatch makes the server reject an otherwise valid key and signature. A test checks that these two values match.

The fork does not negotiate supported RSA algorithms because swift-nio-ssh does not process the server’s algorithm list. Instead, it assumes rsa-sha2-512 is available, as it has been supported by OpenSSH since 2016. The known-algorithm list must recognize both the ssh-rsa key tag and the RSA signature names. To manage the risks of maintaining a security-sensitive fork, every modification is marked for review and rebasing, and a serialization test compares output byte-for-byte with ssh-keygen. The maintainer also stresses that vendored dependencies do not automatically surface security advisories, so users must check upstream themselves. The fork is pinned to swift-nio-ssh 0.15.0, is unaudited, and is intended for one application until upstream adds RSA support.