From f96f21f85bb48c9164ca4fa69c04d07d400c53d6 Mon Sep 17 00:00:00 2001 From: Ryan Date: Wed, 23 Sep 2026 17:50:40 +0000 Subject: [PATCH] Fix ECDSA key registration in Commander SSH agent The ADD_IDENTITY handler called EllipticCurvePublicNumbers.from_encoded_point(), which cryptography removed in 39.0.0, and built the ECDSA public key blob without the RFC 5656 curve-name string. Use EllipticCurvePublicKey.from_encoded_point() and include the curve name so ssh-add and SSH clients accept the key. After implementing the changes, i tested the full process using an ECDSA key and confirmed the change resolved the issue. --- keepercommander/commands/ssh_agent.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/keepercommander/commands/ssh_agent.py b/keepercommander/commands/ssh_agent.py index d7d53691d..30f128dcd 100644 --- a/keepercommander/commands/ssh_agent.py +++ b/keepercommander/commands/ssh_agent.py @@ -514,8 +514,9 @@ def _process_ssh_agent_request(self, request): # type: (bytes) -> bytes raise ValueError(f'Unsupported EC key: {curve_name.decode()}') public_key_bytes, pos = ssh_agent_get_next_value(request, pos) - key.key_blob = ssh_agent_encode_bytes(key_type) + ssh_agent_encode_bytes(public_key_bytes) - public_numbers = ec.EllipticCurvePublicNumbers.from_encoded_point(curve, public_key_bytes) + key.key_blob = ssh_agent_encode_bytes(key_type) + ssh_agent_encode_bytes(curve_name) + ssh_agent_encode_bytes(public_key_bytes) + public_key = ec.EllipticCurvePublicKey.from_encoded_point(curve, public_key_bytes) + public_numbers = public_key.public_numbers() priv_key, pos = ssh_agent_get_next_value(request, pos) private_int = int.from_bytes(priv_key, byteorder='big')