Re: Feedback on draft-ssh-ext-info-00

> Am 03.12.2015 um 00:54 schrieb Damien Miller <[email protected]>:
> 
> The problem is that, for a client to test whether rsa-sha2-256 is supported,
> it must make publickey userauth with an included signature. A
> signature free PK_OK style request won't do since the key blob just
> contains ssh-rsa and not the signature algorithm.

For PK_OK the format is:
     string pkalg = { ssh-rss | rsa-sha2-512 }
     string keyblob
so the server can tell the difference without having an actual signature.
However, many severs count these PK_OK checks as an authentication
error, so looping over possible signature encodings will break setups.

-m