ECDSA public key parsing broken since v0.40.0

[agrahn]

If the remote ssh server only provides an ECDSA host key pair, host key verification fails in sshj (logcat):

08-10 21:48:52.285 13544 14425 E net.schmizz.sshj.transport.TransportImpl: Dying because - com.android.org.conscrypt.OpenSSLX509CertificateFactory$ParsingException: Error parsing public key

This did not happen up to v0.39.0.

Context: I maintain Android Passwordstore app and a user reported a connection failure: agrahn/Android-Password-Store#420

[exceptionfactory]

Thanks for highlighting this problem with ECDSA handling, the linked issue with the full stack trace provides some helpful details.

It looks like this issue with SSHJ 0.40.0 is the result of changes to ECDSA handling from pull request #983.

Prior to those changes, SSHJ used the Bouncy Castle library explicitly for ECDSA key handling. The updated approach delegates handling to the registered Java Security provider. According to the stack trace in the linked issue, the runtime implementation is the Google Conscrypt provider, configured on Android.

One option may be to explicitly register the Bouncy Castle security provider, so that it would be used instead of Conscrypt.

Further evaluation with the Conscrypt library is probably necessary to determine the best solution.