Server: concurrent connections share the host keypair's signature algorithm, so an RSA host key can sign with the wrong one #834

SSHServerConnection.choose_server_host_key sets the negotiated signature algorithm on the keypair object itself:

for alg in peer_host_key_algs:
    keypair = self._server_host_keys.get(alg)
    if keypair:
        if alg != keypair.algorithm:
            keypair.set_sig_algorithm(alg)

        self._server_host_key = keypair
        return True

(asyncssh/connection.py, still the same on develop at 3d3331c; we hit it with 2.21.0, and 2.24.1 has the same code.)

self._server_host_keys comes from the SSHServerConnectionOptions, which every connection accepted by a listener shares. Its rsa-sha2-256, rsa-sha2-512 and ssh-rsa entries are one keypair object. Key exchange spans several packets, so with two connections on one event loop:

1. Connection A negotiates rsa-sha2-512; set_sig_algorithm(b'rsa-sha2-512') runs.
2. Connection B negotiates rsa-sha2-256 before A has signed; set_sig_algorithm(b'rsa-sha2-256') runs on the same object.
3. A signs its exchange hash with rsa-sha2-256, while its client expects rsa-sha2-512.

The client rightly rejects the signature: OpenSSH reports "incorrect signature", and our client (SshSharp, a .NET SSH client) reports that the signature over the exchange hash is invalid. The connection fails, though nothing is wrong on either side.

How we hit it: in our interop CI, 6 of 100 stress iterations failed against an AsyncSSH server, with several clients connecting at once and preferring different RSA signature algorithms. In every failure, the signature had been made with the other RSA algorithm.

Workaround: our test server wraps choose_server_host_key so that each connection works on a shallow copy of the keypair. set_sig_algorithm only sets instance attributes, so a copy is enough:

_choose_server_host_key = asyncssh.connection.SSHServerConnection.choose_server_host_key

def choose_server_host_key(self, peer_host_key_algs):
    self._server_host_keys = {alg: copy.copy(keypair) for alg, keypair in self._server_host_keys.items()}
    return _choose_server_host_key(self, peer_host_key_algs)

asyncssh.connection.SSHServerConnection.choose_server_host_key = choose_server_host_key

Suggested fix: keep the chosen signature algorithm per connection: copy the keypair when choosing it, or store the algorithm on the connection and pass it to sign.

The client side may have the same pattern: SSHClientConnection._choose_signature_alg calls keypair.set_sig_algorithm(alg) on a client key, and client keys can be shared through a reused SSHClientConnectionOptions. We haven't tested that path.