SHA-512 is not a supported hashing algorithm

[sevenrats]

I migrated a working install to a newer machine, replaced the tpm keys, and sshd comes up fine, but I get the "send_disconnect" error no matter how I try to connect ( the server is up and accepts a password though.) checking the ssh-tpm-agent logs shows INFO "agent 13: SHA-512 is not a supported hashing algorithm" right after "signwithflags" is called. shuttdown down the tpm agent and removing its sshd config causes connections to resume.

[Foxboron]

This is known.

TPMs doesn't really support SHA-512 and for this to work I need to implement the signing operation on another layer.

[sevenrats]

How do I work around in the meantime? is this an openssh version problem? can I change a setting somewhere?

[Foxboron]

You need to remove rsa-sha2-512 as a valid signature algorithm. I can't remember from the top of my head how you do this.

[sevenrats]

easier to just delete the RSA hostkey in my case.

[Foxboron]

Been working out this support for RSA keys lately. The WIP patch solves this, but I need to clean this up as I'm borrowing code form the Go stdlib.

Foxboron/go-tpm-keyfiles@7c417ef