commit 573951cbe80bb6352881271bb276f48749eab6f4
author James Myers <jfmyers9@gmail.com> Thu Mar 30 18:09:28 2017 +0900
committer Adam Langley <agl@golang.org> Mon Apr 03 15:29:32 2017 +0000
tree dd44fa1a11ecb4aa26c617ae1eaba515643cd5aa
parent 88915ccf7aeb91e9324fe7cf3eddd1531ced61ea

ssh: improve client public key authentication

Previously, the public key authentication for clients would send an
enquiry to the remote for every key specified before attempting to
authenticate with the server.

Now, we immediately try to authenticate once a valid key is found.
This results in exchanging fewer packets if the valid key is near the
top of the list. If all keys fail, then the number of packets exchanged
by the client and server is unaffected.

For OpenSSH daemon, an enquiry into the validity of a key without
authentication is still recorded as an authentication attempt, so any
clients with more than MaxAuthTries public keys would not be able to
authenticate using the previous implementation. This change will allow
clients to succeed authentication if the successful key is at the start
of the list of keys.

Change-Id: I8ea42caf40c0864752218c3f6934e86b12f5b81a
Reviewed-on: https://go-review.googlesource.com/38890
Reviewed-by: Adam Langley <agl@golang.org>