When adding an identity, validate that private key and public key (or…

src/main/java/com/jcraft/jsch/IdentityFile.java

@@ -26,20 +26,48 @@
 
 package com.jcraft.jsch;
 
+import java.io.IOException;
+
 class IdentityFile implements Identity {
   private KeyPair kpair;
   private String identity;
 
   static IdentityFile newInstance(String prvfile, String pubfile, JSch.InstanceLogger instLogger)
       throws JSchException {
     KeyPair kpair = KeyPair.load(instLogger, prvfile, pubfile);
+    // if both keys are provided, make sure they match
+    if (prvfile != null && pubfile != null) {
+      byte[] pubkey;
+      try {
+        pubkey = Util.fromFile(pubfile);
+      } catch (IOException e) {
+        throw new JSchException("Error opening publickey", e);
+      }
+      KeyPair kpairVal = KeyPair.load(instLogger, null, pubkey);
+      if (kpairVal == null) {
+        throw new JSchException("invalid publickey");
+      }
+      if (!Util.arraysequals(kpair.getPublicKeyBlob(), kpairVal.getPublicKeyBlob())) {
+        throw new JSchException("Public key does not match private key");
+      }
+    }
     return new IdentityFile(prvfile, kpair);
   }
 
   static IdentityFile newInstance(String name, byte[] prvkey, byte[] pubkey,
       JSch.InstanceLogger instLogger) throws JSchException {
 
     KeyPair kpair = KeyPair.load(instLogger, prvkey, pubkey);
+    // if both keys are provided, make sure they match
+    if (prvkey != null && pubkey != null) {
+      KeyPair kpairVal = KeyPair.load(instLogger, null, pubkey);
+      if (kpairVal == null) {
+        throw new JSchException("invalid publickey");
+      }
+      if (!Util.arraysequals(kpair.getPublicKeyBlob(), kpairVal.getPublicKeyBlob())) {
+        throw new JSchException("Public key does not match private key");
+      }
+    }
     return new IdentityFile(name, kpair);
   }
 

src/main/java/com/jcraft/jsch/OpenSshCertificateAwareIdentityFile.java

@@ -169,6 +169,9 @@ static Identity newInstance(String name, byte[] prvkey, byte[] certificateFileCo
         throw new JSchException("Invalid certificate: missing public key");
       }
       kpair = KeyPair.load(instLogger, prvkey, certPublicKey);
+      if (prvkey != null && !Util.arraysequals(kpair.getPublicKeyBlob(), certPublicKey)) {
+        throw new JSchException("Certificate does not match private key");
+      }
 
     } catch (IllegalArgumentException e) {
       throw new JSchException("Invalid certificate format: " + e.getMessage(), e);

src/test/java/com/jcraft/jsch/OpenSshCertificateKeyCompatTest.java

@@ -0,0 +1,75 @@
+package com.jcraft.jsch;
+
+import static com.jcraft.jsch.ResourceUtil.getResourceFile;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+import org.junit.jupiter.api.Test;
+
+/**
+ * Unit tests for openssh certificate key compatibility: does public key signed by certificate match
+ * private key
+ */
+public class OpenSshCertificateKeyCompatTest {
+
+  /**
+   * Test that adding an identity of a private key with matching user certificate succeeds
+   */
+  @Test
+  public void testCheckPrivKeyWithMatchingUserCert() throws Exception {
+    JSch jsch = new JSch();
+    jsch.addIdentity(getResourceFile("certificates/ed25519/root_ed25519_key"),
+        getResourceFile("certificates/ed25519/root_ed25519_key-cert.pub"), null);
+  }
+
+  /**
+   * Test that adding an identity of a private key with unmatching user certificate fails
+   */
+  @Test
+  public void testCheckPrivKeyWithNonMatchingUserCert() throws Exception {
+    JSch jsch = new JSch();
+    assertThrows(JSchException.class,
+
+        () -> jsch.addIdentity(getResourceFile("docker/id_ed25519"),
+            getResourceFile("certificates/ed25519/root_ed25519_key-cert.pub"), null));
+  }
+
+  /**
+   * Test that adding an identity of a private key with matching public key succeeds
+   */
+  @Test
+  public void testCheckPrivKeyWithMatchingPubKey() throws Exception {
+    JSch jsch = new JSch();
+    jsch.addIdentity(getResourceFile("docker/id_ed25519"), getResourceFile("docker/id_ed25519.pub"),
+        null);
+  }
+
+  /**
+   * Test that adding an identity of a private key with non-matching public key fails
+   */
+  @Test
+  public void testCheckPrivKeyWithNonMatchingPubKey() throws Exception {
+    JSch jsch = new JSch();
+    assertThrows(JSchException.class,
+
+        () -> jsch.addIdentity(getResourceFile("docker/id_ed25519"),
+            getResourceFile("certificates/ed25519/root_ed25519_key.pub"), null));
+  }
+
+  /**
+   * Test that adding an identity of a private key with something that is neither a public key nor a
+   * certificate fails
+   */
+  @Test
+  public void testCheckPrivKeyWithNonPubKey() throws Exception {
+    JSch jsch = new JSch();
+    assertThrows(JSchException.class,
+
+        () -> jsch.addIdentity(getResourceFile("docker/id_ed25519"),
+            getResourceFile("certificates/host/sshd_config"), null));
+  }
+
+
+  private String getResourceFile(String fileName) {
+    return ResourceUtil.getResourceFile(getClass(), fileName);
+  }
+}