When adding an identity, validate that private key and public key (or…

src/main/java/com/jcraft/jsch/IdentityFile.java

@@ -26,6 +26,8 @@
 
 package com.jcraft.jsch;
 
+import java.util.Arrays;
+
 class IdentityFile implements Identity {
   private KeyPair kpair;
   private String identity;
@@ -40,6 +42,15 @@ static IdentityFile newInstance(String name, byte[] prvkey, byte[] pubkey,
       JSch.InstanceLogger instLogger) throws JSchException {
 
     KeyPair kpair = KeyPair.load(instLogger, prvkey, pubkey);
+    // if both keys are provided, make sure they match
+    if(prvkey != null && pubkey != null) {
+	KeyPair kpairVal = KeyPair.load(instLogger, null, pubkey);
+	if(kpairVal == null)
+	    throw new JSchException("invalid publickey");
+	if(!Arrays.equals(kpair.getPublicKeyBlob(),
+			  kpairVal.getPublicKeyBlob()))
+	    throw new JSchException("Public key does not match private key");
+    }
     return new IdentityFile(name, kpair);
   }
 

src/main/java/com/jcraft/jsch/OpenSshCertificateAwareIdentityFile.java

@@ -1,5 +1,6 @@
 package com.jcraft.jsch;
 
+import java.util.Arrays;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 
@@ -169,6 +170,9 @@
         throw new JSchException("Invalid certificate: missing public key");
       }
       kpair = KeyPair.load(instLogger, prvkey, certPublicKey);
+      if(prvkey != null &&
+	 !Arrays.equals(kpair.getPublicKeyBlob(), certPublicKey))
+	throw new JSchException("Certificate does not match private key");
 
     } catch (IllegalArgumentException e) {
       throw new JSchException("Invalid certificate format: " + e.getMessage(), e);