Add SHA1 as an allowed hash algorithm for ssh_key_fingerprint (#15134)

* Add SHA1 as an allowed hash algorithm for ssh_key_fingerprint

* Add tests for SHA1 hashes of ssh_key_fingerprint
Update docs to reflect SHA1 being an allowed hash algorithm for ssh_key_fingerprint

* Linting fixes

Author: plinss

docs/hazmat/primitives/asymmetric/serialization.rst

@@ -438,8 +438,8 @@ DSA keys look almost identical but begin with ``ssh-dss`` rather than
     :param key: The public key to compute the fingerprint for.
     :type key: One of :data:`SSHPublicKeyTypes`
 
-    :param hash_algorithm: The hash algorithm to use, either ``MD5()`` or
-        ``SHA256()``.
+    :param hash_algorithm: The hash algorithm to use, either ``MD5()``,
+        ``SHA1()``, or ``SHA256()``.
 
     :return: The key fingerprint.
     :rtype: bytes

src/cryptography/hazmat/primitives/serialization/ssh.py

@@ -1144,10 +1144,13 @@ def _parse_exts_opts(exts_opts: memoryview) -> dict[bytes, bytes]:
 
 def ssh_key_fingerprint(
     key: SSHPublicKeyTypes,
-    hash_algorithm: hashes.MD5 | hashes.SHA256,
+    hash_algorithm: hashes.MD5 | hashes.SHA1 | hashes.SHA256,
 ) -> bytes:
-    if not isinstance(hash_algorithm, (hashes.MD5, hashes.SHA256)):
-        raise TypeError("hash_algorithm must be either MD5 or SHA256")
+    if not isinstance(
+        hash_algorithm,
+        (hashes.MD5, hashes.SHA1, hashes.SHA256),
+    ):
+        raise TypeError("hash_algorithm must be either MD5, SHA1, or SHA256")
 
     key_type = _get_ssh_key_type(key)
     kformat = _lookup_kformat(key_type)

tests/hazmat/primitives/test_ssh.py

@@ -1864,6 +1864,16 @@ def test_ssh_key_fingerprint_rsa_md5(self):
         fingerprint = ssh_key_fingerprint(public_key, hashes.MD5())
         assert fingerprint == b"\x10G\xc2es\xd6QIH\x0b\x81\x1f6\x04{R"
 
+    def test_ssh_key_fingerprint_rsa_sha1(self):
+        ssh_key = load_vectors_from_file(
+            os.path.join("asymmetric", "OpenSSH", "rsa-nopsw.key.pub"),
+            lambda f: f.read(),
+            mode="rb",
+        )
+        public_key = load_ssh_public_key(ssh_key)
+        fingerprint = ssh_key_fingerprint(public_key, hashes.SHA1())
+        assert fingerprint == b"cQ{L\xf8V\xb5N\x8c\x8e^ni?\xb7(1\xc4\xba\xc5"
+
     def test_ssh_key_fingerprint_rsa_sha256(self):
         ssh_key = load_vectors_from_file(
             os.path.join("asymmetric", "OpenSSH", "rsa-nopsw.key.pub"),
@@ -1891,6 +1901,16 @@ def test_ssh_key_fingerprint_ed25519_md5(self):
         fingerprint = ssh_key_fingerprint(public_key, hashes.MD5())
         assert fingerprint == b"\xe5R=\x01\x9e\xa0\xc1\xe9\x8c?L|\xc5\x94W\x85"
 
+    def test_ssh_key_fingerprint_ed25519_sha1(self):
+        ssh_key = load_vectors_from_file(
+            os.path.join("asymmetric", "OpenSSH", "ed25519-nopsw.key.pub"),
+            lambda f: f.read(),
+            mode="rb",
+        )
+        public_key = load_ssh_public_key(ssh_key)
+        fingerprint = ssh_key_fingerprint(public_key, hashes.SHA1())
+        assert fingerprint == b"$\x8a\x8d~p` <\xc4\xdb\x80\xf7*\xaf{)-RX{"
+
     def test_ssh_key_fingerprint_ed25519_sha256(self):
         ssh_key = load_vectors_from_file(
             os.path.join("asymmetric", "OpenSSH", "ed25519-nopsw.key.pub"),
@@ -1918,6 +1938,18 @@ def test_ssh_key_fingerprint_ecdsa_md5(self):
         fingerprint = ssh_key_fingerprint(public_key, hashes.MD5())
         assert fingerprint == b"\re\xf2-\xfaGq\x8c^\x16\xb05+\x06\x1b7"
 
+    def test_ssh_key_fingerprint_ecdsa_sha1(self):
+        ssh_key = load_vectors_from_file(
+            os.path.join("asymmetric", "OpenSSH", "ecdsa-nopsw.key.pub"),
+            lambda f: f.read(),
+            mode="rb",
+        )
+        public_key = load_ssh_public_key(ssh_key)
+        fingerprint = ssh_key_fingerprint(public_key, hashes.SHA1())
+        assert fingerprint == (
+            b"\xdd\xa58\x87cl\x8f\x89\xd9\xd2\x836~\xd1R\xd7\xd7\xf2\x87\xa9"
+        )
+
     def test_ssh_key_fingerprint_ecdsa_sha256(self):
         ssh_key = load_vectors_from_file(
             os.path.join("asymmetric", "OpenSSH", "ecdsa-nopsw.key.pub"),
@@ -1939,7 +1971,7 @@ def test_ssh_key_fingerprint_unsupported_hash(self):
         )
         public_key = load_ssh_public_key(ssh_key)
         with pytest.raises(TypeError):
-            ssh_key_fingerprint(public_key, hashes.SHA1())  # type: ignore[arg-type]
+            ssh_key_fingerprint(public_key, hashes.SM3())  # type: ignore[arg-type]
 
     def test_ssh_key_fingerprint_unsupported_key(self):
         with pytest.raises(ValueError):