abdul-khaliq-khalid · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 17, 2026 · Oct 30, 2026
diff --git a/src/openssl.c b/src/openssl.c
@@ -3434,7 +3434,9 @@ static int ossl_key_from_openssh(LIBSSH2_SESSION *session,
                                              (ssh2_dsa_ctx **)key_ctx);
 #endif
 #if LIBSSH2_ECDSA
-    if(SSH2_IS_LITERAL(buf, buf_len, "sk-ecdsa-sha2-nistp256@openssh.com"))
+    if(SSH2_IS_LITERAL(buf, buf_len, "sk-ecdsa-sha2-nistp256@openssh.com") &&
+       (!want_method ||
+        !strcmp("sk-ecdsa-sha2-nistp256@openssh.com", want_method)))
         rc = ossl_ecdsa_sk_openssh_priv_to_pubkey(session, decrypted,
                                                   method,
                                                   pubkeydata, pubkeydata_len,

diff --git a/tests/Makefile.inc b/tests/Makefile.inc
@@ -99,6 +99,8 @@ EXTRA_DIST = \
   keys/id_ecdsa_openssh_signed \
   keys/id_ecdsa_openssh_signed-cert.pub \
   keys/id_ecdsa_openssh_signed.pub \
+  keys/id_ecdsa_openssh_sk \
+  keys/id_ecdsa_openssh_sk.pub \
   keys/id_ecdsa_pem \
   keys/id_ecdsa_pem.pub \
   keys/id_ecdsa_pem_encrypted \

diff --git a/tests/keys-generate.sh b/tests/keys-generate.sh
@@ -66,6 +66,14 @@ ssh-keygen -t ecdsa   -b  521 -N "${pw}"     -m PKCS8   -C 'id_ecdsa_pkcs8_encry
 ssh-keygen -t ecdsa   -b  384 -N ''          -m RFC4716 -C ''                             -f 'keys/id_ecdsa_openssh'               # empty comment
 ssh-keygen -t ecdsa   -b  256 -N "${pw}"     -m RFC4716 -C 'id_ecdsa_openssh_encrypted'   -f 'keys/id_ecdsa_openssh_encrypted'     -Z chacha20-poly1305@openssh.com
 
+# sk-ecdsa key, copied from OpenSSH's regress test data. `ssh-keygen -t ecdsa-sk`
+# needs a FIDO authenticator or OpenSSH's sk-dummy provider, so it is not
+# generated here. Generated by regress/unittests/sshkey/mktestdata.sh with:
+# ssh-keygen -w "$SK_DUMMY" -t ecdsa-sk -C "ECDSA-SK test key #1" -N "" -f ecdsa_sk1
+openssh_testdata='https://raw.githubusercontent.com/openssh/openssh-portable/e95c0a0e964827722d29b4bc00d5c0ff4afe0ed2/regress/unittests/sshkey/testdata'
+curl -fsS -o 'keys/id_ecdsa_openssh_sk'     "${openssh_testdata}/ecdsa_sk1"
+curl -fsS -o 'keys/id_ecdsa_openssh_sk.pub' "${openssh_testdata}/ecdsa_sk1.pub"
+
 ssh-keygen -t ed25519         -N ''          -m PKCS8   -C 'id_ed25519_pkcs8'             -f 'keys/id_ed25519_pkcs8'
 ssh-keygen -t ed25519         -N "${pw}"     -m PKCS8   -C 'id_ed25519_pkcs8_encrypted'   -f 'keys/id_ed25519_pkcs8_encrypted'     # aes128-cbc
 ssh-keygen -t ed25519         -N ''          -m RFC4716 -C 'id_ed25519_openssh'           -f 'keys/id_ed25519_openssh'

diff --git a/tests/keys/id_ecdsa_openssh_sk b/tests/keys/id_ecdsa_openssh_sk
@@ -0,0 +1,13 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAfwAAACJzay1lY2
+RzYS1zaGEyLW5pc3RwMjU2QG9wZW5zc2guY29tAAAACG5pc3RwMjU2AAAAQQRnVT5Cji1D
+Ge2+q2X0vATh6LYnODV+DJrshJorr5GnipW29RfuaDXs0WB6XBej9dOLazVRDjQrtV19Qg
+O6cfkFAAAABHNzaDoAAAGQuPdnP7j3Zz8AAAAic2stZWNkc2Etc2hhMi1uaXN0cDI1NkBv
+cGVuc3NoLmNvbQAAAAhuaXN0cDI1NgAAAEEEZ1U+Qo4tQxntvqtl9LwE4ei2Jzg1fgya7I
+SaK6+Rp4qVtvUX7mg17NFgelwXo/XTi2s1UQ40K7VdfUIDunH5BQAAAARzc2g6AQAAAOMt
+LS0tLUJFR0lOIEVDIFBSSVZBVEUgS0VZLS0tLS0KTUhjQ0FRRUVJRURmVFB4YzA0alN5Zk
+Z5NlhoV1pTVlpzcnU5ZFlaSVpTOWhjeVFhcDlVT29Bb0dDQ3FHU000OQpBd0VIb1VRRFFn
+QUVaMVUrUW80dFF4bnR2cXRsOUx3RTRlaTJKemcxZmd5YTdJU2FLNitScDRxVnR2VVg3bW
+cxCjdORmdlbHdYby9YVGkyczFVUTQwSzdWZGZVSUR1bkg1QlE9PQotLS0tLUVORCBFQyBQ
+UklWQVRFIEtFWS0tLS0tCgAAAAAAAAAURUNEU0EtU0sgdGVzdCBrZXkgIzEBAgMEBQ==
+-----END OPENSSH PRIVATE KEY-----
diff --git a/tests/keys/id_ecdsa_openssh_sk.pub b/tests/keys/id_ecdsa_openssh_sk.pub
@@ -0,0 +1 @@
+sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBGdVPkKOLUMZ7b6rZfS8BOHotic4NX4MmuyEmiuvkaeKlbb1F+5oNezRYHpcF6P104trNVEONCu1XX1CA7px+QUAAAAEc3NoOg== ECDSA-SK test key #1
diff --git a/tests/test_simple.c b/tests/test_simple.c
@@ -31,7 +31,7 @@
  * SPDX-License-Identifier: BSD-3-Clause
  */
 
-#include "libssh2_priv.h"
+#include "session_fixture.h"
 
 #include <stdio.h>
 #include <string.h>
@@ -306,6 +306,32 @@ static int test_ssh2_bn_from_bin(void)
     return rc;
 }
 
+#if LIBSSH2_RSA
+/* An OpenSSH-format sk-ecdsa private key must not load as an RSA key */
+static int test_ssh2_rsa_new_priv_sk_ecdsa(LIBSSH2_SESSION *session)
+{
+    char *key;
+    size_t key_len;
+    ssh2_rsa_ctx *rsa = NULL;
+    int rc = 0;
+
+    if(ssh2_file_to_blob(session, srcdir_path("keys/id_ecdsa_openssh_sk"),
+                         &key, &key_len)) {
+        fprintf(stderr, "ssh2_file_to_blob() failed\n");
+        return 1;
+    }
+
+    if(!ssh2_rsa_new_priv(&rsa, session, NULL, key, key_len, NULL)) {
+        fprintf(stderr, "ssh2_rsa_new_priv() accepted an sk-ecdsa key\n");
+        rc = 1;
+    }
+
+    SSH2_FREE(session, key);
+
+    return rc;
+}
+#endif
+
 /* Return codes match scp.c (SCP_C_FIELDS_*). */
 static int test_ssh2_scp_parse_c_fields(void)
 {
@@ -397,6 +423,9 @@ int main(int argc, char *argv[])
     rc |= test_ssh2_dh_validate();
     rc |= test_ssh2_bn_from_bin();
     rc |= test_ssh2_scp_parse_c_fields();
+#if LIBSSH2_RSA
+    rc |= test_ssh2_rsa_new_priv_sk_ecdsa(session);
+#endif
 
     libssh2_session_free(session);
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBGdVPkKOLUMZ7b6rZfS8BOHotic4NX4MmuyEmiuvkaeKlbb1F+5oNezRYHpcF6P104trNVEONCu1XX1CA7px+QUAAAAEc3NoOg== ECDSA-SK test key #1