Introduce OpenSSH-compatible SHA256 key fingerprinting.

There's a new enumeration of fingerprint types, and you tell
ssh2_fingerprint() or ssh2_fingerprint_blob() which of them to use.

So far, this is only implemented behind the scenes, and exposed for
testcrypt to test. All the call sites of ssh2_fingerprint pass a fixed
default fptype, which is still set to the old MD5. That will change
shortly.

test/cryptsuite.py

@@ -1146,6 +1146,36 @@ class crypt(MyTestBase):
         self.assertEqual(
             fp, b"768 96:12:c8:bc:e6:03:75:86:e8:c7:b9:af:d8:0c:15:75")
 
+    def testSSH2Fingerprints(self):
+        # A sensible key blob that we can make sense of.
+        sensible_blob = base64.decodebytes(
+            b'AAAAC3NzaC1lZDI1NTE5AAAAICWiV0VAD4lQ7taUN7vZ5Rkc'
+            b'SLJBW5ubn6ZINwCOzpn3')
+        self.assertEqual(ssh2_fingerprint_blob(sensible_blob, "sha256"),
+                         b'ssh-ed25519 255 SHA256:'
+                         b'E4VmaHW0sUF7SUgSEOmMJ8WBtt0e/j3zbsKvyqfFnu4')
+        self.assertEqual(ssh2_fingerprint_blob(sensible_blob, "md5"),
+                         b'ssh-ed25519 255 '
+                         b'35:73:80:df:a3:2c:1a:f2:2c:a6:5c:84:ce:48:6a:7e')
+
+        # A key blob with an unknown algorithm name, so that we can't
+        # extract the bit count.
+        silly_blob = ssh_string(b'foo') + ssh_string(b'key data')
+        self.assertEqual(ssh2_fingerprint_blob(silly_blob, "sha256"),
+                         b'foo SHA256:'
+                         b'mvfJTB4PaRI7hxYaYwn0sH8G6zW1HbLkbWnZE2YIKc4')
+        self.assertEqual(ssh2_fingerprint_blob(silly_blob, "md5"),
+                         b'foo '
+                         b'5f:5f:97:94:97:be:01:5c:f6:3f:e3:6e:55:46:ea:52')
+
+        # A key blob without even a valid algorithm-name string at the start.
+        very_silly_blob = b'foo'
+        self.assertEqual(ssh2_fingerprint_blob(very_silly_blob, "sha256"),
+                         b'SHA256:'
+                         b'LCa0a2j/xo/5m0U8HTBBNBNCLXBkg7+g+YpeiGJm564')
+        self.assertEqual(ssh2_fingerprint_blob(very_silly_blob, "md5"),
+                         b'ac:bd:18:db:4c:c2:f8:5c:ed:ef:65:4f:cc:c4:a4:d8')
+
     def testAES(self):
         # My own test cases, generated by a mostly independent
         # reference implementation of AES in Python. ('Mostly'

test/testcrypt.py

@@ -178,7 +178,7 @@ def make_argword(arg, argtype, fnname, argindex, to_preserve):
     if typename in {
             "hashalg", "macalg", "keyalg", "cipheralg",
             "dh_group", "ecdh_alg", "rsaorder", "primegenpolicy",
-            "argon2flavour"}:
+            "argon2flavour", "fptype"}:
         arg = coerce_to_bytes(arg)
         if isinstance(arg, bytes) and b" " not in arg:
             return arg