Expand native auth and benchmark gates

docs/THREAT_MODEL.md

@@ -72,13 +72,13 @@ compromised endpoint or a malicious authorized peer.
 | Property | SSH | Dosh native v1 | Notes |
 | --- | --- | --- | --- |
 | Server authentication before trusting session data | yes | yes | Host key signs the handshake transcript; client verifies before sending user auth or accepting terminal bytes. |
-| User authentication by private-key possession | yes | yes | Ed25519 via ssh-agent or encrypted OpenSSH key; signature binds the full transcript. |
+| User authentication by private-key possession | yes | yes | Ed25519, ECDSA P-256, and RSA-SHA2 via ssh-agent or OpenSSH key; signature binds the full transcript. |
 | Forward secrecy | yes | yes | Ephemeral X25519 per connection; long-term host/user keys never derive the traffic key. |
 | AEAD on every post-handshake packet | yes | yes | ChaCha20-Poly1305 with per-direction, per-sequence nonces. |
 | Replay protection | yes | yes | Sliding replay window over the AEAD packet counter, plus transcript-bound handshake. |
 | Host-key pinning with explicit first use | TOFU, weakly tied to transport | yes, with explicit policy | Default refuses unknown host keys; TOFU only when `trust_on_first_use` is set; mismatch hard-fails and never auto-replaces. |
 | No plaintext terminal bytes after handshake | yes | yes | All `Frame`/`Input`/stream packets are AEAD-sealed. |
-| No custom cryptographic primitives | yes | yes | Standard X25519/HKDF-SHA256/ChaCha20-Poly1305/Ed25519 crates only. |
+| No custom cryptographic primitives | yes | yes | Standard X25519/HKDF-SHA256/ChaCha20-Poly1305/signature crates only. |
 | Fail-closed downgrade behavior | yes | yes | Native auth failure surfaces an explicit error and SSH fallback is explicit; it never silently drops to an unauthenticated mode. |
 | Fast resumption without re-auth | ControlMaster only | yes, native | Cached session/ticket attach skips a fresh round of public-key proof; this is a deliberate speed/security trade discussed in section 6. |
 
@@ -94,8 +94,9 @@ compromised endpoint or a malicious authorized peer.
 - **Explicit, file-pinned host trust.** Host trust is a first-class, inspectable
   known-hosts entry with source provenance (`tofu`/`ssh`/`manual`) and a hard-fail
   mismatch path, rather than the looser default TOFU behavior most SSH clients ship.
-- **Modern primitives only.** Ed25519 and X25519 by default; no DSA, no SHA-1
-  signatures, no CBC-and-MAC constructions.
+- **Modern primitives only.** Ed25519 and X25519 by default; ECDSA P-256 and
+  RSA-SHA2 are accepted for SSH-key compatibility; no DSA, no SHA-1 signatures, no
+  CBC-and-MAC constructions.
 
 Dosh does **not** claim generic SSH compatibility and must not be described as an
 SSH-protocol implementation.
@@ -114,9 +115,12 @@ These reflect the code in `src/crypto.rs`, `src/native.rs`, `src/auth.rs`, and
   unique nonce per `(key, direction, sequence)`. AES-GCM is reserved for later and is
   not selectable today.
 - **Host-key signatures:** Ed25519 (`ed25519-dalek`) over the handshake transcript.
-- **User-auth signatures:** Ed25519, produced either by ssh-agent over a Unix socket
-  (`src/ssh_agent.rs`) or from an encrypted/plaintext OpenSSH private key
-  (`ssh-key`). The signature covers the user-auth transcript described above.
+- **User-auth signatures:** Ed25519, ECDSA P-256, and RSA-SHA2, produced either by
+  ssh-agent over a Unix socket (`src/ssh_agent.rs`) or from an encrypted/plaintext
+  OpenSSH private key (`ssh-key`). The signature covers the user-auth transcript
+  described above. RSA public keys are matched as `ssh-rsa` authorized keys, but
+  native signatures must be `rsa-sha2-256` or `rsa-sha2-512`; legacy SHA-1
+  `ssh-rsa` signatures are rejected.
 - **Bootstrap auth (SSH fallback path):** HMAC-SHA256 attach tokens and HKDF-SHA256
   derived session keys, with attach tickets sealed under an HKDF-derived
   ticket key. Token comparison is constant-time.
@@ -179,26 +183,25 @@ be evaluated honestly. Items here are *not* yet "green".
 
 ### Known gaps / work in progress (must close before the public claim)
 
-- **Per-IP rate limiting is partial.** The server evicts half-finished native
-  handshakes on a TTL so a flood of `ClientHello` packets cannot grow the pending map
-  without bound, and it reports a static `rate_limit_remaining` hint in `ServerHello`.
-  A full per-source token-bucket limiter is **in progress on another track** and is
-  not yet enforced. Until it lands, sustained auth flooding is mitigated only by the
-  handshake-eviction TTL and OS-level limits.
-- **Protocol VERSION negotiation is being hardened.** The wire format pins a single
-  protocol version: the packet header rejects any non-matching `VERSION` byte and the
-  native handshake rejects any non-matching `protocol_version`. There is no
+- **Native-auth rate limiting needs tuning, not first implementation.** The server
+  enforces a per-source token bucket before expensive native-auth work, evicts
+  half-finished handshakes on a TTL, and reports remaining capacity in
+  `ServerHello`. It is covered by unit/integration tests, but still needs abusive
+  real-host tuning before public hardening claims.
+- **Protocol VERSION compatibility policy is still simple.** The wire format pins a
+  single protocol version: the packet header rejects any non-matching `VERSION` byte
+  and the native handshake rejects any non-matching `protocol_version`. There is no
   multi-version negotiation yet, so cross-version interop and downgrade-resistance for
   future versions are still being designed. Today's behavior is fail-closed (reject),
   not silent downgrade.
-- **Fuzzing is not yet wired into CI.** CI currently runs format, tests, release
-  build, and the Docker SSH benchmark gate. Fuzz targets for packet parsing,
-  authorized-key parsing, known-host parsing, and handshake state (spec milestone 5)
-  are **being wired in** and are not yet running in CI.
-- **User-key algorithm coverage is Ed25519-only today.** The spec permits ECDSA
-  P-256 and (compatibility-only, SHA-2) RSA, but native auth currently accepts and
-  produces `ssh-ed25519` only. ECDSA/RSA support is pending. This is a parity gap, not
-  a weakening of what *is* supported.
+- **Fuzzing is smoke-tested in CI, not yet a deep campaign.** CI runs parser/auth
+  fuzz targets briefly with nightly/cargo-fuzz when available. That catches obvious
+  panics and parser robustness regressions; it is not a substitute for longer
+  coverage-guided fuzz campaigns before public security claims.
+- **User-key algorithm coverage now matches the v1 target.** Ed25519, ECDSA P-256,
+  and compatibility RSA-SHA2 native auth are implemented for ssh-agent and OpenSSH
+  identity files. RSA remains compatibility-only and deliberately rejects legacy
+  SHA-1 `ssh-rsa` signatures.
 - **Hostile-network and long-soak integration tests are partial.** Roaming,
   retransmit, resize, and multi-client tests exist; a dedicated adversarial
   drop/reorder/replay suite and 30-minute-sleep soak (spec section 16) are still being