RuntimeError: dictionary keys changed during iteration (with --json, and Python 3.8)

Running with -j or --json with Python 3.8.x cause the following error

± ./ssh-audit.py -j raspberrypi2.local
Traceback (most recent call last):
  File "./ssh-audit.py", line 3350, in <module>
    main()
  File "./ssh-audit.py", line 3347, in main
    audit(conf)
  File "./ssh-audit.py", line 3337, in audit
    print(json.dumps(build_struct(banner, kex=kex, client_host=s.client_host), sort_keys=True))
  File "./ssh-audit.py", line 3245, in build_struct
    for host_key_type in host_keys.keys():
RuntimeError: dictionary keys changed during iteration

The code in question is

https://github.com/jtesta/ssh-audit/blob/e447c42a79df49841d5269eacde6dbeb811a6be4/ssh-audit.py#L3245-L3249

The fix for the immediate is straightforward, replace host_keys.keys() with list(host_keys.keys()) so the loop iterates over a copy.

However, I’m concerned about the rest of the loop. I think its

• picking one rsa host key amongst (possibly) several, and discarding any others
• the key it keeps is not predictable, because iteration over dict keys is non-deterministic in Python 3.5 and earlier.

I need to confirm whether an ssh server can have multiple RSA keys (perhaps with different key lengths).

Other details

± python3 --version
Python 3.8.2
± git show --summary | cat
commit e447c42a79df49841d5269eacde6dbeb811a6be4
Author: Joe Testa <[e-mail]>
Date:   Wed Mar 11 11:55:14 2020 -0400

    Bumped version to v2.2.0.

[moreati]

Do you have any thoughts on the other possible bug? That if an SSH server offered multiple RSA keys, ssh-audit would pick one at random.

[moreati]

Does this answer your question?

Well enough. I’d more-or-less concluded that multiple RSA keys might be possible according to the protocol, but rarely (if ever) seen in the wild

And are you still running into any bugs in the dev branch?

No, thank you. Close this or leave it open however you prefer.