upstream: support for requiring user verified FIDO keys in sshd

This adds a "verify-required" authorized_keys flag and a corresponding
sshd_config option that tells sshd to require that FIDO keys verify the
user identity before completing the signing/authentication attempt.
Whether or not user verification was performed is already baked into the
signature made on the FIDO token, so this is just plumbing that flag
through and adding ways to require it.

feedback and ok markus@

OpenBSD-Commit-ID: 3a2313aae153e043d57763d766bb6d55c4e276e6

1 files changed, 3 insertions, 1 deletions

diff --git a/auth-options.h b/auth-options.h
index d96ffedee..118a32087 100644
--- a/auth-options.h
+++ b/auth-options.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-options.h,v 1.29 2019/11/25 00:54:23 djm Exp $ */
+/* $OpenBSD: auth-options.h,v 1.30 2020/08/27 01:07:09 djm Exp $ */
 
 /*
  * Copyright (c) 2018 Damien Miller <djm@mindrot.org>
@@ -71,6 +71,8 @@ struct sshauthopt {
 
         /* Key requires user presence asserted */
         int no_require_user_presence;
+        /* Key requires user verification (e.g. PIN) */
+        int require_verify;
 };
 
 struct sshauthopt *sshauthopt_new(void);