upstream: preserve verify-required for resident FIDO keys

When downloading a resident, verify-required key from a FIDO token,
preserve the verify-required in the private key that is written to
disk. Previously we weren't doing that because of lack of support
in the middleware API.

from Pedro Martelletto; ok markus@ and myself

OpenBSD-Commit-ID: 201c46ccdd227cddba3d64e1bdbd082afa956517

1 files changed, 3 insertions, 2 deletions

diff --git a/sk-api.h b/sk-api.h
index 1ecaa3537..cc32cd4cc 100644
--- a/sk-api.h
+++ b/sk-api.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: sk-api.h,v 1.9 2020/04/28 04:02:29 djm Exp $ */
+/* $OpenBSD: sk-api.h,v 1.10 2020/08/27 01:08:19 djm Exp $ */
 /*
  * Copyright (c) 2019 Google LLC
  *
@@ -63,6 +63,7 @@ struct sk_resident_key {
         size_t slot;
         char *application;
         struct sk_enroll_response key;
+        uint8_t flags;
 };
 
 struct sk_option {
@@ -71,7 +72,7 @@ struct sk_option {
         uint8_t required;
 };
 
-#define SSH_SK_VERSION_MAJOR            0x00050000 /* current API version */
+#define SSH_SK_VERSION_MAJOR            0x00060000 /* current API version */
 #define SSH_SK_VERSION_MAJOR_MASK       0xffff0000
 
 /* Return the version of the middleware API */