upstream: when writing an attestation blob for a FIDO key, record all

the data needed to verify the attestation. Previously we were missing the
"authenticator data" that is included in the signature.

spotted by Ian Haken
feedback Pedro Martelletto and Ian Haken; ok markus@

OpenBSD-Commit-ID: 8439896e63792b2db99c6065dd9a45eabbdb7e0a

1 files changed, 4 insertions, 2 deletions

diff --git a/sk-api.h b/sk-api.h
index cc32cd4cc..df17ca540 100644
--- a/sk-api.h
+++ b/sk-api.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: sk-api.h,v 1.10 2020/08/27 01:08:19 djm Exp $ */
+/* $OpenBSD: sk-api.h,v 1.11 2020/09/09 03:08:01 djm Exp $ */
 /*
  * Copyright (c) 2019 Google LLC
  *
@@ -47,6 +47,8 @@ struct sk_enroll_response {
         size_t signature_len;
         uint8_t *attestation_cert;
         size_t attestation_cert_len;
+        uint8_t *authdata;
+        size_t authdata_len;
 };
 
 struct sk_sign_response {
@@ -72,7 +74,7 @@ struct sk_option {
         uint8_t required;
 };
 
-#define SSH_SK_VERSION_MAJOR            0x00060000 /* current API version */
+#define SSH_SK_VERSION_MAJOR            0x00070000 /* current API version */
 #define SSH_SK_VERSION_MAJOR_MASK       0xffff0000
 
 /* Return the version of the middleware API */