upstream: basic support for generating FIDO2 resident keys

"ssh-keygen -t ecdsa-sk|ed25519-sk -x resident" will generate a
device-resident key.

feedback and ok markus@

OpenBSD-Commit-ID: 8e1b3c56a4b11d85047bd6c6c705b7eef4d58431

1 files changed, 8 insertions, 2 deletions

diff --git a/sk-usbhid.c b/sk-usbhid.c
index 594f5d890..61b52bbb9 100644
--- a/sk-usbhid.c
+++ b/sk-usbhid.c
@@ -56,7 +56,9 @@
 #define SK_VERSION_MAJOR        0x00020000 /* current API version */
 
 /* Flags */
-#define SK_USER_PRESENCE_REQD   0x01
+#define SK_USER_PRESENCE_REQD           0x01
+#define SK_USER_VERIFICATION_REQD       0x04
+#define SK_RESIDENT_KEY                 0x20
 
 /* Algs */
 #define SK_ECDSA                0x00
@@ -410,7 +412,6 @@ sk_enroll(int alg, const uint8_t *challenge, size_t challenge_len,
         int r;
         char *device = NULL;
 
-        (void)flags; /* XXX; unused */
 #ifdef SK_DEBUG
         fido_init(FIDO_DEBUG);
 #endif
@@ -452,6 +453,11 @@ sk_enroll(int alg, const uint8_t *challenge, size_t challenge_len,
                     fido_strerr(r));
                 goto out;
         }
+        if ((r = fido_cred_set_rk(cred, (flags & SK_RESIDENT_KEY) != 0 ?
+            FIDO_OPT_TRUE : FIDO_OPT_OMIT)) != FIDO_OK) {
+                skdebug(__func__, "fido_cred_set_rk: %s", fido_strerr(r));
+                goto out;
+        }
         if ((r = fido_cred_set_user(cred, user_id, sizeof(user_id),
             "openssh", "openssh", NULL)) != FIDO_OK) {
                 skdebug(__func__, "fido_cred_set_user: %s", fido_strerr(r));