From 4532bd01d57ee13c3ca881eceac1bf9da96a4d7e Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Mon, 30 Dec 2019 09:19:52 +0000 Subject: upstream: basic support for generating FIDO2 resident keys "ssh-keygen -t ecdsa-sk|ed25519-sk -x resident" will generate a device-resident key. feedback and ok markus@ OpenBSD-Commit-ID: 8e1b3c56a4b11d85047bd6c6c705b7eef4d58431 --- sk-usbhid.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'sk-usbhid.c') diff --git a/sk-usbhid.c b/sk-usbhid.c index 594f5d890..61b52bbb9 100644 --- a/sk-usbhid.c +++ b/sk-usbhid.c @@ -56,7 +56,9 @@ #define SK_VERSION_MAJOR 0x00020000 /* current API version */ /* Flags */ -#define SK_USER_PRESENCE_REQD 0x01 +#define SK_USER_PRESENCE_REQD 0x01 +#define SK_USER_VERIFICATION_REQD 0x04 +#define SK_RESIDENT_KEY 0x20 /* Algs */ #define SK_ECDSA 0x00 @@ -410,7 +412,6 @@ sk_enroll(int alg, const uint8_t *challenge, size_t challenge_len, int r; char *device = NULL; - (void)flags; /* XXX; unused */ #ifdef SK_DEBUG fido_init(FIDO_DEBUG); #endif @@ -452,6 +453,11 @@ sk_enroll(int alg, const uint8_t *challenge, size_t challenge_len, fido_strerr(r)); goto out; } + if ((r = fido_cred_set_rk(cred, (flags & SK_RESIDENT_KEY) != 0 ? + FIDO_OPT_TRUE : FIDO_OPT_OMIT)) != FIDO_OK) { + skdebug(__func__, "fido_cred_set_rk: %s", fido_strerr(r)); + goto out; + } if ((r = fido_cred_set_user(cred, user_id, sizeof(user_id), "openssh", "openssh", NULL)) != FIDO_OK) { skdebug(__func__, "fido_cred_set_user: %s", fido_strerr(r)); -- cgit v1.2.3