-
-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SSH Agent: Add support for OpenSSH 8.2 FIDO/U2F keys #6371
SSH Agent: Add support for OpenSSH 8.2 FIDO/U2F keys #6371
Conversation
1ba945d
to
d67a460
Compare
I tried testing this branch a database but unlocking failed due to a HMAC mismatch (the database has a hardware key as an additional credential) |
That may be an older pre-release bug and this just needs a rebase. Does the current develop/snapshot work for you? |
Yep develop works fine. I tried to do a quick rebase but |
Rebasing onto develop resolved the unlocking issue and using ed25519-sk works flawlessly! The key is only present in the agent when unlocked as expected and I need to confirm with touching the yubikey. Great work 👍 |
@hifi is this ready for review? Probably needs a rebase on develop. |
d67a460
to
b5a4f1c
Compare
@droidmonkey should be ready for review now. Not sure what that test failure was but I rebased and the code looks pretty much identical. |
Adding and removing ed25519-sk keys on fedora 34 using a solokey v1 works for me. Thanks for your great work! |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Beautiful code @hifi!
This is a prerequisite for security key backed keys.
This is a prerequisite for security key backed keys.
b5a4f1c
to
18e4ceb
Compare
Codecov Report
@@ Coverage Diff @@
## develop #6371 +/- ##
===========================================
+ Coverage 63.77% 63.78% +0.02%
===========================================
Files 330 330
Lines 41378 41430 +52
===========================================
+ Hits 26385 26426 +41
- Misses 14993 15004 +11
Continue to review full report at Codecov.
|
Finally closes #4334 😅
Shout-out to @Yubico for sending me keys with up-to-date firmware to properly test this!
Testing strategy
Manual tests with Yubikeys on Linux. Automated tests for the in-wire format.
This needs to be tested by people with Yubikeys other than me before merging.
Type of change