openssh bugs - Oct 2020 - [Bug 3218] New: Support fingerprint user validation

https://bugzilla.mindrot.org/show_bug.cgi?id=3218

            Bug ID: 3218
           Summary: Support fingerprint user validation
           Product: Portable OpenSSH
           Version: 8.4p1
          Hardware: All
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P5
         Component: ssh-keygen
          Assignee: unassigned-bugs at mindrot.org
          Reporter: pflug at pse-consulting.de

I'm using a Trustkey G310. On Webauthn enabled sites (e.g. Bitwarden),
the key requires a valid fingerprint to authenticate, effectively
making the key two factors at once.

While -O verify-required does validate against the key's PIN, it
doesn't request fingerprint verification.

I'd like to see the fingerprint user validation to be supported.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3218

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org

--- Comment #1 from Damien Miller <djm at mindrot.org> ---
I'd like to see this too - I'm trying to obtain hardware to help
implement it.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3218

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Support fingerprint user    |Support biometric user
                   |validation                  |validation

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3218

--- Comment #2 from Damien Miller <djm at mindrot.org> ---
I have tested against a pre-release Yubikey bio and the biometric
authentication does work - it will set the "user verified" flag in the
signature without needing a PIN.

Assuming your device works similarly, then simply adding
"verify-required" to your key lines in ~/.ssh/authorized_keys should
be
sufficient.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3218

--- Comment #3 from Damien Miller <djm at mindrot.org> ---
Just to clarify: you don't need to set verify-required when
*generating* the key

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3218

--- Comment #4 from Andreas <pflug at pse-consulting.de> ---
Tested "verify-required" as option in authorized_keys, but get
"Permission denied" then. 

The key is blinking light-blue, indicating FIDO2 mode without
fingerprint verification, while it should blink dark-blue, using FPV.

Taken from earlier conversation with trustkey, it appears that ssh
doesn't request the key to fp-verify. I'd expect the ssh client to
request FPV when the server has the option verify-required present.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3218

--- Comment #5 from Damien Miller <djm at mindrot.org> ---
AFAIK there is no FIDO flag that we can set to request biometric
verification. There is a concept of "user verification", but that is
commingled with PIN verification.

If you can figure out what flags your webauthn endpoint is setting then
it might be possible to replicate them. It is possible that it is using
a vendor extension for your key in particular...

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3218

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |WORKSFORME
             Status|NEW                         |RESOLVED

--- Comment #6 from Damien Miller <djm at mindrot.org> ---
closed for lack of followup; biometric keys from other vendors (e.g.
yubikey) are known to work

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.