openssh unix dev - Apr 2018 - Adding FIDO / WebAuthn to sshd

I was thinking that it might be interesting to add FIDO [1] / WebAuthn [2]
to sshd to enable users to login remotely using biometrics. (Note that
WebAuthn is currently being implemented in Windows 10 and Google Android,
so there will be a large number of clients that could support this
natively.) Unfortunately, the challenge / response scheme used by those
protocols doesn't fit well with PAM because PAM assumes that it is sending
a relatively small password prompt and receiving a relatively small
password back.

But a quick read through sshd.c shows that maybe I could have my own #ifdef
similar to USE_PAM to integrate FIDO / WebAuthn. My questions are:

1. Is that the right approach?
2. What are the guidelines around making a contribution like this and / or
would you guys be interested in this contribution?
3. Anyone want to help? :)

Thanks,
Adam

[1] https://fidoalliance.org/download/
[2] https://www.w3.org/TR/webauthn/

On 2018-04-27 08:20, Adam Powers wrote:
> I was thinking that it might be interesting to add FIDO [1] / WebAuthn [2]
> to sshd to enable users to login remotely using biometrics. (Note that
> WebAuthn is currently being implemented in Windows 10 and Google Android,
> so there will be a large number of clients that could support this
> natively.) Unfortunately, the challenge / response scheme used by those
> protocols doesn't fit well with PAM because PAM assumes that it is
sending
> a relatively small password prompt and receiving a relatively small
> password back.
> 
> But a quick read through sshd.c shows that maybe I could have my own #ifdef
> similar to USE_PAM to integrate FIDO / WebAuthn. My questions are:

There have already been proposed patches for U2F as a new standalone SSH
authentication method:

https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-December/033262.html

Since clients will need to be updated *anyway* to support WebAuthn, I
think a new auth method is more suitable than trying to hack it via
password auth.

-- 
Mantas Mikul?nas <grawity at gmail.com>