History log of /openssh-portable/sk-usbhid.c (Results 1 - 21 of 21)
Revision (<<< Hide revision tags) (Show revision tags >>>) Date Author Comments
Revision tags: V_8_3_P1
# d7d753e2 13-May-2020 deraadt@openbsd.org

upstream: we are still aiming for pre-C99 ...

OpenBSD-Commit-ID: a240fc9cbe60bc4e6c3d24d022eb4ab01fe1cb38


# 2ad7b7e4 13-May-2020 djm@openbsd.org

upstream: Enable credProtect extension when generating a resident

key.

The FIDO 2.1 Client to Authenticator Protocol introduced a "credProtect"
feature to better protect residen

upstream: Enable credProtect extension when generating a resident

key.

The FIDO 2.1 Client to Authenticator Protocol introduced a "credProtect"
feature to better protect resident keys. This option allows (amone other
possibilities) requiring a PIN prior to all operations that may retrieve
the key handle.

Patch by Pedro Martelletto; ok djm and markus

OpenBSD-Commit-ID: 013bc06a577dcaa66be3913b7f183eb8cad87e73

show more ...


# 1e70dc32 13-May-2020 djm@openbsd.org

upstream: always call fido_init(); previous behaviour only called

fido_init() when SK_DEBUG was defined. Harmless with current libfido2, but
this isn't guaranteed in the future.

upstream: always call fido_init(); previous behaviour only called

fido_init() when SK_DEBUG was defined. Harmless with current libfido2, but
this isn't guaranteed in the future.

OpenBSD-Commit-ID: c7ea20ff2bcd98dd12015d748d3672d4f01f0864

show more ...


# c0dfd18d 30-Apr-2020 Damien Miller

wrap sha2.h inclusion in #ifdef HAVE_SHA2_H


# 59d2de95 28-Apr-2020 djm@openbsd.org

upstream: when signing a challenge using a FIDO toke, perform the

hashing in the middleware layer rather than in ssh code. This allows
middlewares that call APIs that perform the hashing

upstream: when signing a challenge using a FIDO toke, perform the

hashing in the middleware layer rather than in ssh code. This allows
middlewares that call APIs that perform the hashing implicitly (including
Microsoft's AFAIK). ok markus@

OpenBSD-Commit-ID: c9fc8630aba26c75d5016884932f08a5a237f37d

show more ...


Revision tags: V_8_2_P1
# 24c0f752 28-Jan-2020 djm@openbsd.org

upstream: changes to support FIDO attestation

Allow writing to disk the attestation certificate that is generated by
the FIDO token at key enrollment time. These certificates may be used

upstream: changes to support FIDO attestation

Allow writing to disk the attestation certificate that is generated by
the FIDO token at key enrollment time. These certificates may be used
by an out-of-band workflow to prove that a particular key is held in
trustworthy hardware.

Allow passing in a challenge that will be sent to the card during
key enrollment. These are needed to build an attestation workflow
that resists replay attacks.

ok markus@

OpenBSD-Commit-ID: 457dc3c3d689ba39eed328f0817ed9b91a5f78f6

show more ...


# 59d01f1d 25-Jan-2020 djm@openbsd.org

upstream: improve the error message for u2f enrollment errors by

making ssh-keygen be solely responsible for printing the error message and
convertint some more common error responses fr

upstream: improve the error message for u2f enrollment errors by

making ssh-keygen be solely responsible for printing the error message and
convertint some more common error responses from the middleware to a useful
ssherr.h status code. more detail remains visible via -v of course.

also remove indepedent copy of sk-api.h declarations in sk-usbhid.c
and just include it.

feedback & ok markus@

OpenBSD-Commit-ID: a4a8ffa870d9a3e0cfd76544bcdeef5c9fb1f1bb

show more ...


# 3cc60c89 05-Jan-2020 djm@openbsd.org

upstream: missing else in check_enroll_options()

OpenBSD-Commit-ID: e058fb918fda56ddbbf0bee910101004cec421d4


# ff5784e2 05-Jan-2020 djm@openbsd.org

upstream: fix error message

OpenBSD-Commit-ID: 1eb52025658eb78ea6223181e552862198d3d505


# c312ca07 05-Jan-2020 djm@openbsd.org

upstream: Extends the SK API to accept a set of key/value options

for all operations. These are intended to future-proof the API a little by
making it easier to specify additional fields

upstream: Extends the SK API to accept a set of key/value options

for all operations. These are intended to future-proof the API a little by
making it easier to specify additional fields for without having to change
the API version for each.

At present, only two options are defined: one to explicitly specify
the device for an operation (rather than accepting the middleware's
autoselection) and another to specify the FIDO2 username that may
be used when generating a resident key. These new options may be
invoked at key generation time via ssh-keygen -O

This also implements a suggestion from Markus to avoid "int" in favour
of uint32_t for the algorithm argument in the API, to make implementation
of ssh-sk-client/helper a little easier.

feedback, fixes and ok markus@

OpenBSD-Commit-ID: 973ce11704609022ab36abbdeb6bc23c8001eabc

show more ...


# 43ce9642 30-Dec-2019 djm@openbsd.org

upstream: translate and return error codes; retry on bad PIN

Define some well-known error codes in the SK API and pass
them back via ssh-sk-helper.

Use the new "wrong PIN" error

upstream: translate and return error codes; retry on bad PIN

Define some well-known error codes in the SK API and pass
them back via ssh-sk-helper.

Use the new "wrong PIN" error code to retry PIN prompting during
ssh-keygen of resident keys.

feedback and ok markus@

OpenBSD-Commit-ID: 9663c6a2bb7a0bc8deaccc6c30d9a2983b481620

show more ...


# c54cd189 30-Dec-2019 djm@openbsd.org

upstream: SK API and sk-helper error/PIN passing

Allow passing a PIN via the SK API (API major crank) and let the
ssh-sk-helper API follow.

Also enhance the ssh-sk-helper API to

upstream: SK API and sk-helper error/PIN passing

Allow passing a PIN via the SK API (API major crank) and let the
ssh-sk-helper API follow.

Also enhance the ssh-sk-helper API to support passing back an error
code instead of a complete reply. Will be used to signal "wrong PIN",
etc.

feedback and ok markus@

OpenBSD-Commit-ID: a1bd6b0a2421646919a0c139b8183ad76d28fb71

show more ...


# 14cea36d 30-Dec-2019 djm@openbsd.org

upstream: resident keys support in SK API

Adds a sk_load_resident_keys() function to the security key
API that accepts a security key provider and a PIN and returns
a list of keys.

upstream: resident keys support in SK API

Adds a sk_load_resident_keys() function to the security key
API that accepts a security key provider and a PIN and returns
a list of keys.

Implement support for this in the usbhid middleware.

feedback and ok markus@

OpenBSD-Commit-ID: 67e984e4e87f4999ce447a6178c4249a9174eff0

show more ...


# 4532bd01 30-Dec-2019 djm@openbsd.org

upstream: basic support for generating FIDO2 resident keys

"ssh-keygen -t ecdsa-sk|ed25519-sk -x resident" will generate a
device-resident key.

feedback and ok markus@

upstream: basic support for generating FIDO2 resident keys

"ssh-keygen -t ecdsa-sk|ed25519-sk -x resident" will generate a
device-resident key.

feedback and ok markus@

OpenBSD-Commit-ID: 8e1b3c56a4b11d85047bd6c6c705b7eef4d58431

show more ...


# 723a5369 18-Nov-2019 naddy@openbsd.org

upstream: add the missing WITH_OPENSSL ifdefs after the ED25519-SK

addition; ok djm@

OpenBSD-Commit-ID: a9545e1c273e506cf70e328cbb9d0129b6d62474


# d431778a 15-Nov-2019 markus@openbsd.org

upstream: fix typos in sk_enroll

OpenBSD-Commit-ID: faa9bf779e008b3e64e2eb1344d9b7d83b3c4487


# fd1a9649 15-Nov-2019 djm@openbsd.org

upstream: remove most uses of BN_CTX

We weren't following the rules re BN_CTX_start/BN_CTX_end and the places
we were using it didn't benefit from its use anyway. ok dtucker@

Op

upstream: remove most uses of BN_CTX

We weren't following the rules re BN_CTX_start/BN_CTX_end and the places
we were using it didn't benefit from its use anyway. ok dtucker@

OpenBSD-Commit-ID: ea9ba6c0d2e6f6adfe00b309a8f41842fe12fc7a

show more ...


# d165bb53 15-Nov-2019 deraadt@openbsd.org

upstream: rewrite c99-ism

OpenBSD-Commit-ID: d0c70cca29cfa7e6d9f7ec1d6d5dabea112499b3


# 01362cf7 14-Nov-2019 djm@openbsd.org

upstream: U2F tokens may return FIDO_ERR_USER_PRESENCE_REQUIRED when

probed to see if they own a key handle. Handle this case so the find_device()
look can work for them. Reported by Mic

upstream: U2F tokens may return FIDO_ERR_USER_PRESENCE_REQUIRED when

probed to see if they own a key handle. Handle this case so the find_device()
look can work for them. Reported by Michael Forney

OpenBSD-Commit-ID: 2ccd5b30a6ddfe4dba228b7159bf168601bd9166

show more ...


# 22a82712 14-Nov-2019 djm@openbsd.org

upstream: correct function name in debug message

OpenBSD-Commit-ID: 2482c99d2ce448f39282493050f8a01e3ffc39ab


# 6bff9521 14-Nov-2019 djm@openbsd.org

upstream: directly support U2F/FIDO2 security keys in OpenSSH by

linking against the (previously external) USB HID middleware. The dlopen()
capability still exists for alternate middlewa

upstream: directly support U2F/FIDO2 security keys in OpenSSH by

linking against the (previously external) USB HID middleware. The dlopen()
capability still exists for alternate middlewares, e.g. for Bluetooth, NFC
and test/debugging.

OpenBSD-Commit-ID: 14446cf170ac0351f0d4792ba0bca53024930069

show more ...