Skip to content

add support for SK type SSH keys

Franz Baumgärtner requested to merge brainpower/ksshaskpass:sk-keys-presence-confirm into master

This adds support for "Confirm user presence" and security key PIN input.

With sk- type SSH Keys like sk-ssh-ed25519@openssh.com the User may be asked to press or touch a button on their security key device when SSH wants to use the key (e.g. when connecting).

Previously this showed a dialog like the following with a password input, which falsely suggests a password is needed:

screen-2

Which is not the case, the user only needs to "confirm their presence" by pressing a button or touching the SK-Device, nothing else. So this patch switches it to the TypeConfirm dialog, that I think fits the situation a little better:

screen-3

Though, maybe the dialog for this should not even have the Accept button, only the Abort or a single Close button?

Since Accept does nothing in this case, the user still needs to only touch the device, not press any buttons on the dialog.

(Same for Abort actually, it does nothing except close the dialog in this case. So maybe makes sense to only have a Close button?)

SSH will close the dialog automatically, when the button on the device was pressed or the request times out.

Near the "Confirm user presence" string in OpenSSH Code at https://github.com/openssh/openssh-portable/blob/73dcca12115aa12ed0d123b914d473c384e52651/ssh-agent.c#L817 there was also a "Enter PIN and (optionally) confirm presence" thing, so I added a check for that, too. But can't really test, since my SK-Device does not have that/trigger that. I can remove that part, if you don't want it like this.

Merge request reports