[openssh-commits] [openssh] branch master updated: upstream: add some options to allow setting or clearing the
git+noreply at mindrot.org
git+noreply at mindrot.org
Fri Aug 7 15:50:26 AEST 2026
This is an automated email from the git hooks/post-receive script.
djm pushed a commit to branch master
in repository openssh.
The following commit(s) were added to refs/heads/master by this push:
new 72ed5241a upstream: add some options to allow setting or clearing the
72ed5241a is described below
commit 72ed5241a8cf465d7a45035dedf1baa74ad6c3f7
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Aug 7 05:49:53 2026 +0000
upstream: add some options to allow setting or clearing the
touch-required and verify-required flags on FIDO private keys when resetting
the passphrase.
feedback/ok tb@
OpenBSD-Commit-ID: 8895e62eae5778711fe7dd6c09f8679acb2e6674
---
ssh-keygen.1 | 35 +++++++++++++++++++++++++++++++++--
ssh-keygen.c | 39 ++++++++++++++++++++++++++++++++++++---
2 files changed, 69 insertions(+), 5 deletions(-)
diff --git a/ssh-keygen.1 b/ssh-keygen.1
index d48a05f0b..eab40a55c 100644
--- a/ssh-keygen.1
+++ b/ssh-keygen.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssh-keygen.1,v 1.239 2026/07/11 11:15:03 naddy Exp $
+.\" $OpenBSD: ssh-keygen.1,v 1.240 2026/08/07 05:49:53 djm Exp $
.\"
.\" Author: Tatu Ylonen <ylo at cs.hut.fi>
.\" Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -35,7 +35,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd $Mdocdate: July 11 2026 $
+.Dd $Mdocdate: August 7 2026 $
.Dt SSH-KEYGEN 1
.Os
.Sh NAME
@@ -492,6 +492,11 @@ When generating FIDO authenticator-backed keys, the options listed in the
.Sx FIDO AUTHENTICATOR
section may be specified.
.Pp
+When changing the passphrase for an existing key, the options listed in the
+documentation for the
+.Fl p
+flag may be used.
+.Pp
When performing signature-related options using the
.Fl Y
flag, the following options are accepted:
@@ -542,6 +547,32 @@ creating a new private key.
The program will prompt for the file
containing the private key, for the old passphrase, and twice for the
new passphrase.
+.Pp
+Updating the passphrase will cause encrypted keys to be reencrypted,
+allowing the cipher and/or number of KDF rounds (the
+.Fl Z
+and
+.Fl a
+options respectively) to be changed.
+.Pp
+This option may also be used to set or clear FIDO related options via the
+.Fl O
+flag.
+The following FIDO options may be modified:
+.Pp
+.Bl -tag -width Ds -compact
+.It Cm touch-required
+.It Cm no-touch-required
+Add or remove the requirement that signatures made using this key include
+demonstration of user presence (e.g. by having the user touch the
+authenticator).
+.Pp
+.It Cm verify-required
+.It Cm no-verify-required
+Add or remove the requirement for signatures made using this key to first
+verify the user identity, e.g. by PIN or on-token biometrics.
+.El
+.Pp
.It Fl Q
Test whether keys have been revoked in a KRL.
If the
diff --git a/ssh-keygen.c b/ssh-keygen.c
index e3a12bf39..6667a5c1b 100644
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keygen.c,v 1.492 2026/06/30 23:55:32 djm Exp $ */
+/* $OpenBSD: ssh-keygen.c,v 1.493 2026/08/07 05:49:53 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1994 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -1349,13 +1349,14 @@ do_known_hosts(struct passwd *pw, const char *name, int find_host,
* for the current user.
*/
static void
-do_change_passphrase(struct passwd *pw)
+do_change_passphrase(struct passwd *pw, char * const *opts, size_t nopts)
{
char *comment;
char *old_passphrase, *passphrase1, *passphrase2;
struct stat st;
struct sshkey *private;
int r;
+ size_t i;
if (!have_identity)
ask_filename(pw, "Enter file in which the key is");
@@ -1382,6 +1383,38 @@ do_change_passphrase(struct passwd *pw)
if (comment)
mprintf("Key has comment '%s'\n", comment);
+ /* All current -O options relate to FIDO keys only */
+ if (nopts != 0 && !sshkey_is_sk(private)) {
+ fatal("FIDO-specific option requested for non-FIDO key %s",
+ identity_file);
+ }
+ if (sshkey_is_sk(private)) {
+ debug_f("%s: original FIDO key flags: "
+ "%stouch-required %sverify-required", identity_file,
+ (private->sk_flags & SSH_SK_USER_PRESENCE_REQD) ? "": "no-",
+ (private->sk_flags & SSH_SK_USER_VERIFICATION_REQD) ? "" : "no-");
+ }
+ for (i = 0; i < nopts; i++) {
+ if (strcasecmp(opts[i], "touch-required") == 0)
+ private->sk_flags |= SSH_SK_USER_PRESENCE_REQD;
+ else if (strcasecmp(opts[i], "no-touch-required") == 0)
+ private->sk_flags &= ~SSH_SK_USER_PRESENCE_REQD;
+ else if (strcasecmp(opts[i], "verify-required") == 0)
+ private->sk_flags |= SSH_SK_USER_VERIFICATION_REQD;
+ else if (strcasecmp(opts[i], "no-verify-required") == 0)
+ private->sk_flags &= ~SSH_SK_USER_VERIFICATION_REQD;
+ else {
+ fatal("Option \"%s\" is unsupported for "
+ "key passphrase change", opts[i]);
+ }
+ }
+ if (sshkey_is_sk(private) && nopts != 0) {
+ debug_f("%s: updated FIDO key flags: "
+ "%stouch-required %sverify-required", identity_file,
+ (private->sk_flags & SSH_SK_USER_PRESENCE_REQD) ? "": "no-",
+ (private->sk_flags & SSH_SK_USER_VERIFICATION_REQD) ? "" : "no-");
+ }
+
/* Ask the new passphrase (twice). */
if (identity_new_passphrase) {
passphrase1 = xstrdup(identity_new_passphrase);
@@ -3694,7 +3727,7 @@ main(int argc, char **argv)
if (print_fingerprint || print_bubblebabble)
do_fingerprint(pw);
if (change_passphrase)
- do_change_passphrase(pw);
+ do_change_passphrase(pw, opts, nopts);
if (change_comment)
do_change_comment(pw, identity_comment);
#ifdef WITH_OPENSSL
--
To stop receiving notification emails like this one, please contact
djm at mindrot.org.
More information about the openssh-commits
mailing list