Fwd: sk-api suggestions

Reza Tavakoli rta.0070 at gmail.com
Fri Mar 6 00:12:29 AEDT 2020


I'm helping the Git for windows team and contributing in git-for-windows
repository to help expand the OpenSSH support for fido2 devices on Windows.
Currently we are using your internal implementation(sk-usbhic.c) however
since Windows 10 version 1903 this requires administrator privileges.

I'm trying to create a module for OpenSSH to use webauthn.dll instead of
direct calling to libfido2 to eliminate the need for administrator
I noticed that in ssh-sk.c in function sshsk_sign you hash the input data
before passing it to external module sk_sign function. The problem is,
Windows API automatically hash the input before sending it to fido device,
so I need to receive the data without hashing to be able to use this or
else the data will be hashed two times and verification will fail.

May I suggest that you do this part inside sk_sign command so the module
using your sk-api.h interface can do this if it's needed?

Thank you,

More information about the openssh-unix-dev mailing list