Resident SK keys lose verify-required on download

[Savely Krasovsky]

Humbly asking someone to review: I personally think this change is straightforward, and this check is just unnecessary. I also updated the PR description to address the questions. Hopefully, it's clear what I am doing now.

Сб, 25.07.2026 в 21:20 Savely Krasovsky писал(а):
> To clarify, in my case this does not reach the PIN fallback. With flags 
> 0x21, OpenSSH fails with device not found, apparently because it probes 
> for the UV_REQUIRED credential without requesting UV. Changing the same 
> key to 0x25 makes OpenSSH find the authenticator, perform UV, and sign 
> successfully.
>
> Сб, 25.07.2026 в 20:59 Savely Krasovsky via openssh-unix-dev писал(а):
>> Yes, UV_REQUIRED is enforced by both Token2 and YubiKey. The issue is 
>> not enforcement but that losing the OpenSSH UV flag prevents built-in 
>> UV from being explicitly requested, causing failure or PIN fallback. 
>> Manually changing the downloaded key flags from 0x21 to 0x25 fixes it.
>>
>> I wrote a workaround for this a year ago: 
>> https://github.com/savely-krasovsky/ssh-sk-rk-patcher. However, 
>> installing it on every new machine is not convenient as you can 
>> imagine, and ssh-add -K has the same problem but keeps the 
>> reconstructed key only in memory.
>>
>> Сб, 25.07.2026 в 20:50 Jan Schermer писал(а):
>>> Isn't this enforced by the Yubikey when used for signing? If not, then 
>>> this looks like a Yubikey vulnerability or incorrect generation in the 
>>> first place. Or is it just cosmetic?
>>>
>>> Jan
>>>
>>>
>>>> On 25. 7. 2026, at 20:40, Savely Krasovsky via openssh-unix-dev <openssh-unix-dev at mindrot.org> wrote:
>>>> 
>>>> Hi,
>>>> 
>>>> Resident credentials created with verify-required may lose the
>>>> SSH_SK_USER_VERIFICATION_REQD flag when downloaded using ssh-keygen -K
>>>> or ssh-add -K from authenticators with built-in UV.
>>>> 
>>>> The credential retains FIDO_CRED_PROT_UV_REQUIRED, but the downloaded
>>>> OpenSSH key gets flags 0x21 instead of 0x25.
>>>> 
>>>> I have opened a small patch with hardware validation here:
>>>> 
>>>> https://github.com/openssh/openssh-portable/pull/701
>>>> 
>>>> I used Token2 Bio3 to verify, but this also an issue on YubiKey Bio,
>>>> but I don't have it on hands rn.
>>>> 
>>>> Thanks,
>>>> Savely Krasovsky
>>>> _______________________________________________
>>>> openssh-unix-dev mailing list
>>>> openssh-unix-dev at mindrot.org
>>>> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>>
>> -- 
>> Best regards,
>> Savely Krasovsky
>> _______________________________________________
>> openssh-unix-dev mailing list
>> openssh-unix-dev at mindrot.org
>> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>
> -- 
> Best regards,
> Savely Krasovsky

-- 
Best regards,
Savely Krasovsky