Resident SK keys lose verify-required on download

[Emin Hüseynov]

As a hardware authenticator vendor (Token2), we'd like to confirm this bug and support merging the fix.

The problem. When a resident SK credential is created with verify-required on an authenticator that has built-in (internal) user verification - such as the Token2 Bio3-  the credential is correctly stored with FIDO_CRED_PROT_UV_REQUIRED (Cred Protect level 3). However, when that credential is later downloaded on a new machine via ssh-keygen -K or ssh-add -K, OpenSSH reconstructs the key with flags 0x21 instead of 0x25, dropping the SSH_SK_USER_VERIFICATION_REQD flag.

Why it breaks. The authenticator enforces the Cred Protect 3 (force-UV) restriction on the credential itself, not just server-side. When OpenSSH later attempts to assert against that credential without explicitly requesting UV - because the flag was lost on download - the authenticator skips the credential. The result is a "device not found" failure at flags 0x21, or an unintended PIN fallback. Manually patching the downloaded key from 0x21 to 0x25 makes OpenSSH find the authenticator, perform internal UV, and sign successfully - confirming the flag loss is the sole cause.

Scope. This is not enforcement working incorrectly; enforcement is correct on our side and on any FIDO key running FIDO2.1Final or later . The issue is purely that the client-side keystub loses the UV requirement on read-back, so built-in UV can no longer be explicitly requested.

Request. The proposed patch (PR #701) restores the correct flag on download with hardware validation. We've verified the behavior against the Token2 Bio3 and consider the change straightforward and correct.

Token2 is happy to provide test hardware or further verification if that helps the review.

Regards,
Emin

CTO, Token2

Jan Schermer :
>>> Isn't this enforced by the Yubikey when used for signing? If not, then
>>> this looks like a Yubikey vulnerability or incorrect generation in the
>>> first place. Or is it just cosmetic?
>>>
>>> Jan
>>>
>>>
>>>> On 25. 7. 2026, at 20:40, Savely Krasovsky via openssh-unix-dev <openssh-unix-dev at mindrot.org> wrote:
>>>>
>>>> Hi,
>>>>
>>>> Resident credentials created with verify-required may lose the
>>>> SSH_SK_USER_VERIFICATION_REQD flag when downloaded using ssh-keygen -K
>>>> or ssh-add -K from authenticators with built-in UV.
>>>>
>>>> The credential retains FIDO_CRED_PROT_UV_REQUIRED, but the downloaded
>>>> OpenSSH key gets flags 0x21 instead of 0x25.
>>>>
>>>> I have opened a small patch with hardware validation here:
>>>>
>>>> https://github.com/openssh/openssh-portable/pull/701
>>>>
>>>> I used Token2 Bio3 to verify, but this also an issue on YubiKey Bio,
>>>> but I don't have it on hands rn.
>>>>
>>>> Thanks,
>>>> Savely Krasovsky
>>>> _______________________________________________
>>>> openssh-unix-dev mailing list
>>>> openssh-unix-dev at mindrot.org
>>>> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>>
>> --
>> Best regards,
>> Savely Krasovsky
>> _______________________________________________
>> openssh-unix-dev mailing list
>> openssh-unix-dev at mindrot.org
>> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>