Resident SK keys lose verify-required on download

[Savely Krasovsky]

Yes, UV_REQUIRED is enforced by both Token2 and YubiKey. The issue is not enforcement but that losing the OpenSSH UV flag prevents built-in UV from being explicitly requested, causing failure or PIN fallback. Manually changing the downloaded key flags from 0x21 to 0x25 fixes it.

I wrote a workaround for this a year ago: https://github.com/savely-krasovsky/ssh-sk-rk-patcher. However, installing it on every new machine is not convenient as you can imagine, and ssh-add -K has the same problem but keeps the reconstructed key only in memory.

Сб, 25.07.2026 в 20:50 Jan Schermer писал(а):
> Isn't this enforced by the Yubikey when used for signing? If not, then 
> this looks like a Yubikey vulnerability or incorrect generation in the 
> first place. Or is it just cosmetic?
>
> Jan
>
>
>> On 25. 7. 2026, at 20:40, Savely Krasovsky via openssh-unix-dev <openssh-unix-dev at mindrot.org> wrote:
>> 
>> Hi,
>> 
>> Resident credentials created with verify-required may lose the
>> SSH_SK_USER_VERIFICATION_REQD flag when downloaded using ssh-keygen -K
>> or ssh-add -K from authenticators with built-in UV.
>> 
>> The credential retains FIDO_CRED_PROT_UV_REQUIRED, but the downloaded
>> OpenSSH key gets flags 0x21 instead of 0x25.
>> 
>> I have opened a small patch with hardware validation here:
>> 
>> https://github.com/openssh/openssh-portable/pull/701
>> 
>> I used Token2 Bio3 to verify, but this also an issue on YubiKey Bio,
>> but I don't have it on hands rn.
>> 
>> Thanks,
>> Savely Krasovsky
>> _______________________________________________
>> openssh-unix-dev mailing list
>> openssh-unix-dev at mindrot.org
>> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

-- 
Best regards,
Savely Krasovsky