Resident SK keys lose verify-required on download

[Savely Krasovsky]

To clarify, in my case this does not reach the PIN fallback. With flags 0x21, OpenSSH fails with device not found, apparently because it probes for the UV_REQUIRED credential without requesting UV. Changing the same key to 0x25 makes OpenSSH find the authenticator, perform UV, and sign successfully.

Сб, 25.07.2026 в 20:59 Savely Krasovsky via openssh-unix-dev писал(а):
> Yes, UV_REQUIRED is enforced by both Token2 and YubiKey. The issue is 
> not enforcement but that losing the OpenSSH UV flag prevents built-in 
> UV from being explicitly requested, causing failure or PIN fallback. 
> Manually changing the downloaded key flags from 0x21 to 0x25 fixes it.
>
> I wrote a workaround for this a year ago: 
> https://github.com/savely-krasovsky/ssh-sk-rk-patcher. However, 
> installing it on every new machine is not convenient as you can 
> imagine, and ssh-add -K has the same problem but keeps the 
> reconstructed key only in memory.
>
> Сб, 25.07.2026 в 20:50 Jan Schermer писал(а):
>> Isn't this enforced by the Yubikey when used for signing? If not, then 
>> this looks like a Yubikey vulnerability or incorrect generation in the 
>> first place. Or is it just cosmetic?
>>
>> Jan
>>
>>
>>> On 25. 7. 2026, at 20:40, Savely Krasovsky via openssh-unix-dev <openssh-unix-dev at mindrot.org> wrote:
>>> 
>>> Hi,
>>> 
>>> Resident credentials created with verify-required may lose the
>>> SSH_SK_USER_VERIFICATION_REQD flag when downloaded using ssh-keygen -K
>>> or ssh-add -K from authenticators with built-in UV.
>>> 
>>> The credential retains FIDO_CRED_PROT_UV_REQUIRED, but the downloaded
>>> OpenSSH key gets flags 0x21 instead of 0x25.
>>> 
>>> I have opened a small patch with hardware validation here:
>>> 
>>> https://github.com/openssh/openssh-portable/pull/701
>>> 
>>> I used Token2 Bio3 to verify, but this also an issue on YubiKey Bio,
>>> but I don't have it on hands rn.
>>> 
>>> Thanks,
>>> Savely Krasovsky
>>> _______________________________________________
>>> openssh-unix-dev mailing list
>>> openssh-unix-dev at mindrot.org
>>> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>
> -- 
> Best regards,
> Savely Krasovsky
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

-- 
Best regards,
Savely Krasovsky