upstream: add some options to allow setting or clearing the

touch-required and verify-required flags on FIDO private keys when resetting
the passphrase.

feedback/ok tb@

OpenBSD-Commit-ID: 8895e62eae5778711fe7dd6c09f8679acb2e6674

diff --git a/ssh-keygen.1 b/ssh-keygen.1
index d48a05f0b142b5e4c5c292ed6a1780555e93f3a0..eab40a55c461f99e6e23331316b72a3b841b0a1e 100644 (file)
--- a/ssh-keygen.1
+++ b/ssh-keygen.1
@@ -1,4 +1,4 @@
-.\"    $OpenBSD: ssh-keygen.1,v 1.239 2026/07/11 11:15:03 naddy Exp $
+.\"    $OpenBSD: ssh-keygen.1,v 1.240 2026/08/07 05:49:53 djm Exp $

 .\"
 .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
 .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
 .\"
 .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
 .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland


@@ -35,7 +35,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"

-.Dd $Mdocdate: July 11 2026 $
+.Dd $Mdocdate: August 7 2026 $

 .Dt SSH-KEYGEN 1
 .Os
 .Sh NAME
 .Dt SSH-KEYGEN 1
 .Os
 .Sh NAME


@@ -492,6 +492,11 @@ When generating FIDO authenticator-backed keys, the options listed in the
 .Sx FIDO AUTHENTICATOR
 section may be specified.
 .Pp
 .Sx FIDO AUTHENTICATOR
 section may be specified.
 .Pp

+When changing the passphrase for an existing key, the options listed in the
+documentation for the
+.Fl p
+flag may be used.
+.Pp

 When performing signature-related options using the
 .Fl Y
 flag, the following options are accepted:
 When performing signature-related options using the
 .Fl Y
 flag, the following options are accepted:


@@ -542,6 +547,32 @@ creating a new private key.
 The program will prompt for the file
 containing the private key, for the old passphrase, and twice for the
 new passphrase.
 The program will prompt for the file
 containing the private key, for the old passphrase, and twice for the
 new passphrase.

+.Pp
+Updating the passphrase will cause encrypted keys to be reencrypted,
+allowing the cipher and/or number of KDF rounds (the
+.Fl Z
+and
+.Fl a
+options respectively) to be changed.
+.Pp
+This option may also be used to set or clear FIDO related options via the
+.Fl O
+flag.
+The following FIDO options may be modified:
+.Pp
+.Bl -tag -width Ds -compact
+.It Cm touch-required
+.It Cm no-touch-required
+Add or remove the requirement that signatures made using this key include
+demonstration of user presence (e.g. by having the user touch the
+authenticator).
+.Pp
+.It Cm verify-required
+.It Cm no-verify-required
+Add or remove the requirement for signatures made using this key to first
+verify the user identity, e.g. by PIN or on-token biometrics.
+.El
+.Pp

 .It Fl Q
 Test whether keys have been revoked in a KRL.
 If the
 .It Fl Q
 Test whether keys have been revoked in a KRL.
 If the

diff --git a/ssh-keygen.c b/ssh-keygen.c
index e3a12bf39ecda601d6a3f28153fd9ba4d68f74ed..6667a5c1b644964c1ecd76b9626e228807787411 100644 (file)
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keygen.c,v 1.492 2026/06/30 23:55:32 djm Exp $ */
+/* $OpenBSD: ssh-keygen.c,v 1.493 2026/08/07 05:49:53 djm Exp $ */

 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland


@@ -1349,13 +1349,14 @@ do_known_hosts(struct passwd *pw, const char *name, int find_host,
  * for the current user.
  */
 static void
  * for the current user.
  */
 static void

-do_change_passphrase(struct passwd *pw)
+do_change_passphrase(struct passwd *pw, char * const *opts, size_t nopts)

 {
        char *comment;
        char *old_passphrase, *passphrase1, *passphrase2;
        struct stat st;
        struct sshkey *private;
        int r;
 {
        char *comment;
        char *old_passphrase, *passphrase1, *passphrase2;
        struct stat st;
        struct sshkey *private;
        int r;

+       size_t i;

 
        if (!have_identity)
                ask_filename(pw, "Enter file in which the key is");
 
        if (!have_identity)
                ask_filename(pw, "Enter file in which the key is");


@@ -1382,6 +1383,38 @@ do_change_passphrase(struct passwd *pw)
        if (comment)
                mprintf("Key has comment '%s'\n", comment);
 
        if (comment)
                mprintf("Key has comment '%s'\n", comment);
 

+       /* All current -O options relate to FIDO keys only */
+       if (nopts != 0 && !sshkey_is_sk(private)) {
+               fatal("FIDO-specific option requested for non-FIDO key %s",
+                   identity_file);
+       }
+       if (sshkey_is_sk(private)) {
+               debug_f("%s: original FIDO key flags: "
+                   "%stouch-required %sverify-required", identity_file,
+                   (private->sk_flags & SSH_SK_USER_PRESENCE_REQD) ? "": "no-",
+                   (private->sk_flags & SSH_SK_USER_VERIFICATION_REQD) ? "" : "no-");
+       }
+       for (i = 0; i < nopts; i++) {
+               if (strcasecmp(opts[i], "touch-required") == 0)
+                       private->sk_flags |= SSH_SK_USER_PRESENCE_REQD;
+               else if (strcasecmp(opts[i], "no-touch-required") == 0)
+                       private->sk_flags &= ~SSH_SK_USER_PRESENCE_REQD;
+               else if (strcasecmp(opts[i], "verify-required") == 0)
+                       private->sk_flags |= SSH_SK_USER_VERIFICATION_REQD;
+               else if (strcasecmp(opts[i], "no-verify-required") == 0)
+                       private->sk_flags &= ~SSH_SK_USER_VERIFICATION_REQD;
+               else {
+                       fatal("Option \"%s\" is unsupported for "
+                           "key passphrase change", opts[i]);
+               }
+       }
+       if (sshkey_is_sk(private) && nopts != 0) {
+               debug_f("%s: updated FIDO key flags: "
+                   "%stouch-required %sverify-required", identity_file,
+                   (private->sk_flags & SSH_SK_USER_PRESENCE_REQD) ? "": "no-",
+                   (private->sk_flags & SSH_SK_USER_VERIFICATION_REQD) ? "" : "no-");
+       }
+

        /* Ask the new passphrase (twice). */
        if (identity_new_passphrase) {
                passphrase1 = xstrdup(identity_new_passphrase);
        /* Ask the new passphrase (twice). */
        if (identity_new_passphrase) {
                passphrase1 = xstrdup(identity_new_passphrase);


@@ -3694,7 +3727,7 @@ main(int argc, char **argv)
        if (print_fingerprint || print_bubblebabble)
                do_fingerprint(pw);
        if (change_passphrase)
        if (print_fingerprint || print_bubblebabble)
                do_fingerprint(pw);
        if (change_passphrase)

-               do_change_passphrase(pw);
+               do_change_passphrase(pw, opts, nopts);

        if (change_comment)
                do_change_comment(pw, identity_comment);
 #ifdef WITH_OPENSSL
        if (change_comment)
                do_change_comment(pw, identity_comment);
 #ifdef WITH_OPENSSL