upstream: add some options to allow setting or clearing the

touch-required and verify-required flags on FIDO private keys when resetting
the passphrase.

feedback/ok tb@

OpenBSD-Commit-ID: 8895e62eae5778711fe7dd6c09f8679acb2e6674

diff --git a/ssh-keygen.1 b/ssh-keygen.1
index d48a05f0b142b5e4c5c292ed6a1780555e93f3a0..eab40a55c461f99e6e23331316b72a3b841b0a1e 100644 (file)
--- a/ssh-keygen.1
+++ b/ssh-keygen.1
@@ -1,4 +1,4 @@
-.\"    $OpenBSD: ssh-keygen.1,v 1.239 2026/07/11 11:15:03 naddy Exp $
+.\"    $OpenBSD: ssh-keygen.1,v 1.240 2026/08/07 05:49:53 djm Exp $
 .\"
 .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
 .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -35,7 +35,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: July 11 2026 $
+.Dd $Mdocdate: August 7 2026 $
 .Dt SSH-KEYGEN 1
 .Os
 .Sh NAME
@@ -492,6 +492,11 @@ When generating FIDO authenticator-backed keys, the options listed in the
 .Sx FIDO AUTHENTICATOR
 section may be specified.
 .Pp
+When changing the passphrase for an existing key, the options listed in the
+documentation for the
+.Fl p
+flag may be used.
+.Pp
 When performing signature-related options using the
 .Fl Y
 flag, the following options are accepted:
@@ -542,6 +547,32 @@ creating a new private key.
 The program will prompt for the file
 containing the private key, for the old passphrase, and twice for the
 new passphrase.
+.Pp
+Updating the passphrase will cause encrypted keys to be reencrypted,
+allowing the cipher and/or number of KDF rounds (the
+.Fl Z
+and
+.Fl a
+options respectively) to be changed.
+.Pp
+This option may also be used to set or clear FIDO related options via the
+.Fl O
+flag.
+The following FIDO options may be modified:
+.Pp
+.Bl -tag -width Ds -compact
+.It Cm touch-required
+.It Cm no-touch-required
+Add or remove the requirement that signatures made using this key include
+demonstration of user presence (e.g. by having the user touch the
+authenticator).
+.Pp
+.It Cm verify-required
+.It Cm no-verify-required
+Add or remove the requirement for signatures made using this key to first
+verify the user identity, e.g. by PIN or on-token biometrics.
+.El
+.Pp
 .It Fl Q
 Test whether keys have been revoked in a KRL.
 If the

diff --git a/ssh-keygen.c b/ssh-keygen.c
index e3a12bf39ecda601d6a3f28153fd9ba4d68f74ed..6667a5c1b644964c1ecd76b9626e228807787411 100644 (file)
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keygen.c,v 1.492 2026/06/30 23:55:32 djm Exp $ */
+/* $OpenBSD: ssh-keygen.c,v 1.493 2026/08/07 05:49:53 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1349,13 +1349,14 @@ do_known_hosts(struct passwd *pw, const char *name, int find_host,
  * for the current user.
  */
 static void
-do_change_passphrase(struct passwd *pw)
+do_change_passphrase(struct passwd *pw, char * const *opts, size_t nopts)
 {
        char *comment;
        char *old_passphrase, *passphrase1, *passphrase2;
        struct stat st;
        struct sshkey *private;
        int r;
+       size_t i;
 
        if (!have_identity)
                ask_filename(pw, "Enter file in which the key is");
@@ -1382,6 +1383,38 @@ do_change_passphrase(struct passwd *pw)
        if (comment)
                mprintf("Key has comment '%s'\n", comment);
 
+       /* All current -O options relate to FIDO keys only */
+       if (nopts != 0 && !sshkey_is_sk(private)) {
+               fatal("FIDO-specific option requested for non-FIDO key %s",
+                   identity_file);
+       }
+       if (sshkey_is_sk(private)) {
+               debug_f("%s: original FIDO key flags: "
+                   "%stouch-required %sverify-required", identity_file,
+                   (private->sk_flags & SSH_SK_USER_PRESENCE_REQD) ? "": "no-",
+                   (private->sk_flags & SSH_SK_USER_VERIFICATION_REQD) ? "" : "no-");
+       }
+       for (i = 0; i < nopts; i++) {
+               if (strcasecmp(opts[i], "touch-required") == 0)
+                       private->sk_flags |= SSH_SK_USER_PRESENCE_REQD;
+               else if (strcasecmp(opts[i], "no-touch-required") == 0)
+                       private->sk_flags &= ~SSH_SK_USER_PRESENCE_REQD;
+               else if (strcasecmp(opts[i], "verify-required") == 0)
+                       private->sk_flags |= SSH_SK_USER_VERIFICATION_REQD;
+               else if (strcasecmp(opts[i], "no-verify-required") == 0)
+                       private->sk_flags &= ~SSH_SK_USER_VERIFICATION_REQD;
+               else {
+                       fatal("Option \"%s\" is unsupported for "
+                           "key passphrase change", opts[i]);
+               }
+       }
+       if (sshkey_is_sk(private) && nopts != 0) {
+               debug_f("%s: updated FIDO key flags: "
+                   "%stouch-required %sverify-required", identity_file,
+                   (private->sk_flags & SSH_SK_USER_PRESENCE_REQD) ? "": "no-",
+                   (private->sk_flags & SSH_SK_USER_VERIFICATION_REQD) ? "" : "no-");
+       }
+
        /* Ask the new passphrase (twice). */
        if (identity_new_passphrase) {
                passphrase1 = xstrdup(identity_new_passphrase);
@@ -3694,7 +3727,7 @@ main(int argc, char **argv)
        if (print_fingerprint || print_bubblebabble)
                do_fingerprint(pw);
        if (change_passphrase)
-               do_change_passphrase(pw);
+               do_change_passphrase(pw, opts, nopts);
        if (change_comment)
                do_change_comment(pw, identity_comment);
 #ifdef WITH_OPENSSL