From: djm@openbsd.org Date: Fri, 7 Aug 2026 05:49:53 +0000 (+0000) Subject: upstream: add some options to allow setting or clearing the X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=HEAD;p=thirdparty%2Fopenssh-portable.git upstream: add some options to allow setting or clearing the touch-required and verify-required flags on FIDO private keys when resetting the passphrase. feedback/ok tb@ OpenBSD-Commit-ID: 8895e62eae5778711fe7dd6c09f8679acb2e6674 --- diff --git a/ssh-keygen.1 b/ssh-keygen.1 index d48a05f0b..eab40a55c 100644 --- a/ssh-keygen.1 +++ b/ssh-keygen.1 @@ -1,4 +1,4 @@ -.\" $OpenBSD: ssh-keygen.1,v 1.239 2026/07/11 11:15:03 naddy Exp $ +.\" $OpenBSD: ssh-keygen.1,v 1.240 2026/08/07 05:49:53 djm Exp $ .\" .\" Author: Tatu Ylonen .\" Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -35,7 +35,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd $Mdocdate: July 11 2026 $ +.Dd $Mdocdate: August 7 2026 $ .Dt SSH-KEYGEN 1 .Os .Sh NAME @@ -492,6 +492,11 @@ When generating FIDO authenticator-backed keys, the options listed in the .Sx FIDO AUTHENTICATOR section may be specified. .Pp +When changing the passphrase for an existing key, the options listed in the +documentation for the +.Fl p +flag may be used. +.Pp When performing signature-related options using the .Fl Y flag, the following options are accepted: @@ -542,6 +547,32 @@ creating a new private key. The program will prompt for the file containing the private key, for the old passphrase, and twice for the new passphrase. +.Pp +Updating the passphrase will cause encrypted keys to be reencrypted, +allowing the cipher and/or number of KDF rounds (the +.Fl Z +and +.Fl a +options respectively) to be changed. +.Pp +This option may also be used to set or clear FIDO related options via the +.Fl O +flag. +The following FIDO options may be modified: +.Pp +.Bl -tag -width Ds -compact +.It Cm touch-required +.It Cm no-touch-required +Add or remove the requirement that signatures made using this key include +demonstration of user presence (e.g. by having the user touch the +authenticator). +.Pp +.It Cm verify-required +.It Cm no-verify-required +Add or remove the requirement for signatures made using this key to first +verify the user identity, e.g. by PIN or on-token biometrics. +.El +.Pp .It Fl Q Test whether keys have been revoked in a KRL. If the diff --git a/ssh-keygen.c b/ssh-keygen.c index e3a12bf39..6667a5c1b 100644 --- a/ssh-keygen.c +++ b/ssh-keygen.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-keygen.c,v 1.492 2026/06/30 23:55:32 djm Exp $ */ +/* $OpenBSD: ssh-keygen.c,v 1.493 2026/08/07 05:49:53 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1994 Tatu Ylonen , Espoo, Finland @@ -1349,13 +1349,14 @@ do_known_hosts(struct passwd *pw, const char *name, int find_host, * for the current user. */ static void -do_change_passphrase(struct passwd *pw) +do_change_passphrase(struct passwd *pw, char * const *opts, size_t nopts) { char *comment; char *old_passphrase, *passphrase1, *passphrase2; struct stat st; struct sshkey *private; int r; + size_t i; if (!have_identity) ask_filename(pw, "Enter file in which the key is"); @@ -1382,6 +1383,38 @@ do_change_passphrase(struct passwd *pw) if (comment) mprintf("Key has comment '%s'\n", comment); + /* All current -O options relate to FIDO keys only */ + if (nopts != 0 && !sshkey_is_sk(private)) { + fatal("FIDO-specific option requested for non-FIDO key %s", + identity_file); + } + if (sshkey_is_sk(private)) { + debug_f("%s: original FIDO key flags: " + "%stouch-required %sverify-required", identity_file, + (private->sk_flags & SSH_SK_USER_PRESENCE_REQD) ? "": "no-", + (private->sk_flags & SSH_SK_USER_VERIFICATION_REQD) ? "" : "no-"); + } + for (i = 0; i < nopts; i++) { + if (strcasecmp(opts[i], "touch-required") == 0) + private->sk_flags |= SSH_SK_USER_PRESENCE_REQD; + else if (strcasecmp(opts[i], "no-touch-required") == 0) + private->sk_flags &= ~SSH_SK_USER_PRESENCE_REQD; + else if (strcasecmp(opts[i], "verify-required") == 0) + private->sk_flags |= SSH_SK_USER_VERIFICATION_REQD; + else if (strcasecmp(opts[i], "no-verify-required") == 0) + private->sk_flags &= ~SSH_SK_USER_VERIFICATION_REQD; + else { + fatal("Option \"%s\" is unsupported for " + "key passphrase change", opts[i]); + } + } + if (sshkey_is_sk(private) && nopts != 0) { + debug_f("%s: updated FIDO key flags: " + "%stouch-required %sverify-required", identity_file, + (private->sk_flags & SSH_SK_USER_PRESENCE_REQD) ? "": "no-", + (private->sk_flags & SSH_SK_USER_VERIFICATION_REQD) ? "" : "no-"); + } + /* Ask the new passphrase (twice). */ if (identity_new_passphrase) { passphrase1 = xstrdup(identity_new_passphrase); @@ -3694,7 +3727,7 @@ main(int argc, char **argv) if (print_fingerprint || print_bubblebabble) do_fingerprint(pw); if (change_passphrase) - do_change_passphrase(pw); + do_change_passphrase(pw, opts, nopts); if (change_comment) do_change_comment(pw, identity_comment); #ifdef WITH_OPENSSL