Adding U2F/Fido2 keys to the agent from other clients

Prerequisites

Write a descriptive title.
Make sure you are able to repro it on the latest version
Search the existing issues.

Steps to reproduce

When trying to add an ecdsa-sk key to the Windows ssh-agent:

Using the Windows ssh-add (works properly):

PS > & "C:\Program Files\OpenSSH\ssh-add" id_ecdsa_sk
Identity added: id_ecdsa_sk (somu)

From Fedora 35 WSL2 (OpenSSH 8.7p1, via npiperelay, fails):

$ ssh-add -d
Identity removed: /home/abob/.ssh/id_ecdsa_sk ECDSA-SK ((null))
$ ssh-add -l
The agent has no identities.
$ ssh-add id_ecdsa_sk
Could not add identity "id_ecdsa_sk": communication with agent failed

From KeePassXC 2.7.1 (fails):

Fedora and KeePassXC are able to add non-U2F/Fido2 keys

If I change the Fedora ssh-add client to not send a skprovider, it works:

$ ./ssh-add -l
The agent has no identities.
$ ./ssh-add ~/.ssh/id_ecdsa_sk
Identity added: /home/abob/.ssh/id_ecdsa_sk (somu)
$ ./ssh-add -l
256 SHA256:8gAXpKjrC+SzxcCkKk6xb6Rk4I+U/FyewnQy2H+zvtA somu (ECDSA-SK)

Expected behavior

SSH key loaded into agent

Actual behavior

Error messages from other ssh agent clients

Error details

No response

Environment data

PS > & "C:\Program Files\OpenSSH\ssh" -V
OpenSSH_for_Windows_8.9p1, LibreSSL 3.4.3

Version

8.9.1.0

Visuals

No response

Running windows ssh agent in debug mode gives this message:

debug1: process agent request type 25
debug1: unknown agent request 25

type 25 is:

$ grep 25 authfd.h
#define SSH2_AGENTC_ADD_ID_CONSTRAINED          25

ssh-agent.c handles this with the same code path as add_identity:

        case SSH2_AGENTC_ADD_IDENTITY:
        case SSH2_AGENTC_ADD_ID_CONSTRAINED:
                process_add_identity(e);
                break;

support SSH2_AGENTC_ADD_ID_CONSTRAINED by treating it as SSH2_AGENTC_…

Simply adding a key with a lifetime (-t life) using ssh-add.exe shipped with Win32-OpenSSH fails:

> & 'C:\Program Files\OpenSSH\ssh-add.exe' -t 60 .\.ssh\id_ed25519
Enter passphrase for .\.ssh\id_ed25519:
Could not add identity ".\.ssh\id_ed25519": communication with agent failed

support SSH2_AGENTC_ADD_ID_CONSTRAINED for sk-provider@openssh.com (#612

support SSH2_AGENTC_ADD_ID_CONSTRAINED for sk-provider@openssh.com (P…

Navigation Menu

Repository navigation

Adding U2F/Fido2 keys to the agent from other clients #1961

Prerequisites

Steps to reproduce

Expected behavior

Actual behavior

Error details

Environment data

Version

Visuals

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Adding U2F/Fido2 keys to the agent from other clients #1961

Description

Prerequisites

Steps to reproduce

Expected behavior

Actual behavior

Error details

Environment data

Version

Visuals

Activity

ddrown commented on Jul 3, 2022

carlolars commented on Jul 29, 2022

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions