From: Achim Gratz <Stromeko@nexgo.de>
To: cygwin-apps@cygwin.com
Subject: [ATTN MAINTAINER] openssh
Date: Sun, 21 Nov 2021 11:01:46 +0100 [thread overview]
Message-ID: <874k85yghh.fsf@Rainer.invalid> (raw)
Here are my fixes to make transparent WebAuthn through libfido2 work w/
OpenSSH. This is required for Win10 from release 1909; the access to
USB-HID is since restricted to users with administrative privileges:
https://cygwin.com/git-cygwin-packages/?p=git/cygwin-packages/playground.git;a=shortlog;h=refs/heads/openssh
The changes switch to a newer API available from libfido2 that is
required for WebAuthn support (which needs the unhashed data instead of
the SH256 like the actual FIDO2-Token), make that protocol the preferred
one (so that WebAuthn is always used when available w/o being dependent
on the order of the device enumeration) and lastly prevent some extra
(optional) PIN prompts from WinHello that do not happen when using the
USB-HID interface either. The PIN patches were inspired by an
OpensSSH-portable fork that seems to be maintened by some folks who also
work on libfido, although they seem to have missed a few spots and I
opted for slightly different patches.
The use of the new API is properly wired into the configury.
Unfortunately libfido2 does not provide a way to determine if WebAuthn
support has been compiled in (the one exposed function is a predicate
that always returns false on builds that do not use WebAuthn), so I'm
currently using a heuristic that eventually should be replaced by a
configure option. Also, it would probably be a good idea to decide at
runtime whether to use WebAuthn or not (maybe via an environment or
config variable).
These patches work for 32bit also and I believe they are correct, but
that build should not be made available due to a bug in libfido2 that
crashes when trying to free the memory associated with the WebAuthn
payload returned. Without these patches applied you can still use the
fallback to USB-HID when you are an administrator.
Regards,
Achim.
--
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+
SD adaptations for KORG EX-800 and Poly-800MkII V0.9:
http://Synth.Stromeko.net/Downloads.html#KorgSDada
next reply other threads:[~2021-11-21 10:01 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-21 10:01 Achim Gratz [this message]
2021-11-28 9:53 ` Achim Gratz
2021-11-29 12:07 ` Corinna Vinschen
2021-11-29 17:34 ` Achim Gratz
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=874k85yghh.fsf@Rainer.invalid \
--to=stromeko@nexgo.de \
--cc=cygwin-apps@cygwin.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).