diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2020-08-27 03:07:51 +0200 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2020-08-27 03:28:36 +0200 |
| commit | 642e06d0df983fa2af85126cf4b23440bb2985bf (patch) | |
| tree | 7115282d5778d4581b17a7fec07d7dcda64a7836 /ssh-keygen.c | |
| parent | upstream: support for requiring user verified FIDO keys in sshd (diff) | |
| download | openssh-642e06d0df983fa2af85126cf4b23440bb2985bf.tar.xz openssh-642e06d0df983fa2af85126cf4b23440bb2985bf.zip | |
upstream: major rework of FIDO token selection logic
When PINs are in use and multiple FIDO tokens are attached to a host, we
cannot just blast requests at all attached tokens with the PIN specified
as this will cause the per-token PIN failure counter to increment. If
this retry counter hits the token's limit (usually 3 attempts), then the
token will lock itself and render all (web and SSH) of its keys invalid.
We don't want this.
So this reworks the key selection logic for the specific case of
multiple keys being attached. When multiple keys are attached and the
operation requires a PIN, then the user must touch the key that they
wish to use first in order to identify it.
This may require multiple touches, but only if there are multiple keys
attached AND (usually) the operation requires a PIN. The usual case of a
single key attached should be unaffected.
Work by Pedro Martelletto; ok myself and markus@
OpenBSD-Commit-ID: 637d3049ced61b7a9ee796914bbc4843d999a864
Diffstat (limited to 'ssh-keygen.c')
| -rw-r--r-- | ssh-keygen.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/ssh-keygen.c b/ssh-keygen.c index 89ef9a143..1d6234c1c 100644 --- a/ssh-keygen.c +++ b/ssh-keygen.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-keygen.c,v 1.416 2020/08/27 01:06:18 djm Exp $ */ +/* $OpenBSD: ssh-keygen.c,v 1.417 2020/08/27 01:07:51 djm Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -3632,6 +3632,11 @@ main(int argc, char **argv) fatal("Too many incorrect PINs"); passphrase = read_passphrase("Enter PIN for " "authenticator: ", RP_ALLOW_STDIN); + if (!quiet) { + printf("You may need to touch your " + "authenticator (again) to authorize " + "key generation.\n"); + } } if (passphrase != NULL) { freezero(passphrase, strlen(passphrase)); |