pjht/fido_ssh_maker
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Correct flag byte contents

Browse Source
This commit is contained in:
pjht 2023-08-16 09:36:05 -05:00
parent a2587c2a4f
commit 55112f5869
Signed by: pjht
GPG Key ID: 7B5F6AFBEC7EE78E
3 changed files with 19 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Cargo.lock generated
View File

@ -489,6 +489,7 @@ name = "fido_ssh_maker"
version = "0.1.0"
dependencies = [
"anyhow",
"bitflags",
"clap",
"ctap-hid-fido2",
"rpassword",

1
Cargo.toml
View File

@ -7,6 +7,7 @@ edition = "2021"
[dependencies]
anyhow = "1.0.72"
bitflags = "2.4.0"
clap = { version = "4.3.21", features = ["derive"] }
ctap-hid-fido2 = "3.5.0"
rpassword = "7.2.0"

25
src/main.rs
View File

@ -1,18 +1,29 @@
use std::{
fs::Permissions,
os::unix::prelude::PermissionsExt,
path::{Path, PathBuf}, fmt::Display, io::Write,
path::{Path, PathBuf}, fmt::Display,
};
use anyhow::anyhow;
use bitflags::bitflags;
use clap::{Parser, ValueEnum};
use ctap_hid_fido2::{
fidokey::{CredentialSupportedKeyType, MakeCredentialArgsBuilder, CredentialExtension, credential_management::credential_management_params::CredentialProtectionPolicy},
fidokey::{CredentialSupportedKeyType, MakeCredentialArgsBuilder},
verifier, FidoKeyHidFactory, LibCfg,
};
use ssh_encoding::{Decode, Encode, LineEnding};
use ssh_key::{private, PrivateKey};
bitflags! {
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
struct SshSkFlags: u8 {
const UserPresenceRequired = 0x01;
const UserVerificationRequired = 0x4;
const ForceOperation = 0x10;
const ResidentKey = 0x20;
}
}
/// Generate FIDO-backed SSH keys
#[derive(Parser, Debug)]
#[command(author, version, about, long_about = None, arg_required_else_help = true)]
@ -91,13 +102,11 @@ fn main() -> anyhow::Result<()> {
let make_credential_args = if device_has_pin {
MakeCredentialArgsBuilder::new("ssh:", &challenge)
.pin(&pin)
.extensions(&[CredentialExtension::CredProtect(Some(CredentialProtectionPolicy::UserVerificationOptionalWithCredentialIdList))])
.key_type(args.key_type.into())
.build()
} else {
MakeCredentialArgsBuilder::new("ssh:", &challenge)
.without_pin_and_uv()
.extensions(&[CredentialExtension::CredProtect(Some(CredentialProtectionPolicy::UserVerificationOptionalWithCredentialIdList))])
.key_type(args.key_type.into())
.build()
};
@ -117,11 +126,9 @@ fn main() -> anyhow::Result<()> {
.der
.encode(&mut privkey_bytes)?;
"ssh:".encode(&mut privkey_bytes)?;
let flags = (attestation.flags_user_present_result as u8)
| (attestation.flags_user_verified_result as u8) << 2
| (attestation.flags_attested_credential_data_included as u8) << 6
| (attestation.flags_extension_data_included as u8) << 7;
privkey_bytes.push(flags);
let mut flags = SshSkFlags::UserPresenceRequired;
flags.set(SshSkFlags::UserVerificationRequired, args.user_verify);
privkey_bytes.push(flags.bits());
verify_result.credential_id.encode(&mut privkey_bytes)?;
"".encode(&mut privkey_bytes)?;
let privkey = match args.key_type {