diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2020-01-28 08:01:34 +0000 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2020-01-29 18:52:55 +1100 |
| commit | 24c0f752adf9021277a7b0a84931bb5fe48ea379 (patch) | |
| tree | cd1b9474e73ad7647b4ad88775365e7430d3fe64 /ssh-keygen.1 | |
| parent | 156bef36f93a48212383235bb8e3d71eaf2b2777 (diff) | |
| download | openssh-git-24c0f752adf9021277a7b0a84931bb5fe48ea379.tar.gz | |
upstream: changes to support FIDO attestation
Allow writing to disk the attestation certificate that is generated by
the FIDO token at key enrollment time. These certificates may be used
by an out-of-band workflow to prove that a particular key is held in
trustworthy hardware.
Allow passing in a challenge that will be sent to the card during
key enrollment. These are needed to build an attestation workflow
that resists replay attacks.
ok markus@
OpenBSD-Commit-ID: 457dc3c3d689ba39eed328f0817ed9b91a5f78f6
Diffstat (limited to 'ssh-keygen.1')
| -rw-r--r-- | ssh-keygen.1 | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/ssh-keygen.1 b/ssh-keygen.1 index b4a87392..c6a97618 100644 --- a/ssh-keygen.1 +++ b/ssh-keygen.1 @@ -1,4 +1,4 @@ -.\" $OpenBSD: ssh-keygen.1,v 1.196 2020/01/23 23:31:52 djm Exp $ +.\" $OpenBSD: ssh-keygen.1,v 1.197 2020/01/28 08:01:34 djm Exp $ .\" .\" Author: Tatu Ylonen <ylo@cs.hut.fi> .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -35,7 +35,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd $Mdocdate: January 23 2020 $ +.Dd $Mdocdate: January 28 2020 $ .Dt SSH-KEYGEN 1 .Os .Sh NAME @@ -483,6 +483,14 @@ Note that .Xr sshd 8 will refuse such signatures by default, unless overridden via an authorized_keys option. +.It Cm challenge=path +Specifies a path to a challenge string that will be passed to the +FIDO token during key generation. +The challenge string is optional, but may be used as part of an out-of-band +protocol for key enrollment. +If no +.Cm challenge +is specified, a random challenge is used. .It Cm resident Indicate that the key should be stored on the FIDO authenticator itself. Resident keys may be supported on FIDO2 tokens and typically require that @@ -494,6 +502,10 @@ A username to be associated with a resident key, overriding the empty default username. Specifying a username may be useful when generating multiple resident keys for the same application name. +.It Cm write-attestation=path +May be used at key generation time to record the attestation certificate +returned from FIDO tokens during key generation. +By default this information is discarded. .El .Pp The |