2 ms·
SSH supports multiple methods of authentication, including challenge-response authentication, which is specifically designed for the kind of exchange that FIDO2
by ak217 8y ago
SSH supports multiple methods of authentication, including challenge-response authentication, which is specifically designed for the kind of exchange that FIDO2/CTAP uses.
- tialaramex 8y agoBlergh. RFC 4256, which I'd guess is what you're thinking about, aka keyboard-interactive - is completely unsuitable for this purpose and certainly wasn't "specifically designed" for it. In fact RFC 4256 pretty much spells out what it's for, it lets you use PAM to augment your authentication policies by changing what the remote user types into their console. You can add a One Time Password check or whatever. It is full of requirements like "A command line interface (CLI) client SHOULD print the name and instruction (if non-empty), adding newlines" which have nothing whatsoever to do with the actual problem for Security Keys. Of course you could _add_ a new SSH authentication method, but the existing RFC 4256 "challenge-response" approach is completely inappropriate.
- ak217 8y agoGood to know, thanks, I didn't know challenge-response support in sshd was specifically tied to RFC 4256. With that said, I suspect it could be retrofitted for this purpose.