Struggling to use the "assert" example: FIDO_ERR_NO_CREDENTIALS #863
-
|
I am trying to use the assert example, but it fails with I tried this: build/examples/assert -t eddsa -a ~/.ssh/id_ed25519_sk -P "<my FIDO pin>" /path/to/id_ed25519_sk.pub.pem /dev/hidraw7Reading from the sources, I assumed that:
echo "-----BEGIN PUBLIC KEY-----" > id_ed25519_sk.pub.pem
openssl base64 -in ~/.ssh/id_ed25519_sk.pub >> id_ed25519_sk.pub.pem
echo "-----END PUBLIC KEY-----" >> id_ed25519_sk.pub.pemThe example README also says that [-a cred_id] can be omitted for the resident key, but I get the same error when I omit it. What am I doing wrong? 😕 |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 6 replies
-
|
Hi, Are you trying to use an SSH credential with our examples? That will not work without further modifications due to several reasons:
If you extract the corresponding parts from the SSH key files, and recreate the expected input format, you could probably get a successful assertion using What are you trying to accomplish though? If you're just trying to figure out how our API works, I recommend looking at and using |
Beta Was this translation helpful? Give feedback.
-
|
Thanks a lot, that's already helpful!
Sure I can give more context 😊. For the learning experience, I am playing with libgit2 and trying to use my Yubikeys for SSH. At some point I get a git_credential_sign_cb called, that looks like this: My understanding is that I need to "sign" the challenge ( So my plan was to first get the
I guess this might be hard too: I have been struggling to convert the public key to PEM (it works with a "normal"/non-sk public key, but with the Yubikey public key I can't seem to make the conversion with tools like openssl). |
Beta Was this translation helpful? Give feedback.
-
|
Having limited experience with libgit2, I unfortunately don't know what that callback expects. If you really want to try to get an assertion with our tooling instead of our library functions first, and really want to experiment with OpenSSH keys directly, here's an example of crudely extracting information out of the SSH private key file: Let's have a look at the raw contents: We only really need to extract the private key bits here (which also contain the public key), cross-referencing We can see that
This can be used in conjunction with fido2-assert to get an assertion as well as verifying the resulting signature: This is certainly not very convenient, but it "works". 🙂 I'd highly recommend learning each of the protocols separately before attempting to combine them though... 😉 Footnotes |
Beta Was this translation helpful? Give feedback.
-
|
Thank you so much, that gives me a lot of pointers to move forward! I'll come back when I have news, but I believe this is enough to unblock me for a while!
I'm all for that, but to be honest I am finding it a bit hard, maybe because I don't know where to find the documentation I need. For libgit2, I end up reading the source code and trying a lot of things. But in this case, I get "some challenge bytes" and need to respond with "some signature", which depend on the protocol being used and that is not implemented in libgit2 (which means I can't find it in the sources). Knowing that it is SSH, I read about the ssh1 authentication where the client "combines" the session id with the challenge, hashes that with MD5 and returns the result, but never found a definition of what "combines" means (I looked for RFCs and didn't find that information). It feels like I should read the source code of OpenSSH to learn how it's done, but that's steeper than reading RFCs 😅. Of course, ssh1 authentication is older than ssh2, so I tried to find how ssh2 does it. I just can't seem to find where it is defined 🙈. Finally, in my case I am interested in FIDO2. I find a lot of high-level documentation that to me sounds like "the REST API gives you an RP, you pass that to your Javascript library in the field called 'RP' and that's it". Except that for SSH, it's different: it feels like the RP is just useless because we get an SSH fingerprint of the server and can check that instead 🤔. And I don't have a high-level API that just gives me everything the way I need it, as proven e.g. by the need to manually convert keys. Some conversions seem relatively easy, but when I need something in X509 format, it gets overwhelming: should I learn X509 to write my own tool to convert stuff? That's a whole project in its own... Even if the C code takes a "pubkeydata" parameter, the documentation usually doesn't say in which format. Unless someone like you kindly links to e.g. this and shows how it relates to the raw content with an example, I find it extremely difficult to learn. All that to say, I feel like it's one of those examples where reading the specifications becomes a lot easier when you already know pretty well how it works and where to look 😇. |
Beta Was this translation helpful? Give feedback.
-
|
Glad to hear it helped unblock you and happy to help with libfido2 specifics (for OpenSSH and libgit2, I think I'll have to refer you to their support channels). As a final note, I can add that libfido2 is more closely modeled after the CTAP2 specification rather than WebAuthn, so it may help to have a look at that as well. 🙂 |
Beta Was this translation helpful? Give feedback.
-
|
I made it work with my Yubikey that has a resident key ( 🎉 ), but somehow it doesn't work for the other that doesn't have a resident key. Though I'm using both for SSH everyday, so it should work even if it doesn't have a resident key, right? EDIT: ooooh, actually I think it doesn't work because my private key is encrypted with a passphrase on disk. I should decrypt it first! |
Beta Was this translation helpful? Give feedback.
-
The above example is using a non-resident key.
That would make it easier. 🙂 |
Beta Was this translation helpful? Give feedback.
Having limited experience with libgit2, I unfortunately don't know what that callback expects.
If you really want to try to get an assertion with our tooling instead of our library functions first, and really want to experiment with OpenSSH keys directly, here's an example of crudely extracting information out of the SSH private key file:
Let's have a look at the raw contents: