CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/09/15 02:28:26
Modified files:
usr.bin/ssh : sk-usbhid.c
Log message:
sk-usbhid: preserve UV requirement for resident keys
When loading resident credentials, derive SSH_SK_USER_VERIFICATION_REQD
directly from the credential's credProtect policy.
The previous code only preserved the flag when the authenticator did not
report the uv capability. As a result, UV_REQUIRED credentials downloaded
from authenticators with built-in UV were saved with flags 0x21 instead
of 0x25.
Do not make preservation of the credential policy depend on the
authenticator's current UV capability. Keep compatibility with libfido2
versions without fido_cred_prot().
GHPR701 from Savely Krasovsky
