sk-api: separate flags used for FIDO signature verification from sk-api flags

Open martelletto opened this issue 3 years ago • 2 comments

Use separate flags to reduce the risk of future confusion/conflict between WebAuthn/FIDO and sk-api flags (which are similar in concept, but serve a fundamentally different purpose).

Apr 09 '22 13:04 martelletto

Good idea, but I think keeping the existing flags with the same values is a recipe for future confusion. IMO we should renumber the SSH_SK_USER_*_REQD flags at the same time to make sure we have caught all the cases

Apr 29 '22 03:04 djmdjm

If I'm not mistaken, we would need compatibility bits in sshkey_private_deserialize() to be able to load keys that were serialized with the current SSH_SK_USER_*_REQD values. IMHO that's not worth the complexity. Makes sense?

Apr 29 '22 10:04 martelletto