joostd

import logging
import os
import secrets
from flask import Flask, request, jsonify, send_from_directory
from fido2.server import Fido2Server
from fido2.webauthn import (
    PublicKeyCredentialRpEntity,
    PublicKeyCredentialUserEntity,
    ResidentKeyRequirement,
)

joostd

Use TouchID as an SSH key on macOS

on macOS, an ssh-keychain SecurityKeyProvider is available that supports touchID.

TL;DR

The gist of this gist is:

$ sc_auth create-ctk-identity -l SSH -k p-256-ne -t bio -N username -E user@example.org

joostd

# symmetric_key_gcm.py
#
# AES-GCM extension for the python-yubihsm SymmetricKey class.
#
# The YubiHSM 2 has no native GCM command, so this module builds GCM from
# the two primitives the device does expose:
#
#   ENCRYPT_ECB  – used to derive H (GHASH subkey) and to generate the
#                  CTR keystream blocks that encrypt/decrypt the payload.
#   ENCRYPT_ECB  – also used to encrypt the J0 counter block for the tag.

joostd

"""
Register a resident FIDO credential, using USB
Insert a FIDO2 security key in a USB port, and run with:
	ykman script register.py
"""

from fido2.hid import CtapHidDevice
from fido2.ctap2 import Ctap2, ClientPin
from fido2.utils import sha256, hmac_sha256
from secrets import token_bytes

joostd

FROM ubuntu:24.04
USER root
ENV YUBIHSM_PKCS11_CONF="/opt/yubihsm.conf"
WORKDIR /opt
COPY <<EOF yubihsm.conf
connector=http://host.docker.internal:12345
EOF
COPY <<EOF openssl.conf
HOME = .
openssl_conf = openssl_init

joostd

#!/bin/bash

# Generate a Certificate Signing Request (CSR) for an asymmetric key stored in a YubiHSM 2

# Usage:
# ./gencsr.sh <id> <cn>
#
# where <id> is the object ID of the asymmetric key,
# and <cn> is the Common Name of the subject DN in the generated CSR.

joostd

#!/bin/bash

# extend PATH with location of yubihsm-parse-attestation tool
PATH=$PATH:~/go/bin

# check for installed tools
command -v curl >/dev/null 2>&1 \
  || { echo >&2 "please install curl - see https://github.com/curl/curl"; exit 1; }
command -v openssl >/dev/null 2>&1 \
  || { echo >&2 "please install openssl - see https://github.com/openssl/openssl"; exit 1; }

joostd

FROM ubuntu:22.04
ARG user
RUN apt-get update && apt-get install -y openssh-server
RUN mkdir /var/run/sshd
EXPOSE 22
RUN useradd -ms /bin/bash "$user"
COPY id_userca.pub /etc/ssh/user_ca.pub
RUN echo "TrustedUserCAKeys /etc/ssh/user_ca.pub" >> /etc/ssh/sshd_config
CMD ["/usr/sbin/sshd", "-D"]

joostd

#include <assert.h>
#include <dlfcn.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <pkcs11y.h>

/*
 * Generate an RSA key in slot 9a of a YubiKey

joostd

# generate and wrap target key on YubiHSM (firmware 2.4), unwrap using OpenSSL 3.3.1.
# Wrapping Algorithm = RSA_AES_KEY_WRAP_SHA256 (OAEP Padding - SHA256 digest + 256 bit AES-KWP)

HSM=yhusb://
TARGET_KEYID=0x1234
WRAP_KEYID=0xabcd
yubihsm="./yubihsm-shell -C $HSM -p password"

# generate target key
$yubihsm --action generate-asymmetric-key --object-id $TARGET_KEYID --domain 1 --capabilities exportable-under-wrap -A ecp256