Module security_key 

Security key (FIDO2) PINs for ssh runs that have no terminal.

OpenSSH asks for a key’s PIN through askpass. A background run answers it from a PIN typed in the TUI, carried in environment variables for that one run. A wrong PIN costs an attempt on the key, so every run that carried PINs records a refusal. askpass reads that record before it hands the PIN out again.

Structs

PinPrompt

The parts of OpenSSH’s Enter PIN for <type> key <path>: prompt.

RefusalScan

Passes ssh’s stderr through and records a refusal of a key the run carried a PIN for the moment its line arrives. A jump host that refused the PIN is then on record before the target asks for it.

SecurityKeyPin

A PIN typed for one key file.

SecurityKeyRun

The PINs one ssh run may hand out, plus the flow that asks for a missing one. Runs without a flow (containers, snippets) only reuse PINs.

SignFailure

A security key file ssh failed to sign with.

Enums

PinFlow

A flow that can ask for a missing PIN and run again with it.

RefusalReason

Why a security key did not sign.

Constants

PIN_MAX_BYTES

Longest PIN CTAP2 accepts, in bytes.

PIN_MIN_CHARS

Shortest PIN CTAP2 accepts. A shorter one can never be right and would still cost an attempt on the key.

Statics

NO_SECURITY_KEY

A run that carries no PIN and asks for none.

Functions

clear_refusal

Forget a refusal, because the user typed a new PIN for the key.

note_refusal

Record that the key refused. askpass hands out no PIN for it until a new one is typed.

parse_pin_prompt

Recognize the PIN prompt ssh shows for a FIDO2 key file. Anchored at the start: a keyboard-interactive prompt begins with (user@host) and the agent’s own prompt names a fingerprint, so neither matches.

parse_sign_failure

Read one sign_and_send_pubkey: signing failed for <type> "<path>": <why> line. Only security key files count. A key held by an agent is the agent’s business.

refusal_for

Why the key refused the PIN purple last handed out for it, if it did.

sign_failures

Every security key signing failure in an ssh run’s stderr.

ssh_version_allows_pins

True when ssh -V names an OpenSSH that cannot pass a server prompt off as a PIN prompt. Unknown versions count as too old.

take_handed_out_keys

Take the key paths whose PIN went out to a run for alias.

take_pin_request

Take the key path a run of flow for alias asked a PIN for.