Question

开放式SSH >=8.2允许使用ID2认证,而sh星指挥则允许在FID2标记(如Yubikey)上建立居民钥匙。在主要一代人中,还有产出证明数据的选择,可以选择进行书面测试。 E.g.

ssh-keygen -t ed25519-sk -O resident -O write-attestation=id_ed25519-Yubikey.attest -O application=ssh:id_ed25519-Yubikey -f id_ed25519-Yubikey

两个问题:

开放SSH创建的证明文件的形式是什么?
能否利用证明数据核实国际DO2号标书产生的对应公用钥匙,因此只能作为Yubikey/FIDO2号标线上的常住钥匙居住?

Answer 1

格式是

Attestation information is useful for out-of-band key and certificate
registration workflows, e.g. proving to a CA that a key is backed
by trusted hardware before it will issue a certificate. To support this
case, OpenSSH optionally allows retaining the attestation information
at the time of key generation. It will take the following format:

    string      "ssh-sk-attest-v01"
    string      attestation certificate
    string      enrollment signature
    string      authenticator data (CBOR encoded)
    uint32      reserved flags
    string      reserved string

我不认为,今天可以由一个开放式服务器直接使用。但是,你可以结合一份短片证明书,仅向证明在某种假肢装置上产生的钥匙颁发证书。

友情链接