ssh: enforce user presence verification for security keys

Previously the library did not verify the "User Presence" (UP) bit in signatures generated by FIDO/U2F security keys (sk-ecdsa-sha2-nistp256@openssh.com and sk-ssh-ed25519@openssh.com). This allowed signatures without physical interaction to be accepted if the underlying hardware produced them, deviating from the default secure behavior expected by the FIDO standards and OpenSSH. skECDSAPublicKey.Verify and skEd25519PublicKey.Verify now enforce the user-presence bit (0x01, constant flagUserPresence) by default. Signatures whose flags byte has UP clear fail with the sentinel errSKMissingUserPresence. The server public-key authentication path honors the OpenSSH "no-touch-required" extension as an opt-out. noTouchAllowed reports true when the extension is present either in the Permissions returned by PublicKeyCallback (authorized_keys-level opt-out) or in the certificate's own Extensions (CA-level opt-out); in that case skKeyWithoutUP is used to derive a clone of the SK public key (and, for certificates, a clone of the wrapping Certificate whose inner Key is the cloned SK key) whose Verify accepts UP-clear signatures. The originals are never mutated, so a per-session opt-out cannot leak across authentication attempts or connections. Matching OpenSSH, the opt-out is read only from Extensions, never from CriticalOptions. skKeyWithoutUP is iterative and unwraps at most one level of *Certificate: the SSH cert format forbids Certificate.Key from being another Certificate (parseCert rejects it) but callers can still construct such a value directly in Go, so a recursive descent would be driven to unbounded depth by malformed or cyclic input. Any such pathological *Certificate is returned unchanged. CertChecker.CheckCert applies skKeyWithoutUP unconditionally to the certificate's CA key before verifying the CA signature, matching OpenSSH, which calls sshkey_verify with detailsp==NULL in sshkey.c:cert_parse and never extracts or enforces UP/UV flags on CA signatures. The UP bit on a CA signature reflects the CA operator's presence at cert-issuance time, which has no bearing on whether the user being authenticated is present now, so enforcing it here would only break interop with certificates issued by non-interactive SK CAs without a corresponding security benefit. The skKeyWithoutUP call is a no-op for non-SK CA keys (the common case). This change breaks backward compatibility for clients or keys that generate user-authentication signatures without the User Presence flag set. Previously those signatures were accepted by the server. They will now be rejected with "ssh: signature missing required user presence flag" unless the "no-touch-required" extension is explicitly granted to the session by the server callbacks, or carried by the user certificate. This issue was found during a security audit by NCC Group Cryptography Services, sponsored by Teleport. Fixes golang/go#79566 Fixes CVE-2026-39831 Change-Id: I74b6de3bb6a2d7a0f34d7fa36bbbbf06f0b3fc6b Reviewed-on: https://go-review.googlesource.com/c/crypto/+/781662 Reviewed-by: Neal Patel <nealpatel@google.com> Reviewed-by: Roland Shoemaker <roland@golang.org> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-05-21 17:03:20 -07:00
parent 9c2cd33e8d
commit b61cf853a8
6 changed files with 651 additions and 12 deletions
@@ -6,9 +6,14 @@ package ssh

 import (
 	"bytes"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/sha256"
 	"errors"
 	"fmt"
 	"io"
+	"math/big"
 	"net"
 	"reflect"
 	"strings"
@@ -904,3 +909,126 @@ func (*markerConn) RemoteAddr() net.Addr { return nil }
 func (*markerConn) SetDeadline(t time.Time) error      { return nil }
 func (*markerConn) SetReadDeadline(t time.Time) error  { return nil }
 func (*markerConn) SetWriteDeadline(t time.Time) error { return nil }
+
+// skTestSigner is a Signer that produces SK-ECDSA signatures over
+// user-auth data, simulating a FIDO/U2F authenticator. The flags
+// byte (UP and other bits) is caller-controlled so tests can exercise
+// the server's user-presence enforcement and its opt-out paths. This
+// is test-only: the real Signer is hardware-backed.
+type skTestSigner struct {
+	priv        *ecdsa.PrivateKey
+	pub         PublicKey
+	flags       byte
+	application string
+}
+
+func (s *skTestSigner) PublicKey() PublicKey { return s.pub }
+
+func (s *skTestSigner) Sign(r io.Reader, data []byte) (*Signature, error) {
+	h := sha256.New()
+	h.Write([]byte(s.application))
+	appDigest := h.Sum(nil)
+	h.Reset()
+	h.Write(data)
+	dataDigest := h.Sum(nil)
+	var counter uint32 = 1
+	blob := struct {
+		ApplicationDigest []byte `ssh:"rest"`
+		Flags             byte
+		Counter           uint32
+		MessageDigest     []byte `ssh:"rest"`
+	}{appDigest, s.flags, counter, dataDigest}
+	h.Reset()
+	h.Write(Marshal(blob))
+	digest := h.Sum(nil)
+	x, y, err := ecdsa.Sign(r, s.priv, digest)
+	if err != nil {
+		return nil, err
+	}
+	return &Signature{
+		Format: KeyAlgoSKECDSA256,
+		Blob:   Marshal(struct{ R, S *big.Int }{x, y}),
+		Rest: Marshal(struct {
+			Flags   byte
+			Counter uint32
+		}{s.flags, counter}),
+	}, nil
+}
+
+// TestServerAuthSKUserPresence drives the full userAuthLoop with an SK
+// public-key client and verifies the server's wiring of the UP check
+// and its two opt-out paths: the per-key Permissions.Extensions route
+// and (via cert) the cert-level route. It also confirms that non-SK
+// clients are unaffected by the new code path.
+func TestServerAuthSKUserPresence(t *testing.T) {
+	userKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	skPub := &skECDSAPublicKey{application: "ssh:", PublicKey: userKey.PublicKey}
+
+	runAuth := func(t *testing.T, signer Signer, perms *Permissions) error {
+		t.Helper()
+		c1, c2, err := netPipe()
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer c1.Close()
+		defer c2.Close()
+
+		serverConf := &ServerConfig{
+			PublicKeyCallback: func(ConnMetadata, PublicKey) (*Permissions, error) {
+				return perms, nil
+			},
+		}
+		serverConf.AddHostKey(testSigners["ecdsa"])
+
+		serverErr := make(chan error, 1)
+		go func() {
+			_, _, _, err := NewServerConn(c1, serverConf)
+			serverErr <- err
+		}()
+
+		clientConf := &ClientConfig{
+			User:            "user",
+			Auth:            []AuthMethod{PublicKeys(signer)},
+			HostKeyCallback: InsecureIgnoreHostKey(),
+		}
+		_, _, _, clientErr := NewClientConn(c2, "", clientConf)
+		<-serverErr
+		return clientErr
+	}
+
+	optOut := &Permissions{Extensions: map[string]string{noTouchRequiredExtension: ""}}
+
+	t.Run("UP=1, default perms accepts", func(t *testing.T) {
+		s := &skTestSigner{priv: userKey, pub: skPub, flags: flagUserPresence, application: "ssh:"}
+		if err := runAuth(t, s, nil); err != nil {
+			t.Errorf("expected auth to succeed: %v", err)
+		}
+	})
+	t.Run("UP=0, default perms rejects", func(t *testing.T) {
+		s := &skTestSigner{priv: userKey, pub: skPub, flags: 0, application: "ssh:"}
+		if err := runAuth(t, s, nil); err == nil {
+			t.Error("expected auth to fail with UP=0")
+		}
+	})
+	t.Run("UP=0, perms opt-out accepts", func(t *testing.T) {
+		s := &skTestSigner{priv: userKey, pub: skPub, flags: 0, application: "ssh:"}
+		if err := runAuth(t, s, optOut); err != nil {
+			t.Errorf("expected auth to succeed with opt-out: %v", err)
+		}
+	})
+	t.Run("UP=0, perms CriticalOptions does NOT opt out", func(t *testing.T) {
+		s := &skTestSigner{priv: userKey, pub: skPub, flags: 0, application: "ssh:"}
+		critOnly := &Permissions{CriticalOptions: map[string]string{noTouchRequiredExtension: ""}}
+		if err := runAuth(t, s, critOnly); err == nil {
+			t.Error("no-touch-required in CriticalOptions must not waive UP")
+		}
+	})
+	t.Run("non-SK RSA signer unaffected", func(t *testing.T) {
+		if err := runAuth(t, testSigners["rsa"], nil); err != nil {
+			t.Errorf("plain RSA auth must still work: %v", err)
+		}
+	})
+}