Resident SK keys lose verify-required on download

Savely Krasovsky via openssh-unix-dev <[email protected]> Sat, 25 Jul 2026 20:40:50 +0200
Newsgroups gmane.network.openssh.devel
Message-ID <[email protected]>
Hi,

Resident credentials created with verify-required may lose the
SSH_SK_USER_VERIFICATION_REQD flag when downloaded using ssh-keygen -K
or ssh-add -K from authenticators with built-in UV.

The credential retains FIDO_CRED_PROT_UV_REQUIRED, but the downloaded
OpenSSH key gets flags 0x21 instead of 0x25.

I have opened a small patch with hardware validation here:

https://github.com/openssh/openssh-portable/pull/701

I used Token2 Bio3 to verify, but this also an issue on YubiKey Bio,
but I don't have it on hands rn.

Thanks,
Savely Krasovsky