failed to load resident ssh key(ever since 5.10 version and still exist in 5.12 version),Err code:Unable to load resident keys: device not found #59

New Issue

Closed

opened 2024-09-07 00:21:09 +08:00 by MiniProjectDIY · 6 comments

MiniProjectDIY commented 2024-09-07 00:21:09 +08:00 (Migrated from github.com)

Copy Link

Hi
I'm running 5.12 eddsa (with vendor patch to Yubikey 4/5 OTP+FIDO+CCID )on my pico board,using openssh windows from this repo.
I managed to created resident ssh key and save it to the pico key(pretty sure about it since I see the light in processing mode and If I create a new ssh key with the same name it tells me there is already a key with same name there).

But it never allow me to readout the resident key using ssh-add -K -S internal or ssh-keygen -K.
Using these command under a admin mode powershell(has to run under admin mode since this is a bug for openssh windows version)give me a result like this

ssh-keygen -K -v
Enter PIN for authenticator:
You may need to touch your authenticator to authorize key download.
debug1: find_helper: using "C:\\Program Files\\OpenSSH\\ssh-sk-helper.exe" as helper
debug1: client_converse: helper returned error -60
Unable to load resident keys: device not found

I can see that the led light turned to press to confirm mode,and after I pressed the button,it turned to active mode rather than processing mode.
Also there is something wrong with the hid device driver after I pluged in the pico key.

But Everything else works fine like using the key to login website with webauthn.

It even works when I login ssh with -i option to load the key file from local hard disk like:
ssh root@myserver -v -i .\id_ed25519_sk

I just can't use the ssh-add or ssh-keygen command to dump the key file from pico key to local disk.

I've tried several board like official pico board, waveshare pico zero and some board I made by myself,got the same result.
Could it be the driver issue or something else?

Update:
I just did some more test and confirmed that this issue(ssh key load and yellow exclamation mark in Device Manager) happens since 5.10 version,rollback to 5.8 solves the problem.But 5.8 has some other issues fixed in 5.10 and 5.12 which bother me more.

On the same pc(windows 11 os),using 5.8 version everything seems fine in the device manager,

with 5.10 version:

with 5.12 version:

No difference between eddsa branch or main branch.

Hi I'm running 5.12 eddsa (with vendor patch to Yubikey 4/5 OTP+FIDO+CCID )on my pico board,using openssh windows from[ this repo](https://github.com/PowerShell/Win32-OpenSSH/releases). I managed to created resident ssh key and save it to the pico key(pretty sure about it since I see the light in processing mode and If I create a new ssh key with the same name it tells me there is already a key with same name there). But it never allow me to readout the resident key using `ssh-add -K -S internal` or `ssh-keygen -K`. Using these command under a admin mode powershell(has to run under admin mode since this is a bug for openssh windows version)give me a result like this ``` ssh-keygen -K -v Enter PIN for authenticator: You may need to touch your authenticator to authorize key download. debug1: find_helper: using "C:\\Program Files\\OpenSSH\\ssh-sk-helper.exe" as helper debug1: client_converse: helper returned error -60 Unable to load resident keys: device not found ``` I can see that the led light turned to press to confirm mode,and after I pressed the button,it turned to active mode rather than processing mode. Also there is something wrong with the hid device driver after I pluged in the pico key.  But Everything else works fine like using the key to login website with webauthn. It even works when I login ssh with -i option to load the key file from local hard disk like: `ssh root@myserver -v -i .\id_ed25519_sk` I just can't use the ssh-add or ssh-keygen command to dump the key file from pico key to local disk. I've tried several board like official pico board, waveshare pico zero and some board I made by myself,got the same result. Could it be the driver issue or something else? Update: I just did some more test and confirmed that this issue(ssh key load and yellow exclamation mark in Device Manager) happens since 5.10 version,rollback to 5.8 solves the problem.But 5.8 has some other issues fixed in 5.10 and 5.12 which bother me more. On the same pc(windows 11 os),using **5.8 version everything seems fine in the device manager**, with 5.10 version:  with 5.12 version:  No difference between eddsa branch or main branch.

metabo7000 commented 2024-09-08 17:53:02 +08:00 (Migrated from github.com)

Copy Link

Hi I'm running 5.12 eddsa (with vendor patch to Yubikey 4/5 OTP+FIDO+CCID )on my pico board,using openssh windows from this repo. I managed to created resident ssh key and save it to the pico key(pretty sure about it since I see the light in processing mode and If I create a new ssh key with the same name it tells me there is already a key with same name there).

But it never allow me to readout the resident key using ssh-add -K -S internal or ssh-keygen -K. Using these command under a admin mode powershell(has to run under admin mode since this is a bug for openssh windows version)give me a result like this

ssh-keygen -K -v
Enter PIN for authenticator:
You may need to touch your authenticator to authorize key download.
debug1: find_helper: using "C:\\Program Files\\OpenSSH\\ssh-sk-helper.exe" as helper
debug1: client_converse: helper returned error -60
Unable to load resident keys: device not found

I can see that the led light turned to press to confirm mode,and after I pressed the button,it turned to active mode rather than processing mode. Also there is something wrong with the hid device driver after I pluged in the pico key.

But Everything else works fine like using the key to login website with webauthn.

It even works when I login ssh with -i option to load the key file from local hard disk like: ssh root@myserver -v -i .\id_ed25519_sk

I just can't use the ssh-add or ssh-keygen command to dump the key file from pico key to local disk.

I've tried several board like official pico board, waveshare pico zero and some board I made by myself,got the same result. Could it be the driver issue or something else?

Update: I just did some more test and confirmed that this issue(ssh key load and yellow exclamation mark in Device Manager) happens since 5.10 version,rollback to 5.8 solves the problem.But 5.8 has some other issues fixed in 5.10 and 5.12 which bother me more.

On the same pc(windows 11 os),using 5.8 version everything seems fine in the device manager,

with 5.10 version:

with 5.12 version:

No difference between eddsa branch or main branch.

yubico 5 and neo fido_5.8 firmware works great as it should, Yubico Authenticator and YubiKey Personalization Tool handle it, but fido 5.10 and 5.12 are completely defective, yubico manager programs don't handle them completely error-free either! The developer gives very few answers here on the forum, documentation is incomplete, hms versions are still we will never be able to communicate under Windows/Linux or with the recommended environmental software! tutorial video would help a lot for hsm device!

> Hi I'm running 5.12 eddsa (with vendor patch to Yubikey 4/5 OTP+FIDO+CCID )on my pico board,using openssh windows from[ this repo](https://github.com/PowerShell/Win32-OpenSSH/releases). I managed to created resident ssh key and save it to the pico key(pretty sure about it since I see the light in processing mode and If I create a new ssh key with the same name it tells me there is already a key with same name there). > > But it never allow me to readout the resident key using `ssh-add -K -S internal` or `ssh-keygen -K`. Using these command under a admin mode powershell(has to run under admin mode since this is a bug for openssh windows version)give me a result like this > > ``` > ssh-keygen -K -v > Enter PIN for authenticator: > You may need to touch your authenticator to authorize key download. > debug1: find_helper: using "C:\\Program Files\\OpenSSH\\ssh-sk-helper.exe" as helper > debug1: client_converse: helper returned error -60 > Unable to load resident keys: device not found > ``` > > I can see that the led light turned to press to confirm mode,and after I pressed the button,it turned to active mode rather than processing mode. Also there is something wrong with the hid device driver after I pluged in the pico key.  > > But Everything else works fine like using the key to login website with webauthn. > > It even works when I login ssh with -i option to load the key file from local hard disk like: `ssh root@myserver -v -i .\id_ed25519_sk` > > I just can't use the ssh-add or ssh-keygen command to dump the key file from pico key to local disk. > > I've tried several board like official pico board, waveshare pico zero and some board I made by myself,got the same result. Could it be the driver issue or something else? > > Update: I just did some more test and confirmed that this issue(ssh key load and yellow exclamation mark in Device Manager) happens since 5.10 version,rollback to 5.8 solves the problem.But 5.8 has some other issues fixed in 5.10 and 5.12 which bother me more. > > On the same pc(windows 11 os),using **5.8 version everything seems fine in the device manager**, > > with 5.10 version:  > > with 5.12 version:  > > No difference between eddsa branch or main branch. yubico 5 and neo fido_5.8 firmware works great as it should, Yubico Authenticator and YubiKey Personalization Tool handle it, but fido 5.10 and 5.12 are completely defective, yubico manager programs don't handle them completely error-free either! The developer gives very few answers here on the forum, documentation is incomplete, hms versions are still we will never be able to communicate under Windows/Linux or with the recommended environmental software! tutorial video would help a lot for hsm device!

polhenarejos commented 2024-09-14 02:10:59 +08:00 (Migrated from github.com)

Copy Link

I managed to created resident ssh key and save it to the pico key(pretty sure about it since I see the light in processing mode and If I create a new ssh key with the same name it tells me there is already a key with same name there).

How are you sure it is in the device? How do you generate it?

> I managed to created resident ssh key and save it to the pico key(pretty sure about it since I see the light in processing mode and If I create a new ssh key with the same name it tells me there is already a key with same name there). How are you sure it is in the device? How do you generate it?

polhenarejos commented 2024-09-14 03:05:19 +08:00 (Migrated from github.com)

Copy Link

Fixed in ec612a4.

Fixed in ec612a4.

MiniProjectDIY commented 2024-09-14 06:56:19 +08:00 (Migrated from github.com)

Copy Link

I managed to created resident ssh key and save it to the pico key(pretty sure about it since I see the light in processing mode and If I create a new ssh key with the same name it tells me there is already a key with same name there).

How are you sure it is in the device? How do you generate it?

I use command as below to generate the key(under an admin mode powershell env)
ssh-keygen -t ed25519-sk -O resident -O application=ssh:YourTextHere -O verify-required

I'm sure it is in the device since I generated it with a pico key with 5.8 version and everything works fine,just upgrading a firmware version won't erase the key already exist,right?

Thank you for the fix,I will try to build and verify it later.

> > I managed to created resident ssh key and save it to the pico key(pretty sure about it since I see the light in processing mode and If I create a new ssh key with the same name it tells me there is already a key with same name there). > > How are you sure it is in the device? How do you generate it? I use command as below to generate the key(under an admin mode powershell env) `ssh-keygen -t ed25519-sk -O resident -O application=ssh:YourTextHere -O verify-required` I'm sure it is in the device since I generated it with a pico key with 5.8 version and everything works fine,just upgrading a firmware version won't erase the key already exist,right? Thank you for the fix,I will try to build and verify it later.

MiniProjectDIY commented 2024-09-14 10:05:02 +08:00 (Migrated from github.com)

Copy Link

Fixed in ec612a4.

H,I just compiled the development branch and confirmed that this commit works,can you please merge it into the eddsa branch?

Also I found a problem that I have to use flash_nuke.uf2 file to reset the pico board（which erase everything on the spi flash I think） then reinstall the new firmware.

If I just put it into boot mode and upgrade with the compiled firmware the problem still exist.

I'm not sure whether it's the problem that I upgrade with a non-eddsa firmware on the pico board which was running a eddsa firmware or some other reason.

> Fixed in [ec612a4](https://github.com/polhenarejos/pico-fido/commit/ec612a451da5e8cbee61de866dd273f214e6cd5c). H,I just compiled the development branch and confirmed that this commit works,can you please merge it into the eddsa branch? Also I found a problem that I have to use flash_nuke.uf2 file to reset the pico board（which erase everything on the spi flash I think） then reinstall the new firmware. If I just put it into boot mode and upgrade with the compiled firmware the problem still exist. I'm not sure whether it's the problem that I upgrade with a non-eddsa firmware on the pico board which was running a eddsa firmware or some other reason.

MiniProjectDIY commented 2024-11-05 13:17:11 +08:00 (Migrated from github.com)

Copy Link

Fixed in ec612a4.

Can you please merge this commit to the eddsa branch?Thank you.

> Fixed in [ec612a4](https://github.com/polhenarejos/pico-fido/commit/ec612a451da5e8cbee61de866dd273f214e6cd5c). Can you please merge this commit to the eddsa branch?Thank you.

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

main

development

nightly-development

nightly-main

v7.4

v7.2

v7.0-eddsa

v7.0

v6.6

v6.4-eddsa1

v6.4

v6.2

v6.0-eddsa1

v6.0

v5.12-eddsa1

v5.12

nightly-stable

v5.10

v5.8-eddsa1

v5.8

v5.6-eddsa1

v5.6

v5.4

v3.0

v2.10

v2.8

v2.6

v2.4

v2.2

v2.0

v1.2

v1.0

Labels

Clear labels

bug

Something isn't working

documentation

Improvements or additions to documentation

duplicate

This issue or pull request already exists

enhancement

New feature or request

good first issue

Good for newcomers

help wanted

Extra attention is needed

invalid

This doesn't seem right

question

Further information is requested

wontfix

This will not be worked on

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

dearsky

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dearsky/pico-fido#59