Feature Request: Import Existing FIDO2 Resident Keys

[bitcrshr]

Hello!

I was poking around with the app and found that I wasn't able to import an existing FIDO2 resident key from my Yubikey, and I think that would be a great feature.

I have a resident key on each of my 3 Yubikeys and I try hard to keep it at that so I can have a portable SSH identity (or three, rather) without much hassle.

On a normal machine I am able to either discover those via ssh-add -K or just copy around the stub file that looks something like:

# ~/.ssh/id_ed25519_sk_yk_5c_nano.pub
sk-ssh-ed25519@openssh.com <public key> yk-5c-nano

The answer may well be that this is simply not possible on iOS/iPadOS but figured it was worth mentioning.

Thank you!

[kitknox]

Unfortunately the APIs are very restricted in this area and not at all designed for this use case. It is almost by accident that we are able to get this to work at all in the webauthn-sk-ecdsa-sha2-nistp256@openssh.com mode. Even if we generate the key we cannot even use ED25519 in FIDO2 mode. Only in PIV slots which bypass all of the Apple APIs which are WebAuthN specific. Apple really wasn’t thinking about this use case at all when they created the current APIs. Hey maybe we get some positive news at WWDC next month?

The Yubico side has honestly been very disappointing as well. I’m still awaiting even an ETA from their developer support on when they can review rootshell for MFI approval. We had to remove part of our YubiKey support in order to not require MFI approval which requires them to put our bundle identifier in their allow list which Apple will then approve during app review. This resulted in further delays in our initial AppStore approval. One of the support engineers there has done their best to try to help, but it’s been months now. Are there really that many apps trying to integrate?

[bitcrshr]

Ah dang, yeah I figured the platform APIs would probably be in the way. Not surprised about Yubico either, they seem to be very B2B focused these days and not too concerned about the consumer/dev side.

Fingers crossed for WWDC though!

Thanks for taking the time, and I'm looking forward to seeing how this project evolves!

[kitknox]

@bitcrshr Looks like this wasn't our year in terms of any news at WWDC around this.

[bitcrshr]

I know! Maybe next year. Thanks again!