PowerShell / PowerShell/Win32-OpenSSH

unexpected "key enrollment failed: invalid format"

Open
#2,231 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Area-ssh-keygen Issue-Bug
Dominant language
No language data
Stars
8.3k
Forks
819
PR merge metrics
No merged PRs in 30d

Description

Prerequisites
  • Write a descriptive title.
  • Make sure you are able to repro it on the latest version
  • Search the existing issues.
Steps to reproduce

update open-ssh to last version on windows uisng:
Start-Process -NoNewWindow msiexec.exe -ArgumentList "/i <full_path_to>\OpenSSH-Win64-v9.4.0.msi ADDLOCAL=Client ADD_PATH=1" -Wait
restart powershell
ssh-keygen -t ed25519-sk -f $env:USERPROFILE\.ssh\id_ed25519_sk

Expected behavior
key should be generated after requesting to touch the yubikey
Actual behavior
Generating public/private ed25519-sk key pair.
You may need to touch your authenticator to authorize key generation.
Key enrollment failed: invalid format

this prompt is received without even requesting to touch the key



### Error details

_No response_

### Environment data

```PowerShell
Name                           Value
----                           -----
PSVersion                      5.1.22621.2506
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.22621.2506
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
Version

OpenSSH_for_Windows_9.5p1, LibreSSL 3.8.2

Visuals

image

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the failure with the PowerShell ssh-keygen -t ed25519-sk command after installing OpenSSH_for_Windows_9.5p1, using the reported YubiKey setup. Trace the ssh-keygen security-key enrollment path and compare the invalid-format result with the expected touch prompt; done means an ed25519-sk key is generated successfully after requesting authenticator interaction.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, powershell
Domain
authentication, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.