PowerShell / PowerShell/Win32-OpenSSH

Cannot create secure-key (ed25519-sk) via windows-hello (pin)

Open
#2,413 11 comments 2 reactions 1 assignee View on GitHub

@tgauth is already working on this.

Since Dec 8, 2025.

Investigate
Dominant language
No language data
Stars
8.3k
Forks
819
PR merge metrics
No merged PRs in 30d

Description

Prerequisites
  • Write a descriptive title.
  • Make sure you are able to repro it on the latest version
  • Search the existing issues.
Steps to reproduce

I'm trying to setup a secure-key (ed25519-sk) in my machines TPM, which should be protected via windows-hello (PIN).

Windows prompts, that the key will be stored on the device.
When continueing, another prompt appears, telling me that I should insert a security-device.

ssh-keygen -t ed25519-sk
Generating public/private ed25519-sk key pair.
You may need to touch your authenticator to authorize key generation.

Image Image

Interestingly enough, doing the same with

ssh-keygen -t ecdsa-sk
DOES prompt for a PIN, but then just also displays another prompt to "insert a security-device"

Expected behavior
> ssh-keygen -t ed25519-sk
> Generating public/private ed25519-sk key pair.
> You may need to touch your authenticator to authorize key generation.
- prompt to "save your passkey" appears
- upon "continue", prompted to "enter you pin"
- when entered, key gets created and stored in TPM
Actual behavior
> ssh-keygen -t ed25519-sk
> Generating public/private ed25519-sk key pair.
> You may need to touch your authenticator to authorize key generation.

- prompt to "save your passkey" appears
- upon "continue", "Insert your security key into the USB port" appears
Error details

Environment data
Name                           Value
----                           -----
PSVersion                      7.5.4
PSEdition                      Core
GitCommitId                    7.5.4
OS                             Microsoft Windows 10.0.26200
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0
Version

OpenSSH_for_Windows_10.0p2 Win32-OpenSSH-GitHub, LibreSSL 4.2.0

Visuals

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.