PowerShell / PowerShell/Win32-OpenSSH
"ssh-keygen -K" returns "invalid format" when restoring FIDO2 ssh keys on a new machine
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 8.3k
- Forks
- 819
- PR merge metrics
- No merged PRs in 30d
Description
Prerequisites
- Write a descriptive title.
- Make sure you are able to repro it on the latest version
- Search the existing issues.
Steps to reproduce
I have an SSH key stored on my FIDO2 security key (Yubikey), and a new work laptop to set up.
I'm running ssh-keygen -K to regenerate the key handle file, but the command fails with Unable to load resident keys: invalid format after submitting my FIDO2 PIN.
Unfortunately the logs don't give enough information to debug this further so I'm a bit stuck. Any help would be appreciated.
Expected behavior
PS C:\Users\nikn\.ssh> ssh-keygen -K
Enter PIN for authenticator:
You may need to touch your authenticator to authorize key download.
<LOAD_RESIDENT_KEYS>
Actual behavior
PS C:\Users\nikn\.ssh> ssh-keygen -K -vvv
Enter PIN for authenticator:
You may need to touch your authenticator to authorize key download.
debug1: find_helper: using "C:\\WINDOWS\\System32\\OpenSSH\\ssh-sk-helper.exe" as helper
debug3: Creating process with CREATE_NO_WINDOW
debug3: spawning "C:\\WINDOWS\\System32\\OpenSSH\\ssh-sk-helper.exe" as subprocess
debug3: start_helper: started pid=25496
debug3: ssh_msg_send: type 5
debug3: ssh_msg_recv entering
debug1: client_converse: helper returned error -4
debug3: reap_helper: pid=25496
Unable to load resident keys: invalid format
PS C:\Users\nikn\.ssh> ssh -V
OpenSSH_for_Windows_9.5p2, LibreSSL 3.8.2
Error details
Environment data
PS C:\Users\nikn\.ssh> $PSVersionTable
Name Value
---- -----
PSVersion 5.1.26100.7462
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.26100.7462
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
Version
OpenSSH_for_Windows_9.5p2
Visuals
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the ssh-keygen -K resident-key restoration path and the ssh-sk-helper.exe interaction shown in the verbose log. Compare the helper's returned error -4 with the invalid format result on OpenSSH_for_Windows 9.5p2. Done means reproducing the failure, identifying its cause, and confirming that resident FIDO2 keys can be restored successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- authentication, cli, operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100