PowerShell / PowerShell/Win32-OpenSSH

"ssh-keygen -K" returns "invalid format" when restoring FIDO2 ssh keys on a new machine

Open
#2,427 4 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Area-ssh-keygen Investigate
Dominant language
No language data
Stars
8.3k
Forks
819
PR merge metrics
No merged PRs in 30d

Description

Prerequisites
  • Write a descriptive title.
  • Make sure you are able to repro it on the latest version
  • Search the existing issues.
Steps to reproduce

I have an SSH key stored on my FIDO2 security key (Yubikey), and a new work laptop to set up.
I'm running ssh-keygen -K to regenerate the key handle file, but the command fails with Unable to load resident keys: invalid format after submitting my FIDO2 PIN.

Unfortunately the logs don't give enough information to debug this further so I'm a bit stuck. Any help would be appreciated.

Expected behavior
PS C:\Users\nikn\.ssh> ssh-keygen -K
Enter PIN for authenticator:
You may need to touch your authenticator to authorize key download.
<LOAD_RESIDENT_KEYS>
Actual behavior
PS C:\Users\nikn\.ssh> ssh-keygen -K -vvv
Enter PIN for authenticator:
You may need to touch your authenticator to authorize key download.
debug1: find_helper: using "C:\\WINDOWS\\System32\\OpenSSH\\ssh-sk-helper.exe" as helper
debug3: Creating process with CREATE_NO_WINDOW
debug3: spawning "C:\\WINDOWS\\System32\\OpenSSH\\ssh-sk-helper.exe" as subprocess
debug3: start_helper: started pid=25496
debug3: ssh_msg_send: type 5
debug3: ssh_msg_recv entering
debug1: client_converse: helper returned error -4
debug3: reap_helper: pid=25496
Unable to load resident keys: invalid format

PS C:\Users\nikn\.ssh> ssh -V
OpenSSH_for_Windows_9.5p2, LibreSSL 3.8.2
Error details

Environment data
PS C:\Users\nikn\.ssh> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      5.1.26100.7462
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.26100.7462
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
Version

OpenSSH_for_Windows_9.5p2

Visuals

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the ssh-keygen -K resident-key restoration path and the ssh-sk-helper.exe interaction shown in the verbose log. Compare the helper's returned error -4 with the invalid format result on OpenSSH_for_Windows 9.5p2. Done means reproducing the failure, identifying its cause, and confirming that resident FIDO2 keys can be restored successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
authentication, cli, operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.