SSH _sk keys cause out of memory error

[kademahler]

Checklist

• [ yes] Using latest version on the App Store
• [ yes] Read the docs
• [ yes] Searched for existing GitHub issues

Configuration

iPad OS 16.1
16.0.1.616 app

Describe the bug

SK keys cause out of memory error when use is attempted.
Server is running openSSH 8.9p1 on Ubuntu Server

Out of memory error

Prompt for hardware auth

[carloscabanero]

That usually happens if the signature process is cancelled at any point.

Is that passkeys or secure hardware keys? If it is hw keys, what brand and model is it? Was the prompt shown? Did you follow it or cancelled it at one point?

[kademahler]

That usually happens if the signature process is cancelled at any point.

Is that passkeys or secure hardware keys? If it is hw keys, what brand and model is it? Was the prompt shown? Did you follow it or cancelled it at one point?

This happened for me on both a Yubikeys FIPS 5C and with passkeys. The screenshot above was a passkey attempt. No prompt was shown on either, so I didn't cancel anything.

[kademahler]

I’m completely unable to use any _sk key right now with this error, which is my only use case for this app. It never prompts for anything, it goes straight to the error shown.

[kademahler]

Update: this was the only key I had but if I manually define the key I’m using it worked for the passkey, despite it being the default name. That being said I’m still getting the same issue with my security key ssh key when I import it (ed2219_sk key)

[carloscabanero]

Ok, thanks for the update. I’m not sure if there is a bug here, trying to summarize what you are experiencing and I will try to replicate from my side:

• You created both a Passkey and a Secure Key. None were working at the start. Now thePasskey is working when you select it explicitly at the Host.
• Is the Secure Key “tap request screen” showing when you do the same? Or does it fail straight away? Can you send us a screenshot or part of the configuration of the host so we can see it?
• What do you mean by “when I import it “ed2219_sk key”? Is that a key from a different client that you are trying to import to Blink? Is that a FIDO secure key that you are trying to import to Blink? Is it just a key that you are creating inside Blink?
• You are also saying that you only have one key. Is that the Passkey? Are you trying to sign with the Secure Key, but maybe Blink does not have a reference to it anymore inside the Keys section?

Yubikeys are quite straightforward and there should be no issues 🤔. Let me know and I’m still thinking what may be going on.

[kademahler]

No worries, it could be that I'm misunderstanding something here. I was also at a mobile phone so sorry for the lack of clarification. At a computer now, and I'll answer your questions more fully. Also apologies, I'm not sure where ed2219 came from. I meant ed25519, and probably just remembered the numbers wrong.

Here is the full list of steps I took.

1. I first imported an ed25519 key linked to my Yubikey called "id_ed25519_sk" which was created elsewhere (my laptop) for blink, and it is a FIDO secure key. That key is linked to my yubikey. I'm noticing now on that one the error is "authFailed(methods: [SSH.AuthAgent])". when I try to use it. I know the key works as I tested it on my laptop. On blink It never prompted for my yubi key, it just fails with that error.

2. Because that didn't work I deleted that key.

3. I then created a passkey (thus only having one key, but attempting two). The key is named id_ecdsa_sk so I assumed it would be used by default as shown in the screenshot (using "ssh user@host"). It never prompted for passkey authentication, but gave me the out of memory error.

4. I'm now noticing if I specifically use "ssh -i id_ecdsa_sk user@host" in blink, then it works for the passkey, and properly prompts for passkey authentication. If I just use "ssh user@host" in blink, it gives me the out of memory error. It still continues to do so now.

When I was trying each of these options, I only had the one key in the key list at a time, as I didn't want to it to default to the wrong one. That's where I left off in the last messages.

Now that I have a passkey working, I'm keeping that there, but I would prefer to use the ed25519 key I created. As far as I can see blink doesn't let me generate an ed25519_sk key, only edcsa and I would prefer to use ed25519, as that's what my other devices use and it is generally more recommended now from what I understand.

I'm happy to answer more questions. It's a key not selecting properly by default is weird, so if I'm doing something wrong let me know. Same for the imported ed25519_sk key.

[carloscabanero]

Ok! I I think I see now what you tried to do. A few notes:

• We currently do not support importing sk keys that were generated somewhere else other than Blink. The format that we implement, and how we were able to support hardware keys on both iPad and iPhone, is because we implemented WebAuthn keys. The protocol is a bit too new for now, and unfortunately we have no way to import the key format yet.
• You should be able to use that Yubikey by creating a new Security Key inside Blink instead of trying to “import” anything. Another limitation as stated in the manual is that we don’t synchronize the keys yet between your devices. But you can create another key on each of them as you need.
• We do support Secure Enclave keys as well, which are similar to your sk keys in the Yubikey.
• At the moment, the WebAuthn implementation internally uses ECDSA keys instead of Ed25519. Don’t overthink it, the goal of a key is just to get you to the other side as securely as possible, and both are considered secure atm.

[kademahler]

Perfect. I don’t know if ED25519 key support for security keys is in the works but I’ll be one to vote for it. This was super helpful though. For now I’ll keep using the ECDSA keys though, I just prefer the open trust model of those curves vs the NIST curves. There are other reasons as well but that’s the main one for me.

That being said I know I’m a minority in this one, and I’m grateful for the support and understanding I’ve gotten here. Thank you so much!

[carloscabanero]

Opening a Discussion from the content on this thread:

#1875
Please please leave your comments there. I need to know that there is real interest to solve this. Otherwise we won't know if it may be worth our time.