Add support for sk-ssh-ed25519@openssh.com key type, enabling authentication with FIDO2/U2F hardware security keys (passkeys). SKP256 (sk-ecdsa) not included to keep scope minimal; can be added later
Changes
thrussh-keys:
PublicKey::SKEd25519 variant with application field
Signature::SKEd25519 variant with flags + counter authenticator data
SK public key parsing/serialization (wire format and base64)
SK signature verification: SHA256(application) || flags || counter || SHA256(message)
Add support for
sk-ssh-ed25519@openssh.comkey type, enabling authentication with FIDO2/U2F hardware security keys (passkeys).SKP256(sk-ecdsa) not included to keep scope minimal; can be added laterChanges
thrussh-keys:
PublicKey::SKEd25519variant withapplicationfieldSignature::SKEd25519variant withflags+counterauthenticator dataSHA256(application) || flags || counter || SHA256(message)key_handleandapplicationKeyPair::SKEd25519variant for local FIDO2 signing via hardware tokenctap-hid-fido2::FidoKeyHid::get_assertionthrussh:
sk-ssh-ed25519@openssh.comadded to algorithm negotiation listsNamedandPubKeytrait impls for SK keysflags+counterfrom SK signature blob before verification