[SSHD-1221] Support key constraints when adding a key to an SSH agent

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.7.0
• Fix Version/s: 2.8.0
• Assignee: Thomas Wolf
• Reporter: Thomas Wolf
• Created: 03/Nov/21 21:32
• Updated: 08/Nov/21 17:35
• Resolved: 08/Nov/21 17:35

Description

This is needed for OpenSSH compatibility. OpenSSH documents three constraints:

• confirm - the agent prompts the user before each key use of a key added with this option.
• lifetime - in seconds; the agent automatically removes the key when the time expires.
• generic extensions, of which there is one:
  • sk-provider - path to a middleware library needed for FIDO keys

 The IETF draft also has constraints for keys being added, but of course those are different, and their draft looks incomplete in those sections.

Apache MINA sshd should provide interfaces that enable users to implement adding keys to an agent with arbitrary constraints, and should provide a default implementation compatible with OpenSSH.