tavrez/openssh-sk-winhello

user_id behavior mismatch with OpenSSH

carlreinke opened this issue · 1 comments

wchar_t lUserId[32] = L"SSH User";
if (strcmp(user_id, "") && (convert_byte_string(user_id, strlen(user_id) + 1, lUserId) <= 0))
{
skdebug(__func__, "convert_string user_id failed");
goto out;
}
WEBAUTHN_USER_ENTITY_INFORMATION userInfo = {WEBAUTHN_USER_ENTITY_INFORMATION_CURRENT_VERSION, strlen(user_id) + 1, user_id, lUserId, NULL, lUserId};

This doesn't match OpenSSH but not for the reasons mentioned in the README.

OpenSSH always uses 32 bytes for user_id. I.e., WEBAUTHN_USER_ENTITY_INFORMATION.cbId should always be 32 and not be based on strlen. If the user didn't specify anything, user_id will contain 32 zero bytes.

https://github.com/openssh/openssh-portable/blob/V_8_9_P1/sk-usbhid.c#L839

Thanks for pointing this, I'll fix it with the next version which has the support for OpenSSH 8.9