libssh2\_userauth\_publickey\_sk(3) libssh2 libssh2\_userauth\_publickey\_sk(3)

# [NAME](#NAME)

libssh2\_userauth\_publickey\_sk - authenticate a session with a FIDO2 authenticator

# [SYNOPSIS](#SYNOPSIS)

```
#include <libssh2.h>
int
libssh2_userauth_publickey_sk(LIBSSH2_SESSION *session,


                              const char *username,


                              size_t username_len,


                              const unsigned char *publickeydata,


                              size_t publickeydata_len,


                              const char *privatekeydata,


                              size_t privatekeydata_len,


                              const char *passphrase,


                              LIBSSH2_USERAUTH_SK_SIGN_FUNC((*sign_callback)),


                              void **abstract);
```

# [CALLBACK](#CALLBACK)

```
#define LIBSSH2_SK_PRESENCE_REQUIRED     0x01
#define LIBSSH2_SK_VERIFICATION_REQUIRED 0x04
typedef struct _LIBSSH2_SK_SIG_INFO {


    uint8_t flags;


    uint32_t counter;


    unsigned char *sig_r;


    size_t sig_r_len;


    unsigned char *sig_s;


    size_t sig_s_len;
} LIBSSH2_SK_SIG_INFO;
int name(LIBSSH2_SESSION *session, LIBSSH2_SK_SIG_INFO *sig_info,


         const unsigned char *data, size_t data_len, int algorithm,


         uint8_t flags, const char *application,


         const unsigned char *key_handle, size_t handle_len,


         void **abstract);
```

# [DESCRIPTION](#DESCRIPTION)

*session* - Session instance as returned by [**libssh2\_session\_init\_ex(3)**](/man/os/libssh2/libssh2_session_init_ex.3)

*username* - Name of user to attempt authentication for.

*username\_len* - Length of username parameter.

*publickeydata* - Buffer containing the contents of a public key file. If NULL, the public key will be extracted from the privatekeydata. When using certificate authentication, this buffer should contain the public certificate data.

*publickeydata\_len* - Length of public key data.

*privatekeydata* - Buffer containing the contents of a private key file.

*privatekeydata\_len* - Length of private key data.

*passphrase* - Passphrase to use when decoding private key file.

*sign\_callback* - Callback to communicate with FIDO2 authenticator.

*abstract* - User-provided data to pass to callback.

Attempt FIDO2 authentication. using either the sk-ssh-ed25519@openssh.com or sk-ecdsa-sha2-nistp256@openssh.com key exchange algorithms.

This function is only supported when libssh2 is backed by OpenSSL.

# [CALLBACK DESCRIPTION](#CALLBACK_DESCRIPTION)

*session* - Session instance as returned by [**libssh2\_session\_init\_ex(3)**](/man/os/libssh2/libssh2_session_init_ex.3)

*sig\_info* - Filled in by the callback with the signature and accompanying information from the authenticator.

*data* - The data to sign.

*data\_len* - The length of the data parameter.

*algorithm* - The signing algorithm to use. Possible values are LIBSSH2\_HOSTKEY\_TYPE\_ED25519 and LIBSSH2\_HOSTKEY\_TYPE\_ECDSA\_256.

*flags* - A bitmask specifying options for the authenticator. When LIBSSH2\_SK\_PRESENCE\_REQUIRED is set, the authenticator requires a touch. When LIBSSH2\_SK\_VERIFICATION\_REQUIRED is set, the authenticator requires a PIN. Many servers and authenticators do not work properly when LIBSSH2\_SK\_PRESENCE\_REQUIRED is not set.

*application* - A user-defined string to use as the RP name for the authenticator. Usually "ssh:".

*key\_handle* - The key handle to use for the authenticator's allow list.

*handle\_len* - The length of the key\_handle parameter.

*abstract* - User-defined data. When a PIN is required, use this to pass in the PIN, or a function pointer to retrieve the PIN.

The *sign\_callback* is responsible for communicating with the hardware authenticator to generate a signature. On success, the signature information must be placed in the \`*sig\_info* sig\_info parameter and the callback must return 0. On failure, it should return a negative number.

The fields of the LIBSSH2\_SK\_SIG\_INFO are as follows.

*flags* - A bitmask specifying options for the authenticator. This should be read from the authenticator and not merely copied from the flags parameter to the callback.

*counter* - A value returned from the authenticator.

*sig\_r* - For Ed25519 signatures, this contains the entire signature, as returned directly from the authenticator. For ECDSA signatures, this contains the r component of the signature in a big-endian binary representation. For both algorithms, use LIBSSH2\_ALLOC to allocate memory. It will be freed by the caller.

*sig\_r\_len* - The length of the sig\_r parameter.

*sig\_s* - For ECDSA signatures, this contains the s component of the signature in a big-endian binary representation. Use LIBSSH2\_ALLOC to allocate memory. It will be freed by the caller. For Ed25519 signatures, set this to NULL.

*sig\_s\_len* - The length of the sig\_s parameter.

# [RETURN VALUE](#RETURN_VALUE)

Return 0 on success or negative on failure. It returns LIBSSH2\_ERROR\_EAGAIN when it would otherwise block. While LIBSSH2\_ERROR\_EAGAIN is a negative number, it is not really a failure per se.

# [ERRORS](#ERRORS)

Some of the errors this function may return include:

*LIBSSH2\_ERROR\_ALLOC* - An internal memory allocation call failed.

*LIBSSH2\_ERROR\_SOCKET\_SEND* - Unable to send data on socket.

*LIBSSH2\_ERROR\_AUTHENTICATION\_FAILED* - failed, invalid username/key.

# [AVAILABILITY](#AVAILABILITY)

Added in libssh2 1.10.0

# [SEE ALSO](#SEE_ALSO)

[**libssh2\_session\_init\_ex(3)**](/man/os/libssh2/libssh2_session_init_ex.3)

1 Jun 2022 libssh2

---

Document: libssh2_userauth_publickey_sk(3) from libssh2 1.11.1-r10 (Chainguard OS)
Source: https://github.com/libssh2/libssh2.git