[FEATURE] Implement FIDO2 support for SSH authentication

[d-hain]

Is your feature request related to a problem? Please describe.

I'd like to import my FIDO2 key for SSH authentication.

Describe the solution you'd like

When importing an SSH key, allow for importing FIDO2 keys (instead of only PGP keys).

Edited by @valasiadis

---

Describe the bug

During initial setup when trying to clone using a ssh git link and importing a private key (which was generated using a smartcard (YubiKey 5C NFC)) it just hangs on "Running Git operation..." and fails with a timeout (ETIMEDOUT).

Steps to reproduce

Steps to reproduce the behavior: (I am describing everything, even if i assume it's gonna be irrelevant)

1. Build the latest version of this repo using ./gradlew assembleDebug
2. Import a GPG Key
3. Set my Git Identity and enable Git Commit Signing
4. Put in the ssh git url. In the form of git@github.com:<username>/<repository>
5. Choose "Public Key" and "Import SSH Key"
6. Import my Yubikey private SSH Key
7. Click on "Clone"
8. It hangs on "Running Git operation..." and fails with a timeout.

Expected behavior

It prompts me to tap my Yubikey to my phone to access my FIDO2 SSH Key which i just imported.

Screenshots

No response

Device information

• Device: Google Pixel 9 Pro XL
• OS: GrapheneOS based on Android 17 (Build Number: 2026080501)
• App version: built from the latest commit (c33ee21)

Additional context

I wanted to try this fork of APS, because I just setup my new Yubikey and wanted to try out if it worked with it, but I stumped upon this error before being able to try out the GPG decryption itself.

I'll gladly help debug this, as I really need this to work with this app, as I don't want to move away from using pass at all.
If there's anything I should test please tell me 🙏

[czchen]

I also have the same issue in 2.1.0-SNAPSHOT with the following steps.

Steps to reproduce

1. In step 1 The key that encrypts them, Click + and then Set up NFC smartcard to setup my YubiKey 5 NFC.
2. In step 2 Your Git identity, provide username and email.
3. In step 3 Where the store lives, provide Repository URL, and select Public-key as Authentication method. Now Clone button is gray out, and I cannot click it, despite having authentication key in YubiKey 5 NFC.

Expected behavior

It shall provide a way to select authentication in YubiKey 5 NFC.

Device information

• Device: Google Pixel 9 Pro XL
• OS: Official Android 17
• App version: 2.1.0-SNAPSHOT

Additional context

The YubiKey can be used to clone/encrypt/decrypt in legacy version, so key is configured correctly.

[valasiadis]

Hey, and sorry for the late reply. Unfortunately, GitHub didn't notify me about the new issue. But we'll get this sorted out :)

@d-hain Give me a sec, I'm trying to reproduce

@czchen your problem is a different one. Clone is grayed out because you didn't select the key. You need to tap the "Select a PGP key" and select the key you want to use. But you're completely right, that's not as intuitively designed as I'd like to have it. The reason for this is that some people use different keys for SSH authentication and encryption/decryption.

[valasiadis]

@d-hain Quick question: you use a separate SSH authentication key (that you import from a file) and an encryption key on the Yubikey/smartcard?

[d-hain]

Yes.
I have a FIDO2 SSH Key on the Yubikey which i import in the cloning step and a GPG Key (also on the Yubikey) which I use to en/decrypt my pass store with.

[valasiadis]

Your SSH key is FIDO2 and on the Yubikey? Okay, that actually makes it complicated. Importing those is not possible right now, and implementing it would be a completely new feature. Until now, the scope actually was getting PGP smartcards running and FIDO2 goes beyond that. This is not something I can realise in a couple of hours or even days, and I don't have a lot of time right now, I'll convert this issue into a feature request for now. Though before implementing this, I'd like to harden the core features of this fork (including supporting USB as an alternative to NFC).

Would this also be a feature you'd be willing to merge, @agrahn?

[d-hain]

I still have a private key file which I import, just the actual private key material is on the Yubikey. (as far as I understand this, i am pretty new to this sorry)

So cloning currently only works with a PGP Key?

[valasiadis]

I still have a private key file which I import, just the actual private key material is on the Yubikey. (as far as I understand this, i am pretty new to this sorry)

So cloning currently only works with a PGP Key?

yes and no. you can also import your private key file in APS as well (Import SSH key) OR use a PGP key for SSH authentication. Both works. Using a PGP key for SSH authentication works via SSH agent forwarding (the SSH agent forwards the request to the GPG agent, which asks the Yubikey to decrypt the challenge the server sent to authenticate). This is kind of the standard way for handling SSH authentication, although the newer concept of authenticating via FIDO2 is the way recommended by GitHub, GitLab etc. I suggest maybe trying PGP authentication or to just import the SSH private key as an intermediate solution for your problem.

Edit: the main advantage of using a PGP as an SSH authentication key is being able to use the same cryptographic keypair for everything.

[agrahn]

@valasiadis I still need time to review the code. Currently I am absorbed with improving passkey support, but then I will look into your hw key contribution.

[d-hain]

I suggest maybe trying PGP authentication

I tried that just now, but it also fails:

I added my GPG Key (and its corresponding ssh-rsa public key) to my GitHub and i tried this in the App:

• Authentication Method: Public-key -> Select a PGP Key
• Checked that the generated SSH Key was the same which I added to GitHub (it was correct)

but i still get a timeout after ~30s of "Running git operation..."

[valasiadis]

@valasiadis I still need time to review the code. Currently I am absorbed with improving passkey support, but then I will look into your hw key contribution.

This is actually not exactly what I meant. I'd just like to know if this, if I were to implement the FIDO2 SSH authentication support, would be something you'd be generally open to have upstream?

[valasiadis]

I suggest maybe trying PGP authentication

I tried that just now, but it also fails:

I added my GPG Key (and its corresponding ssh-rsa public key) to my GitHub and i tried this in the App:

* `Authentication Method: Public-key` -> `Select a PGP Key`

* Checked that the generated SSH Key was the same which I added to GitHub (it was correct)

but i still get a timeout after ~30s of "Running git operation..."

Hm, that's weird. You imported the key via NFC? And it's the same key? Does the app prompt for a PIN entry? Does it ask you to present the key?

[d-hain]

Yes I imported via NFC.
previously it didn't prompt for PIN entry, but i reinstalled the app now and i am getting to the "OpenPGP card PIN" promt.

i now put in the PIN (100% correct I checked like 10 times). It then asks to "Present you OpenPGP smartcard." and fails telling me the PIN was wrong.
I reset my PIN 2 times now, it is definitely correct 😭