Support for SSH keys secured with security keys

[Volodymyr Lantsov]

Starting from OpenSSH 8.2, SSH keys support an integration with physical security keys (FIDO2 / U2F). There are 2 new SSH key types introduced: "ed25519-sk" and "ecdsa-sk". What this actually means is that you need to have a hardware security key inserted into your USB port and a button on the security key physically pressed in order to use the SSH key.

Currently, Bitbucket does NOT support those keys however OpenSSH 8.2 was introduced back in February 2020.

I'd like to ask Bitbucket staff to consider adding the support for security keys.

I'm leaving some details below.

Example of command to generate a SK-secured SSH key (PowerShell):

ssh-keygen -t ed25519-sk -O resident -O verify-required -O user=personal -C "Personal key (SK)" -f $env:USERPROFILE\.ssh\id_personal_sk

Meaning of some parameters:

-O resident means that a generated key will be stored on the security key itself.

-O verify-required means that you need to verify the security key presence every time we try to use SSH key.

-O user=personal means that a key will be scoped to a user named 'personal'. You can define different names to store multiple SSH keys simultaneously on the same security key.

How final public key looks like:

sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIOMCvBwsYCZPt1HIHAMZzC0zsCXb7t933kAudU8CP7FBAAAABHNzaDo= Personal key (SK)

Thank you for your time!

[Theodora Boudale · Accepted solution]

Hi Volodymyr,

Thank you for the feedback. We have a feature request in our issue tracker:

• https://jira.atlassian.com/browse/BCLOUD-20297

I suggest adding your vote to that feature request (by selecting the Vote for this issue link) as the number of votes helps the product managers better understand the demand for features. You are more than welcome to leave feedback, and you can also add yourself as a watcher (by selecting the Start watching this issue link) if you'd like to be notified via email on updates.

Implementation of features is done as per our policy here and any updates will be posted in the feature request.

Kind regards,
Theodora

[manji2k]

Hi,

is it planned to have this support for bitbucket.org as well?  I have the same problem, generated a ssh key with the ed25519-sk extension and the key gets rejected as invalid by bitbucket.

[Theodora Boudale]

Hi,

The feature request I shared in my previous answer, https://jira.atlassian.com/browse/BCLOUD-20297, is for Bitbucket Cloud (bitbucket.org).

This is not supported at the moment in Bitbucket Cloud. when there is an update, it is going to be posted in the feature request.

Kind regards,
Theodora