Package com.hierynomus.sshj.userauth.fido

Interface SecurityKeySigner

public interface SecurityKeySigner
Service provider interface for signing with an OpenSSH FIDO/U2F security key (an sk-ecdsa-sha2-nistp256@openssh.com or sk-ssh-ed25519@openssh.com key).

sshj cannot talk to a hardware authenticator on its own: there is no pure-Java USB-HID / CTAP stack. The embedding application supplies one of these to bridge to the hardware - for example via libfido2, a platform WebAuthn API, or by delegating to a running ssh-agent. Given the challenge to sign, the application string and the credential (key handle), an implementation makes the authenticator produce an assertion and returns the device's signature plus the flags and counter that the authenticator reported.

Note: when a ssh-agent holds the security key, you do not need this interface at all - the agent returns a fully formed SSH signature. Use the com.hierynomus.sshj.userauth.agent support instead. This SPI is for applications that drive the authenticator themselves.

See Also:

  • Method Details

    • sign

      SecurityKeySignatureData sign(SecurityKeySigningRequest request) throws IOException
      Produce a FIDO assertion over the given challenge.
      Parameters:
      request - the challenge, application and credential to sign with
      Returns:
      the authenticator's response (signature, flags and counter)
      Throws:
      IOException - if the authenticator could not be reached or declined to sign