Provide an SSH_SK_PROVIDER for openssh

[arianvp]

Openssh comes with built-in support for security keys through linking against libfido2.

However, they also support loading a SSH_SK_PROVIDER shared library instead (implementing the https://github.com/openssh/openssh-portable/blob/master/sk-api.h functions).

Would be neat if we can provider a small shim that supports this so that openssh can be used with credentialsd instead of libfido2

[iinuwa]

This is an interesting idea. So the goal would be to use FIDO credentials over any transport available to credentialsd for SSH?

I think some alternatives would be:

• integrate credentialsd into libfido2 like Windows Hello currently is
• provide an SSH agent for credentialsd that references FIDO credentials
• add explicit SSH credential support to credentialsd, with the option

(Of course those are not all equivalent: for example, some servers may require -sk keys even if the plain keys are hardware-bound, so just creating any SSH key through credentialsd might not work the same.)

I think that adding libfido2 into credentialsd would probably get us better mileage. But I haven't considered much about SSH credentials, so this is just me thinking out loud.

[arianvp]

Also see https://github.com/tavrez/openssh-sk-winhello

For reference