inureyes · Oct 22, 2026 · Oct 22, 2026 · Oct 22, 2026 · Oct 22, 2026 · Oct 22, 2026
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
@@ -863,6 +863,7 @@ but not with themselves; omit the key (plain `#[serial]`) when in doubt.
 - Private key files with passphrase support
 - Password authentication (discouraged in production)
 - Public key authentication preferred
+- FIDO security-key identities (`sk-ssh-ed25519@openssh.com`, `sk-ecdsa-sha2-nistp256@openssh.com`): the default identity list includes `id_ed25519_sk` and `id_ecdsa_sk`. Signing goes through a `SecurityKeyProvider` (`src/ssh/security_key/`, `src/ssh/tokio_client/security_key_signer.rs`): the default is `$SSH_SK_PROVIDER`, an external library implementing OpenSSH's `sk-api.h` is loaded with `dlopen` and called on a blocking thread, and `internal` reports a diagnostic because bssh has no built-in provider. A missing or failing provider declines that identity and authentication continues with the next one. Keys held by an agent sign through the agent and need no provider. Static musl builds cannot `dlopen` and report a diagnostic instead.
 
 #### macOS `UseKeychain`
 
@@ -904,6 +905,7 @@ validates the certificates it is offered:
   and runs the `HOSTNAME` invocation before the DNSSEC and known_hosts checks.
 - Without a matching CA the certified key is checked as a plain host key if
   `HostKeyAlgorithms` permits its plain type.
+- The key or certificate the server sends must have the type the key exchange negotiated (`src/ssh/tokio_client/host_key_type.rs`, mirroring OpenSSH `kex_verify_host_key`), including the `sk-*` types; a mismatch refuses the connection, so a `HostKeyAlgorithms` restriction also limits which trusted key type a server may present.
 - `ServerCheckMethod::NoCheck` still accepts, because there the operator has
   turned host verification off outright.
 

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -75,6 +75,9 @@ hmac = "0.13.0"
 sha2 = "0.11.0"
 hickory-resolver = { version = "0.26.1", features = ["dnssec-ring"] }
 libc = "0.2"
+# sk-api (FIDO security key) middleware libraries are dlopened in process;
+# see src/ssh/security_key for why no ssh-sk-helper style subprocess exists.
+libloading = "0.8"
 ipnetwork = "0.21"
 bcrypt = "0.19"
 # `argon2` 0.5 uses `crypto-common` 0.1.7, which deliberately pins

diff --git a/README.md b/README.md
@@ -602,7 +602,7 @@ See [examples/mpi_exit_code.sh](examples/mpi_exit_code.sh) and [examples/health_
 bssh supports multiple authentication methods:
 
 ### SSH Key Authentication
-- **Default keys**: Automatically tries `~/.ssh/id_ed25519`, `~/.ssh/id_rsa`, `~/.ssh/id_ecdsa`, `~/.ssh/id_dsa`
+- **Default keys**: Automatically tries `~/.ssh/id_ed25519`, `~/.ssh/id_ed25519_sk`, `~/.ssh/id_rsa`, `~/.ssh/id_ecdsa`, `~/.ssh/id_ecdsa_sk`, `~/.ssh/id_dsa` (the `*_sk` FIDO keys need a `SecurityKeyProvider`)
 - **Custom key**: Use `-i` flag to specify a key file
 - **Encrypted keys**: Automatically detects and prompts for passphrase
 

diff --git a/docs/architecture/ssh-client.md b/docs/architecture/ssh-client.md
@@ -15,6 +15,9 @@
 **Tokio Client Module Structure :**
 - `tokio_client/connection.rs` - Connection management (293 lines)
 - `tokio_client/authentication.rs` - Authentication methods (378 lines)
+- `tokio_client/security_key_signer.rs` - russh `Signer` for FIDO `sk-*` identities: resolves `SecurityKeyProvider`, checks the provider before decrypting an `sk-*` key file, calls the provider on a blocking thread (serialized process-wide), prints the touch notice, prompts once for a PIN, and declines a failed signature so authentication continues with the next identity (`authenticate_declinable`)
+- `ssh/security_key/` - provider interface (`SecurityKeyProvider` trait, `$VAR` resolution, `internal`/`none` handling), the `sk-api.h` `dlopen` binding (`external.rs`), and the `sk-*` signature blob encoder (`signature.rs`)
+- `tokio_client/host_key_type.rs` - refuses a server host key or certificate whose type differs from the negotiated host-key algorithm (OpenSSH `kex_verify_host_key`), including `sk-*` types and ECDSA curves
 - `tokio_client/channel_manager.rs` - Channel operations (230 lines)
 - `tokio_client/file_transfer.rs` - SFTP file operations (285 lines)
 

diff --git a/docs/architecture/ssh-config-parser.md b/docs/architecture/ssh-config-parser.md
@@ -207,6 +207,7 @@ bssh supports 40+ SSH configuration directives organized into categories:
 - `ConnectTimeout` - Connection timeout in seconds
 - `ServerAliveInterval` - Keepalive interval
 - `ServerAliveCountMax` - Keepalive retry count
+- `SecurityKeyProvider` - Library implementing OpenSSH's `sk-api.h` for `sk-*` identities, `internal`, `none`, or a `$VAR` reference (default `$SSH_SK_PROVIDER`). Stored verbatim in `security_key_provider`; `-G` prints the raw value and expansion happens in `src/ssh/tokio_client/security_key_signer.rs` when an `sk-*` identity is used.
 - `Compression` - Advertise transport compression to the server (yes/no, default: no). `yes` offers eager `zlib` ahead of `none`; `no`/unset offers only `none`. `zlib@openssh.com` is never advertised because russh's delayed-zlib codec desyncs the flate2 stream a few packets after activation; wiring is in `SshConnectionConfig::to_russh_config` (`src/ssh/tokio_client/connection.rs`).
 
 **Authentication Options:**

diff --git a/docs/man/bssh.1 b/docs/man/bssh.1
@@ -122,7 +122,7 @@ Example: -J jump1@proxy1,jump2@proxy2
 
 .TP
 .BR \-Q " " \fIquery_option\fR
-Query SSH configuration options (cipher, kex, mac, key, protocol-version, help)
+Query SSH configuration options (cipher, cipher-auth, mac, kex, compression, key, key-plain, key-cert, key-sig, protocol-version, help). The key lists include the FIDO types sk-ssh-ed25519@openssh.com and sk-ecdsa-sha2-nistp256@openssh.com in OpenSSH's order; webauthn-sk-ecdsa-sha2-nistp256@openssh.com is not listed because bssh does not verify it.
 
 .TP
 .BR \-4 ", " \-\-ipv4
@@ -1096,6 +1096,13 @@ Special values:
 Example:
 .I IdentityAgent ~/.1password/agent.sock
 
+.TP
+.B SecurityKeyProvider
+Specifies the library used to access FIDO authenticator-hosted keys (sk-ssh-ed25519@openssh.com and sk-ecdsa-sha2-nistp256@openssh.com identity files, as enrolled by ssh-keygen -t ed25519-sk or ecdsa-sk). The value is a path to a shared library implementing OpenSSH's sk-api (for example libsk-libfido2.so), or a name starting with $ that selects an environment variable holding that path. The default is $SSH_SK_PROVIDER; when the variable is unset, or the value is none, sk-* identities are skipped. The value internal (OpenSSH's built-in USB HID provider) is not available in this build and is reported before the next identity is tried. The library is loaded with dlopen(3); statically linked musl builds cannot load it and say so. When a key requires user presence and standard error is a terminal, bssh prints a confirmation notice while waiting for the touch; when the provider asks for a PIN and BatchMode is off, bssh prompts for it once. If signing fails (no device, PIN required in BatchMode, provider error), bssh reports it and continues with the next identity. Keys held by an agent keep signing through the agent.
+.br
+Example:
+.I SecurityKeyProvider /usr/lib/libsk-libfido2.so
+
 .TP
 .B PubkeyAcceptedAlgorithms
 Specifies the signature algorithms that will be used for public key authentication.
@@ -2081,7 +2088,7 @@ Configuration file when XDG_CONFIG_HOME is set
 SSH known hosts file for host key verification
 
 .TP
-.I ~/.ssh/id_ed25519, ~/.ssh/id_rsa, ~/.ssh/id_ecdsa, ~/.ssh/id_dsa
+.I ~/.ssh/id_ed25519, ~/.ssh/id_ed25519_sk, ~/.ssh/id_rsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ecdsa_sk, ~/.ssh/id_dsa
 Default SSH private keys (checked in order of preference). If a key is
 encrypted, bssh will prompt for the passphrase.