Checklist
Configuration
Blink 18.6.3
YubiKey 5C NFC, Firmware 5.7.4
Describe the bug
When a passkey is generated by Blink on external hardware such as a YubiKey, and the YubiKey's passkey storage is PIN-protected, Blink requires the PIN for every SSH authentication.
However, when the same key is exported to another computer using ssh-keygen -K, the PIN is only required during the export. Subsequent use of the extracted key no longer requires the PIN.
Expected behavior
I expected the key itself to retain its PIN protection regardless of where it is used. From a security perspective, silently losing the PIN requirement after export is unexpected and, in my opinion, weakens the protection provided by hardware-backed authentication in 2FA scenarios. While the hardware authenticator is still required, the user-verification factor (PIN) is effectively removed without any indication to the user.
Feature request
It would be great if Blink could provide an option to create keys with mandatory user verification, analogous to OpenSSH's ssh-keygen -O verify-required. This would allow users who prefer stronger security guarantees to ensure that every authentication requires PIN (or other user verification), even after the key has been exported and is used on another system.
Checklist
Configuration
Blink 18.6.3
YubiKey 5C NFC, Firmware 5.7.4
Describe the bug
When a passkey is generated by Blink on external hardware such as a YubiKey, and the YubiKey's passkey storage is PIN-protected, Blink requires the PIN for every SSH authentication.
However, when the same key is exported to another computer using ssh-keygen -K, the PIN is only required during the export. Subsequent use of the extracted key no longer requires the PIN.
Expected behavior
I expected the key itself to retain its PIN protection regardless of where it is used. From a security perspective, silently losing the PIN requirement after export is unexpected and, in my opinion, weakens the protection provided by hardware-backed authentication in 2FA scenarios. While the hardware authenticator is still required, the user-verification factor (PIN) is effectively removed without any indication to the user.
Feature request
It would be great if Blink could provide an option to create keys with mandatory user verification, analogous to OpenSSH's ssh-keygen -O verify-required. This would allow users who prefer stronger security guarantees to ensure that every authentication requires PIN (or other user verification), even after the key has been exported and is used on another system.