[Question] theoretical passwordless login impl.

[ToxicMushroom]

Situation:

• Password-less methods like yubikeys etc have their own unique keys. A backup yubikey has a different second key. (see fido2 hmac-secret for how to get deterministic keys out)
• Users have a backup-password in-case they do not have their yubikey with them.

For login there currently exists a yubico provided pam module which handles multiple keys and delegates to pam_unix for password login.
However that module doesn't emit the user-password when unlocking with a yubikey, since it doesn't store it.

Problems:

• No single password during login -> no keyring unlock during certain flows.
• Current keyring prompters ask for a password, I doubt they are extendible like PAM?

The first thing that comes to mind for me when needing a shared secret is SOPS, but that seems to be aimed at ssh or age keys, not arbitrary ones. Another option is to simply encrypt the shared secret with each key. Keys can hopefully be distinguished by id or method.
I believe would need to solve that shared secret issue outside of oo7, since oo7 seems to already have been written for the single password model.

Question:
If I were to implement a proof of concept for passwordless with oo7.
I suppose I would need to:

1. write my own pam-module (to support passwordless methods and to extract the shared key, update on passwd change)
2. create a 3rd prompter in the server to talk to custom prompter client.
3. create a prompter client (to support passwordless methods and to extract the shared key)

Is what I described the intended path to support passwordless methods?

[bilelmoussaoui]

That would need an extension of the prompting mechanism, but give it a try and we shall see? :)

[bilelmoussaoui]

we also need to figure out the case for gpg encrypted keyrings... probably the same thing +/-

[ToxicMushroom]

we also need to figure out the case for gpg encrypted keyrings... probably the same thing +/-

Thanks, I did not know of gpg encrypted keyrings yet :p

[bilelmoussaoui]

Basically the file backend in oo7 expects a secret that we derive a key from. In those cases where you already have a key, then we could skip the key derivation and just use that. That would require some changes in oo7:: file but i don't expect it to be too much work. You would then have to wire that up in the server side on top of the secret based bits.