openssh-sk-winhello

For Windows, it seems it's possible[0, see footnote], however there are problems like general incompatibilities [1], and official support status is " We have this in our backlog. At this point it's not prioritized.". 0: https://github.com/tavrez/openssh-sk-winhello 0.footnote: "Windows Hello also supports other types of authenticators like internal TPM device(if they support generating ECDSA or Ed25519 keys, they can be used instead of FIDO/U2F security keys)." 1: https://github.com/tavrez/openssh-sk-winhello/issues 2: https://github.com/PowerShell/Win32-OpenSSH/issues/1804#issu...

> Because AFAIK, (Fido) yubikey support is still missing. Correct, hopefully Microsoft will provide an updated SSH client soon. It only requires recompiling OpenSSH with the correct flags. Alternatively, use these build instruction for openssh with FIDO for windows: https://gist.github.com/martelletto/6a7cf806c6433ac9ce71d66a... > Using either the PKCS#11 support or the gpg applet requires some extra piece of software For those wanting to do that, here are some ways: Using a premade dll: https://github-wiki-see.page/m/mooltipass/minible/wiki/Setti... Or with a middleware: https://github.com/mgbowen/windows-fido-bridge Using the Hello API: https://github.com/tavrez/openssh-sk-winhello Given how many people came with their own ways, I believe there's enough demand for Microsoft to fix that.

Does anyone know of the TPM equivalent for this? I found this [1] but when I tried it, the Windows Hello prompt only accepts USB security keys and not the fingerprint sensor in my laptop (already set up for login). My knowledge of WebAuthn is limited but their invocation of the relevant API seems like it should work for fingerprints also. [1] https://github.com/tavrez/openssh-sk-winhello