wsl2-ssh-pageant VS openssh-sk-winhello

Hey there! So, I've been using WSL2 with a yubikey for gpg, which is pretty sweet. Basically, this setup uses a Unix socket to Windows gpg-agent and pageant (if you're curious, you can find all the details in this GitHub repo: https://github.com/BlackReloaded/wsl2-ssh-pageant). It's been working great for about a month or so, until I recently installed the Windows Store version for WSLg support on Windows 10. But now, my WSL2 isn't talking to the Win gpg-agent anymore. I've searched GitHub for answers, but no luck yet. Figured I'd post here and see if there are others in the same boat or who might have some tips on this pesky socket issue. Thanks!

You should use the latest wsl2-ssh-peagent, which has a new --gpgConfigBasepath option to allow you to specify the .gnupg directory in Windows.

sshCommand = C:/utils/OpenSSH-Win64/ssh.exe

For GPG, the only things I've done is to use gpg-agent and set up a passthrough for gpg-agent to WSL2 for both OpenSSH and GPG via https://github.com/BlackReloaded/wsl2-ssh-pageant/ since I do development both natively on Windows and via WSL2.

Yeah, I've been using a Yubikey for a bit over a year and I'm already a huge fan of the way it works with SSH/Git. It's a bit more of a pain to set up with WSL2 since you need something like https://github.com/BlackReloaded/wsl2-ssh-pageant but it's absolutely worth the setup time.

I use PuTTY's pageant and https://github.com/BlackReloaded/wsl2-ssh-pageant to share keys between environments but you still need to enter your passphrase at power-on. Window's ssh-agent looks like a better solution. No need to re-enter the passphrase and no need to keep the private key around.

For Windows, it seems it's possible[0, see footnote], however there are problems like general incompatibilities [1], and official support status is " We have this in our backlog. At this point it's not prioritized.".

0: https://github.com/tavrez/openssh-sk-winhello

0.footnote: "Windows Hello also supports other types of authenticators like internal TPM device(if they support generating ECDSA or Ed25519 keys, they can be used instead of FIDO/U2F security keys)."

1: https://github.com/tavrez/openssh-sk-winhello/issues

2: https://github.com/PowerShell/Win32-OpenSSH/issues/1804#issu...

Awesome article! Also found this tool (tavrez/OpenSsh-sk-winhello) for windows that lets you do this without admin access

Which is also how they are generated when retrieving them on a new computer via ssh-keygen -K since I used the application=ssh:yubikey_5 flag when first generating them. So something like ssh-keygen -t ed25519-sk -O resident -O application=ssh:yubikey_5c, but because I am on Windows I also had the -w winhello.dll flag (In case anyone stumbles on this question)

This is what i used but YMMV https://github.com/tavrez/openssh-sk-winhello/releases/tag/v2.0.0

> Because AFAIK, (Fido) yubikey support is still missing.

Correct, hopefully Microsoft will provide an updated SSH client soon. It only requires recompiling OpenSSH with the correct flags.

Alternatively, use these build instruction for openssh with FIDO for windows:

https://gist.github.com/martelletto/6a7cf806c6433ac9ce71d66a...

> Using either the PKCS#11 support or the gpg applet requires some extra piece of software

For those wanting to do that, here are some ways:

Using a premade dll:

https://github-wiki-see.page/m/mooltipass/minible/wiki/Setti...

Or with a middleware:

https://github.com/mgbowen/windows-fido-bridge

Using the Hello API:

https://github.com/tavrez/openssh-sk-winhello

Given how many people came with their own ways, I believe there's enough demand for Microsoft to fix that.

My knowledge of WebAuthn is limited but their invocation of the relevant API seems like it should work for fingerprints also.

[1] https://github.com/tavrez/openssh-sk-winhello