Arch Linux

If you use -w /usr/lib/libsk-libfido2.so do you get 'Provider "/usr/lib/libsk-libfido2.so" implements unsupported version 0x00020000 (supported: 0x00040000)'?
If you rebuild the package passing --with-security-key-builtin to configure does ssh-keygen then function as expected?

This does not appear to be a packaging problem since U2F is correctly enabled and built at compile time. Also I have virtually no knowledge on how this new feature is supposed to work. I suggest you consult upsteam's documentation as to how U2F should be used. And if it works differently in your experience than the documentation says it should, report this upstream. Cheers.

@loqs
I had ran: ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_sk -w /usr/lib/libfido2.so
Generating public/private ecdsa-sk key pair.
You may need to touch your authenticator to authorize key generation.
Provider "/usr/lib/libfido2.so" dlsym(sk_api_version) failed: /usr/lib/libfido2.so: undefined symbol: sk_api_version
Key enrollment failed: invalid format

but the output of that is:
ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_sk -w /usr/lib/libsk-libfido2.so
Generating public/private ecdsa-sk key pair.
You may need to touch your authenticator to authorize key generation.
Provider "/usr/lib/libsk-libfido2.so" implements unsupported version 0x00020000 (supported: 0x00040000)
Key enrollment failed: invalid format

@vesath
I wasn't sure what the problem was, nor if it was openssh at fault or the support libs
part of why i filed the bug was cause the upstream changelog implied it was 'simple'

This is a packaging problem. Even though libfido2 provides /usr/lib/libsk-libfido2.so, the middleware has been moved to openssh. That was the whole point of the "new fido2" support in openssh, it already existed out of tree but it has now been upstreamed.

Since we are packaging openssh portable, support needs to be manually enabled with --with-security-key-builtin. This is all described in the changelog[1], if anyone bothered to read it.

The attached patch fixes the issue.

In the patch I made libfido2 an optional dependency. When it is not present and we try to generate an ecdsa-sk key, the output is rather ugly but it should be fine.
```
Generating public/private ecdsa-sk key pair.
You may need to touch your authenticator to authorize key generation.
/usr/lib/ssh/ssh-sk-helper: error while loading shared libraries: libfido2.so.1: cannot open shared object file: No such file or directory
ssh_msg_recv: read header: Connection reset by peer
client_converse: receive: unexpected internal error
reap_helper: helper exited with non-zero exit status
Key enrollment failed: unexpected internal error
```

[1] https://www.openssh.com/txt/release-8.2

Thanks Filipe.