Seems to be not fully functional

as soon as I set "set service ssh hostkey-algorithm 'sk-ssh-ed25519@openssh.com'", the SSH server rejects all SSH connections.

tom$ ssh user@host.name
Connection closed by 2a01:000:0:00::000 port 22

Also the system/login config part seems to not jet support the sk-ssh-ed25519 option.

user@host.name# set system login user vyos authentication public-keys KEY type 
Possible completions:
   ssh-dss              None
   ssh-rsa              None
   ecdsa-sha2-nistp256  None
   ecdsa-sha2-nistp384  None
   ssh-ed25519          None
   ecdsa-sha2-nistp521

Tested with the version "VyOS 1.4-rolling-202210280218"

@Arc771
Could you provide an example of how to generate the required keys? We will test it.
But It should be a separate task

This task allows support by sshd/ssh server/server_config
But key management is a different task

I reopened T4750

First of all, sorry for my late reply. I was on vacation and stayed away from IT for a bit ;)

@Viacheslav
I'm not sure how familiar you are with these kinds of SSH keys.
You need a FIDO Key to generate/use these SSH keys. Like for example a YubiKey.

The current Linux versions all come with OpenSSH that already supports it.
On MacOS you need to update the OpenSSH version via eg. brew, because the one that comes with MacOS is a bit outdated.
No Idea how it is on Windows but as Windows itself has pretty good FIDO support, it should probably also work there.

to generate these SSH keys on Linux (in my example Debian 10) you just need to install the fido lib and you done.

apt install libfido2-dev
ssh-keygen -t ed25519-sk -C "comment"

Assuming you have set up and connected your FIDO Key.

Some useful information are:
https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.u2f
https://forums.lawrencesystems.com/t/ssh-with-yubikey-fido-u2f-authentication/13024
https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html

On the server side, they're nothing special to do. As all current Linux versions support -sk keys out of the box, you just need to throw the public key into your authorised_keys file.

sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1N......

That's it.

@Arc771 Thanks, Could you check it in the next rolling release after 20221118?

@Viacheslav Works!

Thanks for your great work!