Subject: smartcard keys and the ssh-agent

From: Nils Larsch <[email-masked]>
Date: Tue, 16 Sep 2003 11:59:08 +0200

Hi,

in the last/current draft of the 'Secure Shell Authentication
Agent Protocol' the only way to add a new key to the ssh-agent is
by sending the private key blob to the agent. If the key is stored
in a smartcard and if it's not extractable this is not possible
(at least if the normal private key blobs for rsa keys etc. are
used). What about adding an additional message to the agent
protocol to deal with hardware keys, for example something like
this:
....
#define SSH_AGENT_ADD_PKCS11_KEY 214

byte    SSH_AGENT_ADD_PKCS11_KEY
uint32  pkcs11 slot id
string  pkcs11 CKA_Id
string  pin
.... 0, 1 or several constraints follow

Another possibility would be to define special private key blobs
for hardware keys containing, for example, the slot id etc.

Comments etc. are welcome

Nils

---

From: Jon Bright <[email-masked]>
Date: Tue, 16 Sep 2003 12:28:45 +0200

Hi,

> protocol to deal with hardware keys, for example something like

It would seem to me that this situation doesn't occur - the agent's on 
the client side and would already know about any local smartcards. 
Under what circumstances would the server know about a smartcard that 
the agent was unaware of?

-- 
Jon Bright
Silicon Circus Ltd.
http://www.siliconcircus.com

---

From: Nils Larsch <[email-masked]>
Date: Tue, 16 Sep 2003 12:46:48 +0200

Jon Bright wrote:
> the client side and would already know about any local smartcards. Under 

And how should the client add a smartcard key (for example using
OpenSSH's ssh-add(1)) to the agent ? How should the agent know
anything about local smartcards ?

Nils