Giters

francoismichel / ssh3

SSH3: faster and rich secure shell using HTTP/3, checkout our article here: https://arxiv.org/abs/2312.08396 and our Internet-Draft: https://datatracker.ietf.org/doc/draft-michel-ssh3/

Home Page:https://arxiv.org/abs/2312.08396

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

add support for PKCS11

edgecase14 opened this issue · comments

commented

This will enable various hardware backed private key tokens: Yubikey, Smartcards, TPM

commented

I think it can be easily done by relying on OpenSSH's ssh-agent. Currently, we only look at files containing public keys, but we could ask for ssh3 to use PKCS11 through ssh-agent. That would enable using PKCS11 without having to support it natively in ssh3 right now.

commented

FYI I made it work with a Yubikey through SSH agent.
SSH3 currently does not handle the -sk key format bug with classical RSA pubkeys generated by the ssh-agent it works.

You can make it work using the following procedure: https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PKCS11.html (Step 6 won't work but you can connect using the pubkey-for-agent switch)