Can I use the on-board key generated keys on the HSPD-12 card as openssh keys? If so, how?
Smartcards and Openssh
The point of the smartcard is that you cannot extract the private key for the keypair generated but that the public key is generally accessible.
For *nix you should install opensc (github.com/OpenSC) toools. On ubuntu:
$ sudo apt-get install opensc $ sudo apt-get install opensc-pkcs11
Additional packages that you may find useful include OpenSSL (for engine-pkcs11.so installed above -- but not required for this process).
Back to the main question involving ssh and smartcards:
Taking ssh as the example, a 2048 byte RSA key generated on the card, you must put the public key on the remote hosts. Then when you ssh to the remote hosts from you desktop (on the desktop: smart card reader with smart card inserted) you will be prompted to enter your pin to unlock the card.
Extract the Public Key
On my test HSPD-12/PIV the first key slot is the authentication key and the second is the signature key. I will use the opensc-tools to extract the public key.
# note: use 'lsusb' to see if you can see your card reader, if not fix it. $ pkcs15-tool --read-certificate 2 --out my_key.pub
On your remote hosts put the contents of my_key.pub into your ~/.ssh/authorized_keys2 file in the same way you add other public keys.
$ ssh -I /usr/lib/opensc-pkcs11.so martin@remotehost Enter PIN for 'MARTIN PALJAK (PIN1)': martin@remotehost:~$
The above was taken from the OpenSC project wiki: https://github.com/OpenSC/OpenSC/wiki/OpenSSH-and-smart-cards-PKCS%2311