Can I use the on-board key generated keys on the HSPD-12 card as openssh keys? If so, how?


Smartcards and Openssh

The point of the smartcard is that you cannot extract the private key for the keypair generated but that the public key is generally accessible.

For *nix you should install opensc (github.com/OpenSC) toools. On ubuntu:

$ sudo apt-get install opensc
$ sudo apt-get install opensc-pkcs11

Additional packages that you may find useful include OpenSSL (for engine-pkcs11.so installed above -- but not required for this process).

Back to the main question involving ssh and smartcards:

Taking ssh as the example, a 2048 byte RSA key generated on the card, you must put the public key on the remote hosts. Then when you ssh to the remote hosts from you desktop (on the desktop: smart card reader with smart card inserted) you will be prompted to enter your pin to unlock the card.

Extract the Public Key

On my test HSPD-12/PIV the first key slot is the authentication key and the second is the signature key. I will use the opensc-tools to extract the public key.

# note:  use 'lsusb' to see if you can see your card reader, if not fix it.

$ pkcs15-tool --read-certificate 2 --out my_key.pub

On your remote hosts put the contents of my_key.pub into your ~/.ssh/authorized_keys2 file in the same way you add other public keys.

Openssh example:

    $ ssh -I /usr/lib/opensc-pkcs11.so martin@remotehost
    Enter PIN for 'MARTIN PALJAK (PIN1)': 

The above was taken from the OpenSC project wiki: https://github.com/OpenSC/OpenSC/wiki/OpenSSH-and-smart-cards-PKCS%2311


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.