PKCS#11 support for openssh

[Alon Bar-Lev]

Roumen Petrov wrote:
> Alon,
> 
> you should improve security of code. I already sent some notes offlist.
> 
> 

Hello,

Attached is a new version modified according to Roumen 
Petrov's helpful comments.

For those of you that did not follow this thread:

The PKCS#11 patch modify ssh-add and ssh-agent to support 
PKCS#11 private keys and certificates.

It allows using multiple PKCS#11 providers at the same time, 
selecting keys by id, label or certificate subject, handling 
card removal and card insert events, handling card re-insert 
to a different slot, supporting session expiration.

A valid X.509 certificate should exist on the token, without 
X.509 support it is exported as regular RSA key. Self-signed 
certificates are treated as RSA key and not as X.509 RSA 
key. There is a simple utility Timo Felbinger wrote 
(http://www.timof.qipc.org/x509toOpenSSH.c) that extracts 
ssh public key from X.509 certificate.

If you like X.509 support apply the X.509 patch *AFTER* the 
PKCS#11 patch. There are minor rejects that can be easily 
corrected by:
$ autoreconf -i -v

One significant change is that the ssh-agent prompts for 
passwords now... So you need to configure it with a program 
that asks for card insert or PIN, a program such as 
x11-ssh-askpass. Current implementation (ssh-add asks for 
passwords) is not valid for dynamic smartcard environment.

Current implementation uses the askpin program also for 
prompting card insert... Don't be confused, it only expects 
ok or cancel, attached is a simple scripts that uses kde in 
order to display these dialogs.

A common scenario is the following:

$ ssh-agent xterm ->

  $ ssh-add --pkcs11-ask-pin `which openssh-kde-dialogs.sh`

  $ ssh-add --pkcs11-add-provider --pkcs11-provider 
/usr/lib/pkcs11/MyProvider.so

  $ ssh-add --pkcs11-add-id --pkcs11-slot-type label 
--pkcs11-slot "MyToken" --pkcs11-id-type subject --pkcs11-id 
"/C=XX/CN=YY"

  $ ssh myhost

In order to see available objects, you can use:

  $ ssh-add --pkcs11-show-slots --pkcs11-provider 
/usr/lib/pkcs11/MyProvider.so

  $ ssh-add --pkcs11-show-objects --pkcs11-provider 
/usr/lib/pkcs11/MyProvider.so --pkcs11-slot 0

I will be happy to receive any more comments!

Best Regards,
Alon Bar-Lev.