https://bugzilla.mindrot.org/show_bug.cgi?id=2530
Bug ID: 2530
Summary: Client does not differentiate between more keys on
Smart card, signs always with first one
Product: Portable OpenSSH
Version: 7.1p1
Hardware: Other
OS: Linux
Status: NEW
Severity: enhancement
Priority: P5
Component: Smartcard
Assignee: [email protected]
Reporter: [email protected]
Based on the report in our bugzilla [1] (though on older version and
with different use case), I can reproduce the same behaviour with two
different key pairs on smartcard (opencryptoki softtoken), when only
the second is accepted.
This is caused by the fact, that when the public key is read from the
card, its CKA_ID is not stored alongside with the public key and ssh
later does not know which key use for signing (use the first one
implicitly, since it is first result of search).
So far, the key is identified by its pkcs11 provider library [2] and by
flag SSHKEY_FLAG_EXT [3], which is obviously not enough (see the
self-explaining comment /* XXX */ [2]).
Fortunately, similar question was asked before by different people and
there is RFC7512 describing PKCS#11 URI scheme, which quite suits these
needs. It can overgrow into ugly monstrosity, but for our case should
be enough to note the id (CKA_ID) in scheme.
Integration of this idea into openssh would require some changes, which
are more complex to do them without discussion as a patch for bugzilla.
If you feel this would be useful, I would like to hear upstream
acknowledgement.
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1280422
[2] https://github.com/openssh/openssh-portable/blob/master/ssh.c#L1994
[3]
https://github.com/openssh/openssh-portable/blob/master/ssh-pkcs11.c#L541
[4] https://tools.ietf.org/html/rfc7512
--
You are receiving this mail because:
You are watching the assignee of the bug.
_______________________________________________
openssh-bugs mailing list
[email protected]
https://lists.mindrot.org/mailman/listinfo/openssh-bugs
