PowerShell / PowerShell/Win32-OpenSSH

Issue with YubiKey and ECC keys

Open
#1,947 11 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
No language data
Stars
8.3k
Forks
819
PR merge metrics
No merged PRs in 30d

Description

"OpenSSH for Windows" version : 8.9.1.0

Client OperatingSystem : Windows 11 21H2

What is failing
I'm facing an issue with OpenSSH, OpenSC and the use of a YubiKey 5. It seems that ECCP256 and ECCP384 keys are not supported by OpenSSH on Windows. When I try to export the public key from the YubiKey multiple errors like unsupported key type are thrown.
I have already opened an issue on OpenSC's side (OpenSC/OpenSC#2559) but for them the problem is with OpenSSH for Windows.

Step to reproduce
Generate an ECCP256 or ECCP384 on the YubiKey with the yubico-piv-tool (source) :

PS > & 'C:\Program Files\Yubico\Yubico PIV Tool\bin\yubico-piv-tool.exe' -s 9a -a generate -A ECCP384 -o public.pem
PS > & 'C:\Program Files\Yubico\Yubico PIV Tool\bin\yubico-piv-tool.exe' -a verify-pin -a selfsign-certificate -s 9a -S "/CN=SSH key/" -i public.pem -o cert.pem
PS > & 'C:\Program Files\Yubico\Yubico PIV Tool\bin\yubico-piv-tool.exe' -a import-certificate -s 9a -i cert.pem

Then try to export the public key from the YubiKey with the following command :

PS > ssh-keygen.exe -D 'C:\Program Files\OpenSC Project\OpenSC\pkcs11\opensc-pkcs11.dll' -e

Expected output
The public key of the generated certificate should be printed to stdout.

Actual output

PS > ssh-keygen.exe  -vvv -D 'C:\Program Files\OpenSC Project\OpenSC\pkcs11\opensc-pkcs11.dll' -e
skipping unsupported key type
failed to fetch key
unknown certificate key type
failed to fetch key
Enter PIN for 'SSH key':
skipping unsupported key type
failed to fetch key
unknown certificate key type
failed to fetch key
cannot read public key from pkcs11

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the YubiKey ECCP384 steps and the ssh-keygen.exe -D ... -e command from the issue, then trace how Win32-OpenSSH handles the returned PKCS#11 key and certificate types. Done means the public key from the generated certificate is printed to stdout instead of reporting an unsupported or unknown key type.

Written by the indexing model from the issue text.

Assessment

Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.