PowerShell / PowerShell/Win32-OpenSSH
Issue with YubiKey and ECC keys
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 8.3k
- Forks
- 819
- PR merge metrics
- No merged PRs in 30d
Description
"OpenSSH for Windows" version : 8.9.1.0
Client OperatingSystem : Windows 11 21H2
What is failing
I'm facing an issue with OpenSSH, OpenSC and the use of a YubiKey 5. It seems that ECCP256 and ECCP384 keys are not supported by OpenSSH on Windows. When I try to export the public key from the YubiKey multiple errors like unsupported key type are thrown.
I have already opened an issue on OpenSC's side (OpenSC/OpenSC#2559) but for them the problem is with OpenSSH for Windows.
Step to reproduce
Generate an ECCP256 or ECCP384 on the YubiKey with the yubico-piv-tool (source) :
PS > & 'C:\Program Files\Yubico\Yubico PIV Tool\bin\yubico-piv-tool.exe' -s 9a -a generate -A ECCP384 -o public.pem
PS > & 'C:\Program Files\Yubico\Yubico PIV Tool\bin\yubico-piv-tool.exe' -a verify-pin -a selfsign-certificate -s 9a -S "/CN=SSH key/" -i public.pem -o cert.pem
PS > & 'C:\Program Files\Yubico\Yubico PIV Tool\bin\yubico-piv-tool.exe' -a import-certificate -s 9a -i cert.pem
Then try to export the public key from the YubiKey with the following command :
PS > ssh-keygen.exe -D 'C:\Program Files\OpenSC Project\OpenSC\pkcs11\opensc-pkcs11.dll' -e
Expected output
The public key of the generated certificate should be printed to stdout.
Actual output
PS > ssh-keygen.exe -vvv -D 'C:\Program Files\OpenSC Project\OpenSC\pkcs11\opensc-pkcs11.dll' -e
skipping unsupported key type
failed to fetch key
unknown certificate key type
failed to fetch key
Enter PIN for 'SSH key':
skipping unsupported key type
failed to fetch key
unknown certificate key type
failed to fetch key
cannot read public key from pkcs11
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the YubiKey ECCP384 steps and the ssh-keygen.exe -D ... -e command from the issue, then trace how Win32-OpenSSH handles the returned PKCS#11 key and certificate types. Done means the public key from the generated certificate is printed to stdout instead of reporting an unsupported or unknown key type.
Written by the indexing model from the issue text.
Assessment
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100