Support PKCS providers in Windows

[sdalessandro]

Getting the following error trying to use OpenSC to generate a key for my YK4...

PS C:\Users\Sandro\Documents\Yubi_Stuff> ssh-keygen.exe -D opensc-pksc11.dll -e
no pkcs11 support

I have a fresh install of both OpenSSH-Win32 and OpenSC-0.15.0-win32. Not sure where the issue is that's throwing this error. Any help is much appreciated!

[manojampalam]

Yes. PKCS providers are not in scope yet. https://github.com/PowerShell/Win32-OpenSSH/wiki/Project-Scope

[omniproc]

I'd like to see PKCS11 as well. As we're moving away from traditional passwords this would be a great deal.

[RichardScothern]

Just adding an interest in this feature too.

@manojampalam do you have a hard requirement for this repo being merged into the official openSSH before accepting pull requests for out of scope features? Thanks!

[manojampalam]

@RichardScothern, not at all. We can take any changes that are well tested and don't contribute to any major deviations in core source code layout .

[lars18th]

Hi,

You ca use this solution:

• Install the PuTTY-Pageant-CAC from @NoMoreFood : https://github.com/NoMoreFood/putty-cac/releases
• Use the WSL-SSH-Pageant tool to link the Pageant-CAC to the OpenSSH Client AUTH : https://github.com/benpye/wsl-ssh-pageant/releases (download the GUI version).
• Set your environment with SETX SSH_AUTH_SOCK \\.\pipe\ssh-pageant.
• Then start the PuTTY-Pageant-CAC and launch the WSL-SSH-Pageant with wsl-ssh-pageant-amd64-gui.exe --systray --winssh ssh-pageant.

After that all of yours certificates in PKCS11 loaded in Pageant will be available for your Win32-OpenSSH SSH Client.
And this works too for PuTTY keys and CAPI certificates.

Regards.

[omniproc]

@lars18th I'm currently using the CAC port of PuTTY and yes, your suggested method to use it's pageant component would allow PKCS11 use. However: this seems like a workaround. Native PKCS11 support in Windows and W31-OpenSSH would be a great thing.

[lars18th]

@lars18th I'm currently using the CAC port of PuTTY and yes, your suggested method to use it's pageant component would allow PKCS11 use. However: this seems like a workaround. Native PKCS11 support in Windows and W31-OpenSSH would be a great thing.

Hi @M451 ,

I feel native support will never be. Why? Because Win32-OpenSSH has his own Agent Manager. And the Microsoft people prefers to use it. Then, if you like to use the PuTTY's Agent Pageant (de facto standard in Windows), then you only require to use a PROXY. And this piece it's the WSL-SSH-Pageant. This new tool is quite simple and works well. You don't need more... except that the original Pageant lacks PKCS11 support (and others). But @NoMoreFood did a good job adding support to the Pageant.

So from my point of view, this it's the best solution. Besides, I'm a PuTTY Pageant fan. 😄
Regards.

[miketheitguy]

Just throwing my hat in the ring for support for this :)

[keliansb]

Hi,

You ca use this solution:

• Install the PuTTY-Pageant-CAC from @NoMoreFood : https://github.com/NoMoreFood/putty-cac/releases
• Use the WSL-SSH-Pageant tool to link the Pageant-CAC to the OpenSSH Client AUTH : https://github.com/benpye/wsl-ssh-pageant/releases (download the GUI version).
• Set your environment with SETX SSH_AUTH_SOCK \\.\pipe\ssh-pageant.
• Then start the PuTTY-Pageant-CAC and launch the WSL-SSH-Pageant with wsl-ssh-pageant-amd64-gui.exe --systray --winssh ssh-pageant.

After that all of yours certificates in PKCS11 loaded in Pageant will be available for your Win32-OpenSSH SSH Client.
And this works too for PuTTY keys and CAPI certificates.

Regards.

Thank you for your solution, it works like a charm! Do you know if the same thing is possible to do but with PuTTY instead of the Win32-OpenSSH client? I'm currently using mRemoteNG which doesn't support it currently...

[lars18th]

Thank you for your solution, it works like a charm! Do you know if the same thing is possible to do but with PuTTY instead of the Win32-OpenSSH client? I'm currently using mRemoteNG which doesn't support it currently...

Sure! If you use the original PuTTY (or any other fork... I like the KiTTY), then you only need to run the PuTTY-Pageant-CAC and select in your session configuration "Connection-->SSH-->Auth-->Authenticate methods" and check the option Attempt authentication using Pageant.

Regards.

[manojampalam]

Relevant changes

• PowerShell/openssh-portable@44ba548
• PowerShell/openssh-portable@3449eb2

[omniproc]

@manojampalam any usage instructions?

[NoMoreFood]

@M451 There's nothing unique about the Windows implementation other than you point to a .dll file instead of a .so file. The -I flag can be used to specify the library.