Home » Using OpenSSH with smartcards

Reading SSH public key on card (client side)

Connect the smart card reader and insert a smart card.
If you are using a token, connect the USB key.

In the next paragraphs, '*' indicate that text was shortened for readability.

Query the available RSA keys:

$ pkcs15-tool --list-public-keys
Using reader with a card: OmniKey CardMan 4321 00 00
Public RSA Key [Public Key]
Com. Flags : 2
Usage : [0x4], sign
Access Flags: [0x0]
ModLength : 2048
Key ref : 0
Native : no
Path : 3f0050153000
Auth ID : 01
ID : 7645d913d5b4e03f3fe5*****f02324c23a7ebf

In our example, the public key ID is 7645d913d5b4e03f3fe5*****f02324c23a7ebf4.

Sometimes, there is no public key, only a private key. Try:

$ pkcs15-tool --list-keys
Using reader with a card: Feitian ePass2003 00 00
Private RSA Key [Private Key]
Object Flags : [0x3], private, modifiable
Usage : [0x2E], decrypt, sign, signRecover, unwrap
Access Flags : [0x0]
ModLength : 2048
Key ref : 0 (0x0)
Native : yes
Path : 3f0050152900
Auth ID : 01
ID : 7645d913d5b4e03f3fe5*****f02324c23a7ebf

Now extract the RSA key in SSH format:

$ pkcs15-tool --read-ssh-key 7645d913d5b4e03f3fe5*****f02324c23a7ebf4
Using reader with a card: OmniKey CardMan 4321 00 00
Please enter PIN [User PIN]:
2048 65537 258115708996235*****134757454178319
ssh-rsa AAAAB3NzaC*****ed0aZdx9FFu/w6l7P5KsndWgP

Notice the RSA public key in SSH format:

ssh-rsa AAAB3NzaC*****ed0aZdx9FFu/w6l7P5KsndWgP
Bookmark/Search this post with