smartcard keys and the ssh-agent

[Nils Larsch <larsch%trustcenter.de@localhost>]

Hi,

in the last/current draft of the 'Secure Shell Authentication
Agent Protocol' the only way to add a new key to the ssh-agent is
by sending the private key blob to the agent. If the key is stored
in a smartcard and if it's not extractable this is not possible
(at least if the normal private key blobs for rsa keys etc. are
used). What about adding an additional message to the agent
protocol to deal with hardware keys, for example something like
this:
....
#define SSH_AGENT_ADD_PKCS11_KEY 214

byte    SSH_AGENT_ADD_PKCS11_KEY
uint32  pkcs11 slot id
string  pkcs11 CKA_Id
string  pin
.... 0, 1 or several constraints follow

Another possibility would be to define special private key blobs
for hardware keys containing, for example, the slot id etc.

Comments etc. are welcome

Nils