Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Comments

Providing support of PKCS#11 URI#616

Open
beldmit wants to merge 5 commits intoopenssh:master from
beldmit:pkcs11-uri
Open

Providing support of PKCS#11 URI #616
beldmit wants to merge 5 commits intoopenssh:master from
beldmit:pkcs11-uri

Conversation

@beldmit
Copy link

@beldmit beldmit commented Dec 18, 2025

This is a rebase of patch provided in #2817 by @Jakuje to OpenSSH 10.2/master branches.
The patch has been tested in RHEL/Fedora for a while and I'm not aware of any problems

The authentication identity can be also specified in a form of PKCS#11 URI
starting with a string
.Cm pkcs11: .
There is supported a subset of the PKCS#11 URI as defined
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK, so this is a lot of code, Aside from the questions of "does this need to be in SSH or in something external" - Right the claims to implement a subset of RFC7512. How about we be specific about what that subset is? Are we going to support piped arbitrary commands like is hinted to in there?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK, so this is a lot of code

Its moving a lot of code around. And almost half of the code are tests.

does this need to be in SSH or in something external

We discussed this last year in Munich, but nobody in the room was very much in favor of going in this direction. Something external would be a pkcs11-provder. It would make a lot of things much easier, but would not play well with the other *SSL forks and would not play well with the process/address space separation implemented currently.

How about we be specific about what that subset is?

It can be clarified if needed. The idea was "the useful subset" without introducing too much complexity.

Are we going to support piped arbitrary commands like is hinted to in there?

I hope note.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

2 more reviewers

@Jakuje Jakuje Jakuje left review comments

@bob-beck bob-beck bob-beck left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

AltStyle によって変換されたページ (->オリジナル) /