The smartcard needs to support openpgp smart cards. You then create an RSA gpg key with three subkeys - signing, encryption, and authentication. You'll have to enable the advanced key-creation mode for the last one. That authentication subkey then becomes your ssh key.
There are plenty of tutorials online, but none are particularly good. I've been meaning to regenerate my keys, so maybe I'll take notes and try to write up a good one.
It will display the public key but it is in hex and uses Microsoft's PublicKeyBlob structure. OpenSSL will convert this to PEM for you though, which is what you want for SSH authentication. Something like:
Open this new file in a text editor and get rid of the begin and end public key lines and just smack it all on one line with "ssh-rsa " (note the space) in front of it. You can then add this to your server's authorized_keys file.
OpenSSH can use a pkcs11 library for authentication (-I option), which is also avaliable from Gemalto's website (these are generally specific to the smartcard), and on Windows there is a version of PuTTY called PuTTY SC that will also let you use the pkcs11 library.
Comments
I'm quite interested in this, as I have some old smartcard readers around from the days of Nagra/Nagra2. Care to share any more details?
The smartcard needs to support openpgp smart cards. You then create an RSA gpg key with three subkeys - signing, encryption, and authentication. You'll have to enable the advanced key-creation mode for the last one. That authentication subkey then becomes your ssh key.
There are plenty of tutorials online, but none are particularly good. I've been meaning to regenerate my keys, so maybe I'll take notes and try to write up a good one.
Here are a few links:
http://wiki.debian.org/Smartcards/OpenPGP http://www.gnupg.org/howtos/card-howto/en/smartcard-howto.ht... https://www.crypto-stick.com/
The last one is interesting - it's a smart card reader and integrated smart card built into a usb stick.
Most likely will depend on what smartcard you get but here is how I do it with my Gemalto card:
I use the Minidriver manager tool from: http://www.gemalto.com/products/dotnet_card/resources/develo... although you could use something like pkcs11-tool.
Generating a RSA keypair is as simple as right clicking on an empty container, selecting OBKG Container and filling this out:
http://i.imgur.com/uMY53OD.png
It will display the public key but it is in hex and uses Microsoft's PublicKeyBlob structure. OpenSSL will convert this to PEM for you though, which is what you want for SSH authentication. Something like:
Open this new file in a text editor and get rid of the begin and end public key lines and just smack it all on one line with "ssh-rsa " (note the space) in front of it. You can then add this to your server's authorized_keys file.OpenSSH can use a pkcs11 library for authentication (-I option), which is also avaliable from Gemalto's website (these are generally specific to the smartcard), and on Windows there is a version of PuTTY called PuTTY SC that will also let you use the pkcs11 library.