Bug 1908

Summary: Extract the public key from certificate on pkcs#11
Product: Portable OpenSSH Reporter: Laurent <laurent>
Component: SmartcardAssignee: Assigned to nobody <unassigned-bugs>
Status: CLOSED FIXED    
Severity: enhancement CC: djm, markus
Priority: P2 Keywords: patch
Version: 5.8p2   
Hardware: All   
OS: All   
Attachments:
Description Flags
Patch for extract the pubkey from cert on pkcs#11
none
updated patch for extracting the pubkey from x509 via pkcs#11
none
extract pub key from x509 via pkcs11, skip duplicates djm: ok+

Description Laurent 2011-05-19 20:29:01 AEST 
Some token not allow access the public key object.
(It does not even exist at all on some token...)
This patch add search on CKO_CERTIFICATE to retrieve public key from certificates.
Must be optimized...
Tested with SafeNet 72K eToken.
Comment 1 Damien Miller 2011-06-03 10:25:04 AEST 
It looks like you forgot to attach the patch. Could you please try again?
Comment 2 Laurent 2011-06-04 03:50:46 AEST 
Created attachment 2054 [details]
Patch for extract the pubkey from cert on pkcs#11
Comment 3 Markus Friedl 2013-10-17 02:17:03 AEDT 
Created attachment 2354 [details]
updated patch for extracting the pubkey from x509 via pkcs#11
Comment 4 Damien Miller 2013-10-17 10:10:44 AEDT 
Might a token offer a key in bare form and as a certificate? If so, should it check for an identical key in the array before appending it? 

Later, it would be nice to be able to extract an OpenSSH certificate from an extension section of the X.509 certificate so we could store our certs on the card too.
Comment 5 Markus Friedl 2013-11-01 18:59:30 AEDT 
Created attachment 2370 [details]
extract pub key from x509 via pkcs11, skip duplicates
Comment 6 Damien Miller 2013-11-01 19:09:32 AEDT 
Comment on attachment 2370 [details]
extract pub key from x509 via pkcs11, skip duplicates

Looks good!
Comment 7 Markus Friedl 2013-11-03 07:09:11 AEDT 
(In reply to Damien Miller from comment #6)
> Comment on attachment 2370 [details]
> extract pub key from x509 via pkcs11, skip duplicates
> 
> Looks good!

I've committed the patch to openbsd....
Comment 8 Damien Miller 2015-04-17 14:54:59 AEST 
this was committed some time back
Comment 9 Damien Miller 2016-08-02 10:41:29 AEST 
Close all resolved bugs after 7.3p1 release