Bug 3432

Summary:	ssh-add: Skip PKCS11 pin prompt with TEE identity
Product:	Portable OpenSSH	Reporter:	Valerii <profmaker3>
Component:	ssh-add	Assignee:	Assigned to nobody <unassigned-bugs>
Status:	NEW ---
Severity:	normal
Priority:	P5
Version:	9.0p1
Hardware:	Other
OS:	Linux

Description Valerii 2022-05-14 01:55:35 AEST

TEE Identity-based authentication provides functionality to
log in without a pin but using a User or Group identity.
The feature is valuable for embedded devices where there is no
user interaction.

With the TEE Identity authentication, the pin should be empty.

The use case is:
CKTEEC_LOGIN_TYPE=user ssh-add -s /usr/lib/libckteec.so.0

For TEE Identity-based auth pin should be provided as an
empty string. But in the current implementation, if a pin
is empty the message structure will not be populated with
the pin(see sshbuf_put_string). As a result, the error:
"pin required". As a solution add a new line character.

The details about the TEE Identity-based authentication:
OP-TEE/optee_os#4222

The implementation is in the following pull request:
https://github.com/openssh/openssh-portable/pull/318