TEE Identity-based authentication provides functionality to log in without a pin but using a User or Group identity. The feature is valuable for embedded devices where there is no user interaction. With the TEE Identity authentication, the pin should be empty. The use case is: CKTEEC_LOGIN_TYPE=user ssh-add -s /usr/lib/libckteec.so.0 For TEE Identity-based auth pin should be provided as an empty string. But in the current implementation, if a pin is empty the message structure will not be populated with the pin(see sshbuf_put_string). As a result, the error: "pin required". As a solution add a new line character. The details about the TEE Identity-based authentication: OP-TEE/optee_os#4222 The implementation is in the following pull request: https://github.com/openssh/openssh-portable/pull/318