GNOME Bugzilla – Bug 672145
Protocol support for ECDSA in ssh-agent
Last modified: 2018-03-05 11:37:21 UTC
Implement ECDSA code for handling signature requests in daemon/ssh-agent. This does not include actually doing the signing but parsing the requests and keys that come in on ssh-agent binary protocol, and validating them and passing them through to the PKCS#11 key store. Reference for how to implement this would be the openssh sources. Functions that are probably affected: * build_like_attributes() * op_add_identity() * op_sign_request() * gkd_ssh_agent_initialize_with_module() * gkd_ssh_agent_proto_keytype_to_algo() * gkd_ssh_agent_proto_algo_to_keytype() * gkd_ssh_agent_proto_read_public() * gkd_ssh_agent_proto_write_public() Possible new functions, similar to functions for other algorithms nearby: * gkd_ssh_agent_proto_read_pair_ecdsa() * gkd_ssh_agent_proto_read_public_ecdsa() * gkd_ssh_agent_proto_write_public_ecdsa() * gkd_ssh_agent_proto_write_signature_ecdsa()
Hey, what's the progress on this? This is starting to trip people up: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=738660
In particular, it would be useful to support ed25519, not just the nist curves.
gnome-keyring should just wrap stock ssh-agent to solve this problem: https://bugzilla.gnome.org/show_bug.cgi?id=775981