search

maxgoedjen / secretive

Store SSH keys in the Secure Enclave
MIT License
6.99k stars 155 forks source link

Compatibility of PIV Certificates with other agents #556

Open dingwen07 opened 3 days ago

dingwen07 commented 3 days ago

Description

When using a PIV certificate (RSA2048) stored in a YubiKey for SSH authentication, Secretive derives a different SSH key than other SSH agents like WinCrypt SSH Agent on Windows and TermBot on Android. Both of these agents gives the same SSH key starts with ssh-rsa, whereas Secretive derives a different key that begins with rsa-sha2-512.

Steps to Reproduce

  1. Configure a certificate on YubiKey 9a slot
  2. Install cert on Windows Certificate Store and use WinCrypt SSH Agent to check the public key
  3. Plug YubiKey into Mac and open Secretive and check the public key and fingerprint

Proposed Solution

Provide a compatibility mode in Secretive that will derive the same SSH Key as other agents