Yubico Forum

Hello,

I've got my yubikey neo working with a RSA public/private key and ssh. However, I can't get it to work with the elliptic curve algorithm ECCP256.

The steps that I've done :-



Which all seem to run ok, however, when I run



I get the error C_GetAttributeValue failed: 18.

I can use ssh-keygen to convert the public-ecc.pem file directly and copy that to authorized_keys. However, when I attempt to login with ssh -I /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so I get the same error.

pkcs15-tool --list-public-keys shows the key. pkcs15-tool --read-public-key comes back with a "not implemented" error (but also does the same for a RSA key). pkcs15-tool --read-certificate correctly outputs the certificate that was imported.

Cheers
Guy

Hello,

This may not be a complete answer, but the pkcs11 module doesn't support ECC.

Could you double check?

How do I do that?

Ok, I've done some more experimenting. It seems that things are ok at the PKCS11 level as the following works :-



The problem looks like it's with openssh. The man page for ssh_config mentions that the PKCS11Provider reads RSA keys (no mention of ECC) and a quick scan of the source code at https://github.com/openssh/openssh-port ... h-pkcs11.c seems to confirm this.

Cheers
Guy

Hi,
have you found out a solution to this?

I'd love to use ECC keys, but without PKCS11 support it will not work. I looked around for possibility of adding the support but couldn't find anything (and I'm not a developer).