Smartcard quickstarter guide Why use smartcards? - GOOZE ...

Smartcard quickstarter guide
Some users have been using the same OpenSSH RSA key for a long time and feel happy to keep them.
The pros: after transfer, copy your original certificates (id_rsa) to a laser disc and store it in a safe place. This is a very good way
to enhance security and have a backup of your SSH keys.
The cons: not all OpenSSH formats are supported and it seems that the Feitian PKI is a little bit picky. DSA format is not
supported. This solution is not considered perfectly secure. If your computer is compromised, the secret key may be
compromised.
Reusing OpenSSH RSA keys
Before all, you should know that the Feitian PKI only accepts 1024bit or 2048bit RSA key. OpenSSH DSA keys are not
accepted.
Save the OpenSSH private RSA key in PEM format:
$ openssl rsa -in ~/.ssh/id_rsa -outform pem > id_rsa.pem
Transfer the key to to smartcard:
$ pkcs15-init --store-private-key id_rsa.pem --auth-id 01 --pin 0000
Scenario 5: importing 3DES key
OpenSC is able to generate RSA keys using the embedded processor, not 3DES keys.
To use 3DES keys, we need to generate and import them to smartcard/token.
Generate a 3des key using OpenSSL:
$ openssl rand 24 -out 3des.key
Import the 3DES key as an independant object and write private flag to forbid the user from reading it back:
$ pkcs11-tool -v --module opensc-pkcs11.so --slot 1 --label "3deskey" --write-object 3des.key --type data --
private --login --pin 0000
Now dump content of card/token:
$ pkcs15-tool --dump
Using reader with a card: Feitian ePass2003 00 00
PKCS#15 Card [François Pérou]:
Version : 0
Serial number : 2431330916091101
Manufacturer ID: EnterSafe
Last update : 20111231100514Z
Flags : EID compliant
PIN [User PIN]
Object Flags : [0x3], private, modifiable
ID : 01
Flags : [0x32], local, initialized, needs-padding
Length : min_len:4, max_len:16, stored_len:16
Pad char : 0x00
Reference : 1
Type : ascii-numeric
Copyright GOOZE 2010-2011 http://www.gooze.eu 44 / 63