nomorefood/putty-cac

Windows Secure Shell Client With Support For Smart Cards, Certificates, & FIDO Keys

PuTTY CAC

PuTTY CAC is a fork of PuTTY, a popular Secure Shell (SSH) terminal. PuTTY CAC adds the ability to use the Windows Certificate API (CAPI), Public Key Cryptography Standards (PKCS) libraries, or Fast Identity Online (FIDO) keys to perform SSH public key authentication using a private key associated with a certificate that is stored on a hardware token.

PuTTY CAC can be used with many types of cryptographic tokens such as Yubikeys and popular smart card models. The 'CAC' in 'PuTTY CAC' refers to Common Access Card, a smart card token used for US Government facilities which was one of the initial drivers for the development of PuTTY CAC.

PuTTY CAC is maintained independently from the US Government by the open source community.

You can download the latest release of PuTTY CAC here: https://github.com/NoMoreFood/putty-cac/releases

PuTTY CAC source code and binaries are free to use for any purpose. The license can be found here: https://github.com/NoMoreFood/putty-cac/blob/master/code/LICENCE

Prerequisites

• Microsoft Windows 10 or Later
• For CAPI support, an appropriate Windows smart card mini-driver must be installed. This is typically provided by the smart card manufacturer although many common hardware tokens are supported by OpenSC.
• For PKCS support, a PKCS #11 library (typically a DLL file) is needed to interface with the hardware token. This is typically provided by the smart card manufacturer although many common hardware tokens are supported by OpenSC.
• For FIDO support, a FIDO key supported by Windows 10.

Usage

You can find a basic set of instructions on the usage of United States Government's ID Management website under the 'SSH Using PuTTY-CAC' section:

https://playbooks.idmanagement.gov/piv/engineer/ssh/

Command Line Usage

PuTTY CAC supports the same command line options as PuTTY with some additional, specialized options for PuTTY CAC specifically.

In place of a PuTTY key file path for any PuTTY utility, you can specific certificate thumbprint or application identifier. For example:

• Connect to user@host using the certificate with thumbprint '716B8B58D8F2C3A7F98F3F645161B1BF9818B689' the user certificate store:
  putty.exe user@host -i CAPI:716B8B58D8F2C3A7F98F3F645161B1BF9818B689
• Connect to user@host using the certificate with thumbprint 'B8B58D8F2C3A7F98F3F645161B1BF9818B689716' using PKCS library 'PKCS.dll':
  putty.exe user@host -i PKCS:B8B58D8F2C3A7F98F3F645161B1BF9818B689716=C:\PKCS.dll
• Connect to user@host using FIDO key identified by 'ssh:MyFidoKey' from PuTTY CAC FIDO key cache:
  putty.exe user@host -i FIDO:ssh:MyFidoKey

PuTTY executables (putty.exe, pageant.exe, psftp.exe) support the following additional command line options. Most of these options are focused on the operation of Pageant and are also settable from its user interface. Once set, these options will apply automatically to subsequent executions unless specifically unset. Settings that filter Pageant certificate selection dialogs will also affect filter certificate selection dialogs in the standard PuTTY application:

• Automatically load any compatible CAPI certificates at startup: -autoload,-autoloadoff
• Save key list between PuTTY executions: -savecertlist,-savecertlistoff
• Enable supplementary PIN caching in Pageant: -forcepincache,-forcepincacheoff
• Prompt when certificate signing operation is requested: -certauthprompting,-certauthpromptingoff
• Only display trusted certificates in certificate selection dialogs: -trustedcertsonly,-trustedcertsonlyoff
• Do not display expired certificates in certificate selection dialogs: -ignoreexpiredcerts,-ignoreexpiredcertsoff
• Disable all filtering in certificate selection dialogs: -allowanycert,-allowanycertoff

Special Considerations

Certificates

For the purposes of PuTTY CAC, the certificate is simply a convenient way to reference a private/public key pair. If you want to use PuTTY CAC to securely logon to your system and do not have access to a Certificate Authority (CA), the certificate can be self-signed. Conversely, PuTTY CAC can be used in conjunction with managed SSH servers to enforce multifactor authentication. This can be done by ensuring that the OpenSSH authorized_keys file only contains public keys associated with hardware tokens either procedurally or by creating an index of all issued certs and looking them up through OpenSSH directives like AuthorizedKeysCommand.

Federal Information Processing Standards (FIPS) Compliance

The specific code used to interface with the hardware token utilizes the Microsoft cryptographic libraries which in turn are governed by system-level FIPS settings (see Microsoft's website). Similarly, the hardware token that is used for signing authentication challenges is guaranteed to use FIPS compliant algorithms if the hardware key is FIPS certified; see the hardware token's manufacturer website for more information. PuTTY itself utilizes proprietary encryption and hashing once the SSH session is established which has not undergone evaluation for FIPS compliance or certification.

Notes On Building PuTTY CAC

Prerequisites

• Visual Studio 2022 with C++ Desktop Application Development
• WiX Toolset (to build the MSI files)
• Windows PowerShell (to build the MSI/ZIP/Hash files)

Building

• Execute 'packager\build.cmd' to create build files
• Visual Studio solution files will be generated under 'build'

Dependencies

• PuTTYImp is used to import existing FIDO resident keys. This links libfido2 statically; libfido2 and its binary dependencies are included in this repository. All other PuTTY executables have no dependencies other than those included within the Windows operating system and its associated SDKs.

putty-cac's Issues

Resource IDs should have constants

Example: e41c556#commitcomment-23300358

While it may be moot in cases like

putty-cac/windows/winpgnt.c

Line 607 in 35f7ab9

case 104: /* add capi key */

, it is notable that the ID meanings are sometimes mixed up (see:

putty-cac/windows/pageant.rc

Line 37 in 35f7ab9

PUSHBUTTON "Add PKCS Cert",104,142,160,60,14

).

Solution: Constants for IDs defined in a header; both source modules and resource files should include those headers and use those contants for the IDs.

Question: Automated retrieval of CAPI SSH keystring

Hello,

I am trying to determine if there is any way to automate the retrieval of the CAPI string (ssh-rsa AAAAB3NzXX.......) from a smartcard/PKI infrastructure (AD or CA perhaps) or if it has the be retrieved from the card manually by the user each time. Thanks

CAPI cert PIN entry does not accept enter key as "OK"

On Windows 7 when Pageant 0.69 using a CAPI cert asks for PIN entry it is not possible to just enter the PIN + press the enter key. After entering the PIN need to either move focus to the "OK" button (tab * 2) and then hit enter/space or click "OK" with the mouse. It has been like this on all releases in this repo.

It did work on Kageant 0.6x. The PIN entry dialog looks exactly the same on both.

It is a small thing but quite annoying.

Suggestion: Pageant supporting key usage confirmation

Hi,

This function described in the title is present in some other forks. And I feel it very useful. It's a check for knowing wich certificate is used, and a method for grant the use.

The original patch is published here:
http://people.mpi-klsb.mpg.de/~pcernko/pageant.html

And in this forum is commented the port to another fork that uses some PuTTY-CAC patches:
http://www.9bis.net/kitty/?action=forum&id=0809

I hope you can implement (importing the patches) it soon!
Regards.

x509 certificate lookup failure before signing in some nistp521r1 public key.

Hi,
I'm developing PKCS#11 token and testing it.
In the test, I found some problems in nistp521 operation.

putty-cac/cert/cert_pkcs.c

Line 69 in ffd5c71

int iKeySize = ((bignum_bitcount(ec->publicKey.x) + 7) / 8);

The nistp521r1 ecpoint (x, y) has the length of 521 bits or 65byte+1bit for each x and y.
In some case, a effective size of x is 65 bytes and of y is 66 bytes, then pkcs_lookup_token_cert() will fail.

Furthermore, puttygen always puts 66bytes x2 long into PEM EC Public Key regardless of x,y length.
If both x and y are 65byte long and public key in certificate is formed 66byte long, this routine doesn't work properly.

I've attached files in zip:
nistp521_65and66_pub.pem - EC public key generated by OpenSSL. x=65bytes, y=66bytes
nistp521_65byte.ppk - putty key generated by puttygen, x and y are both 65bytes but 0 paddings exist.
nistp521_65byte_privkey.pem - private key of nistp521_65byte.ppk, generated by generated by puttygen
nistp521_65byte_pubkey.pem - public key of nistp521_65byte.ppk, generated by generated by puttygen
nistp521_65byte_cert.pem - certificate of nistp521_65byte.ppk, generated by OpenSSL
nistp521_keys.zip

Thanks,
masayuki

PIN caching lost after hibernate

Sometimes when a computer running Pageant-CAC is hibernated, Pageant loses the PIN caching. It will ask for PIN every time after recovery from hibernation.

When Pageant is started, it will remember the PIN after first typing. But after hibernation it asks for PIN every time when connecting, until Pageant is restarted and cache works again until next hibernation.

Edit: this is with a CAPI cert from a PIV YubiKey.

windows 10 with ActivClient does not show certificate selection window

There seems to be a problem under windows 10 with ActivClient in cert enumeration function. It brings up a partial window but hangs w/o showing the list of available certificates, both for putty and pageant.

We were able to work around this by hard coding the certificate path in the command line for pageant. unfortunately I don't have access to this machine anymore. A user took off with it since he was ok with the workaround.. Just thought I should report this..

Problem with SSH Agent Forwarding when start with Putty-CAC+Pageant-CAC

Hi,

We are trying to setup an SSH Agent Forwarding situation where we "start" by using Putty-CAC (with Pageant-CAC running and loaded with the key) to get to what I call a "jump machine" (this is connection/authentication is implemented via a COTS product).

Then, onnce we are logged into the jump machine, we have an SSH private key in the .ssh dir and the corresponding public key in the .ssh of the target (==target1), and the user can SSH to the the 'target1' machine without entering a password. In the same way, we have agent forwarding configured, so the user can then SSH to the 2nd target (==target2) machine, again with no password.

However, we are having problem with that 2nd hop (to target2) and the user gets prompted for the password :(....

NOTE that if we use just Pageant and Putty, and Putty directly to the jump machine, then the SSH to target1, and then the next SSH to target2, works fine, with no password being entered.

To be clear, I don't know if this is a problem with Putty-CAC... I don't actually know WHAT the problem is, but I am posting this here, to try to maybe get some information.

In a test, I have recorded the same login chain, using both approaches (Putty+Pageant+forwarding) vs. (Putty-CAC+Pageant-CAC+COTS) and using "SSH -vvvv" and comparing the output side-by-side, which I am attaching.

The difference seems to be that the one that works has this:

debug2: key: imported-openssh-key (0x7f109753bc00)
debug2: key: /home/centos/.ssh/identity ((nil))
debug2: key: /home/centos/.ssh/id_rsa ((nil))
debug2: key: /home/centos/.ssh/id_dsa ((nil))
debug2: key: /home/centos/.ssh/id_ecdsa ((nil))
debug3: Wrote 68 bytes for a total of 1317

whereas the one that does not work has just this:

debug2: key: /home/centos/.ssh/identity ((nil))
debug2: key: /home/centos/.ssh/id_rsa ((nil))
debug2: key: /home/centos/.ssh/id_dsa ((nil))
debug2: key: /home/centos/.ssh/id_ecdsa ((nil))
debug3: Wrote 68 bytes for a total of 1317
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password

i.e., the one that does not work is missing this line:

debug2: key: imported-openssh-key (0x7f109753bc00)

the "imported-openssh-key" is the private key, so it appears that on the scenario that is not working, for some reason, the SSH is not getting the private key passed to it or something.

Does this make any sense?

Thanks,
Jim
log.txt

"Add pkcs cert" don't work for pageant

Using 0.69 64-bit version of pageant. Also use ruToken device with installed cert/key. The cert is working because it works correctly with puttysc (checked).
"Add pkcs cert" -> choose 64-bit pkcs dll for this device -> "Cert is not available"

Pageant won't load certificate again once Smartcard is re-injected

Using pageant with a smartcard is not a problem in the first place (i'm using a Yubikey 4 Nano), but if you unplug said smartcard and plug it back in, pageant seems to be unable to load the certificate.
After Just replugging it and startig a PuTTY-CAC session with PKCS Auth, i get an error saying "Server refused public-key signature despite accepting key!".
So I removed the "obsolete" PKCS Key by clicking on it and then hitting "remove" in pageant, then I added it again. But still, trying to authenticate with a server failed. To make pageant work again I need to restart the whole application. This problem seems to be only present on Windows 8 / Windows 10! Is there a way to just automatically remove the PKCS Key once the smartcard is unplugged? I think unplugging said device is not a rarity when you're at your workplace, thus restarting pageant each time does produce a lot of hassle.

Also: The PIN prompt only happens when connecting to a server using putty. Should it not instead prompt you for the PIN just as you add your PKCS cert? Because of that I need to firstly start a PuTTY remote login (on any host) and THEN I can start my WinSCP (which is able to use pageant but does not prompt for a pin if it's needed).

Thanks in advance.

Suggestion: Certificate name for CAPI certs

Hi,

In the "Pageant Key List" at time four different rows are shown:

CERT-TYPE  /  KEY LENGTH  /  FINGERPRINT  / COMMENT-NAME

For example,

ssh-rsa  1024  01:02:03:......  my-cert
ssh-rsa  2048  11:12:13:......  CAPI
ssh-rsa  2048  21:22:23:......  CAPI

And as you can see for CAPI certs the name is missing. So, please can you add also the name in this case?

Here can be an example of the suggested format (including the different variants):

ssh-rsa  1024  01:02:03:......  KEY(my-cert)
ssh-rsa  2048  11:12:13:......  CAPI(my-card)
ssh-rsa  2048  21:22:23:......  CAPI(my-card2)
ssh-rsa  2048  31:32:33:......  PKCS(dll-name:my-token)

I feel this can be easy to implement as the name (Comment) it's stored as a simple STRING and it can contain any info.
You agree?

Yubikey piv - capi cert

I'm using Win10 and a Yubikey Neo. If I select "Set CAPI Cert", I can select the SSH Key cert, but there is no input field for the pin showing up. If I connect to the server, I get a popup, that the connection is not possible to establish with this smartcard.

Security issues in Putty 0.70

Description

Putty 0.71 has been released and adresses multiple critical vulnerabilities:
https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html

Vulnerabilities

Security fixes found by an EU-funded bug bounty programme:
a remotely triggerable memory overwrite in RSA key exchange, which can occur before host key verification
potential recycling of random numbers used in cryptography
on Windows, hijacking by a malicious help file in the same directory as the executable
on Unix, remotely triggerable buffer overflow in any kind of server-to-client forwarding
multiple denial-of-service attacks that can be triggered by writing to the terminal

remediation

Merge putty 0.70 upstream fixes into putty-cac

OpenPGP 4096bit key and pageant-cac support

Hi,
I have a question about using OpenPGP token (Yubikey FIPS) and pageant-cac via the opensc-pkcs11 library (os: win10):
In the OpenSC Forum, I received information that pageant-cac does not support 4096bit keys?
If so, why this restriction?
Will 4096bit key support be added in the future?
If a 4096bit key is stored on the token, the pageant displays a message that there is no available key on the card. For 2048bit OpenPGP keys I haven't tried it yet.
I know that 4096bit OpenPGP keys can be put into a putty via the gpg-agent (GnuPGP), but because of exclusive access to the token it is useless to me. (I need to use one Token at the same time in PKCS11 mode [VPN connection] and OpenPGP mode [ssh connection]).

Build errors

After i finally figured out how to run these dsp's, trying to make gives an error that says, that /ZI and /Gy are incopatible. How to fix it?

is there any plan to restore pkcs#11 support in future version?

The pkcs11 support has been removed from v0.65.
is it possible to support pkcs11 in future version?

Putty-CAC 0.70u1 issue with Windows 7

We are running the 64-bit version of Windows 7 Enterprise w/SP1 installed, and when we update to 0.70u1, we are then unable to launch the PuTTY software, getting an error dialog box "Failed to initialize COM subsystem".

I should note, this is using the 32-bit version of putty-cac, and we have ActivClient 7.1.x installed.

We were using 0.70 with no issues, as well as the previous versions, 0.68 and 0.68u1, all 32-bit.

Thanks.

Question: Full portable mode?

Hi,

I downloaded the "Pageant.EXE". And I like to use it in a PORTABLE mode. However, I see that if I check, for example, the option "Autoload Certs" it's saved in the registry.

So I request for a method for using a command-line parameter for disabling the use of the registry. Or an option for disabling the "Autoload Certs". My objetive is starting the Pageant mananger using SCRIPTS, and I don't like to use at all the registry.

Please, can you help me with this?
Thank you!

PuTTY CAC version 0.73 Update 1 does not start on Windows 10

I have tried to run version 0.73 Update 1 (64-bit) on two Windows 10 (1909) machines, with the same result: PuTTY does not start. The busy cursor flashes for a brief moment, and then nothing. PuTTY.exe crashes, Pageant.exe works. I haven't tried the other programs.

I compiled the latest version from GitHub on Mingw-w64, and all went smoothly: the program ran without issue, except for one thing: the "Certificate" entry in the settings was missing. It was as if I had compiled the standard PuTTY. Is there some build configuration setting I missed, or is it not possible to compile the "cac" version with Mingw? Anyway, the startup problem could not be reproduced with the Mingw compiled version.

The following error is reported in the event log:

Faulting application name: putty.exe, version: 0.73.0.1, time stamp: 0x5e52e5e3
Faulting module name: putty.exe, version: 0.73.0.1, time stamp: 0x5e52e5e3
Exception code: 0xc0000005
Fault offset: 0x000000000002afb6
Faulting process id: 0x6b44
Faulting application start time: 0x01d5ed78d7a941e6
Faulting application path: C:\Program Files\PuTTY\putty.exe
Faulting module path: C:\Program Files\PuTTY\putty.exe
Report Id: 5a40248f-1bc0-4e6a-9ada-d80932a39c17
Faulting package full name: 
Faulting package-relative application ID: 

Putty-cac has a blurry screen on launch

I am on Windows 10 machine with a 4K monitor and I have just discovered putty-cac. However, it looks blurry. Putty 0.70 doesn't have this issue and when I launch both side by side, the difference is amazing. After trying to use for a few hours, I started to get a headache. I tried playing with compatibility settings, but to no avail. Any recommendations as to what could be the cause if they are off the same codebase? (Screenshot shows putty on left and putty-cac on right)

Suggestion: Let Pageant list valid certificates first

Just wondering if you can make Pageant list valid certificates first. Perhaps sort by descending order of the end validity date of each certificate? This will be useful for smart card that has a lot of certificates. Alternatively, there could be an option to filter out expired certificates from the list. Thanks!

0.72 Pageant caches PIN even though "Force PIN Caching" is not ticked

Hello,

I think it's the same on 0.72 and 0.71 (and maybe earlier versions; didn't test):

For improved security, I want Pageant to force users entering the PIN of the PKCS cert every time: is this possible? I though unchecking the "Force PIN Caching" option would make sense, but I see no different behaviour than when it's ticked.

This is not an issue on PuTTY CAC directly without Pageant: the PIN is by default requested every time there. I think this should also be by default on Pageant (or at least an option).
My end goal is to use PKCS certs on MobaXterm or WinSCP thanks to Pageant, but I still want users to enter their PIN every time they SSH or SCP somewhere!

The only workaround at the moment is to exit from Pageant, re-start it and browse the PKCS dll again to add the certificate from the smartcard; then the PIN will be requested again at next SSH session... but that's quite an effort; users will probably never want to go through that!

Another inconvenience that I noticed is that the pop up window for the PKCS cert's PIN is often hidden behind other windows. For example, I can't enter the PIN when I launch a saved WinSCP session for the first time because the PIN prompt is behind and I can't move the WinSCP window. Maybe this deserves to open another issue...

Thank you,
Chris.

How is the "rsa-sha" string calculated?

Hi,

This is more a question than an issue - I hope that is ok...

We want to pre-provision users on the server-side so that they will be able to use Putty-CAC.

On the server-side we are using the "rsa-sha" string that is copied into the clipboard by putty-CAC when "Copy to Clipboard" is pressed to authenticate, so can someone here describe how that string is calculated from the original certificate material?

If we could know that, then we could process each certificate to generate the "rsa-sha" string and populate each user's profile with that string.

Thanks,
Jim

pageant and putty crash when add dll library

pageant and putty crash when add dll library
I open pagent, click "Add PKCS Cert", select opensc-pkcs11.dll, and click OK in windown form "PuTTY: Select Certificate for Authentication"
Same situation in putty if I add dll library
I have windows 10 pro with all last updates.
AppCrash_pageant.exe_38d025ccead485afa7be298d5c4356469c38aa8_bc63c0b2_246b0da0.zip

Suggestion: Resizable "Pageant Key List"

Hi,

Simple request: Make the Window resizable, or add an horizontal scroll.
When you're using a large name then you can't show the full text.

Thank you!

Question: How to run two Pageant in parallel?

Hi,

This issue isn't a bug, and is not a problem of PuTTY-CAC too. However, I have this problem:

• The PuTTY-CAC has the best Pageant tool for using Smarcard's certificates. However, I need to use another Pageant that has additional functionality (that it doesn't implements PuTTY-CAC).

Anyone knows a solution to run both in parallel?
Thank you!

Wrong string used to determine if argument is -savecertlist or -savecertlistoff

putty-cac/windows/winpgnt.c

Line 1486 in 5eb85eb

DWORD SaveCertListOn = (!strcmp(argv[i], "-savelist")) ? 1 : 0;

This line can't be correct. SaveCertListOn is set to 1 or 0 based on the string in argv[i] is "-savelist" or not, but this code branch is only entered if argv[i] is either "-savecertlist" or "-savcecertlistoff". The second argument to strcmp should be "-savecertlist".

Support for certificate authorities?

Is there a way to support certificate authorities on SSH servers, rather than trust-on-first-use? I'm not seeing an option in the app.

It would be nice to be able to add one or more CAs to PuTTY and have it automatically recognize servers signed with a trusted CA key. It would be particularly useful in CAC and other high security environments.

"PuTTY could not load the selected PKCS library" when it is not even supposed to.

I used PuTTY-CAC using a a smart card and the OpenSC PKCS library. Then I decided to skip OpenSC because on Windows it's not really needed and not using it means one less (unsigned) package to install. So I uninstalled OpenSC and tried to use the MS CAPI instead.

Now, no matter how many times I try to remove any certificate using "Clear Cert" in the PuTTY configuration (which says "") or using "Remove" in Pageant, which does not list any certificate, I still get an error dialog saying message "PuTTY could not load the selected PKCS library. Either the file is corrupted or not appropriate for this version of PuTTY. [...]".

Obviously, the library file is "corrupted", since it is uninstalled. The bug is that there does not seem to be any way to get rid of the error message using either the PuTTY or Pageant user interface.

The only way I have found to get out of this situation is to delete the CAPICertID registry key, which has a value starting with "PKCS" and ending with the path to the (now non-existent) "C:\Program Files\OpenSC Project\OpenSC\pkcs11\opensc-pkcs11.dll".

Making Pageant automatically load certs on startup

According to the Pageant docs, you can pass filenames to keys to have them preloaded.

How can you preload CAPI certs? Possible?

[FR] openssh-certificates

Hi,

is there any hope that you might support converting the public keys into ssh-certificates to use ssh's integrated certificate system for authenticating users? I didn't find anything in the existing issues.

I.e.

1. I import a smartcard into putty-cac...
2. ... take the ssh-rsa ... key and have it signed by the ssh-ca...
3. ...store the resulting [email protected] ... somewhere in putty-cac. As it doesn't have to be kept secret that shouldn't be too much of an issue.
4. I Authenticate on the server with that cert. That would require supporting the algorithm. I have no idea how complicated that would be.

It would make my life quite a bit easier. :)

Thanks
Stefan

Putty-CAC cert/cert-capi.c is still using SHA1 which newer OpenSSH servers will not accept.

See the discussion on: smartcard-openssh-and-putty-ssh

Note the same Yubikey 4 works via opensc-pkcs11.dll, but does not work via CAPI. The Yubikey 4 is a PIV like card and uses the Microsoft builtin smart card drivers.

OpenSSH servers no longer accept SHA1 signatures. Putty-CAC appears to still be trying use SHA1 in cart-capi.c

It looks like cert-capi.c is defaulting to using CALG_SHA1 in line 86, or the code at line 111:
tInfo.pszAlgId = NCRYPT_SHA1_ALGORITHM;

As I don't have a good way to debug Putty-CAC here is some of the putty-log, openssh debug and a snipit which show up twice. I think from lines70 and 71.

   CryptSignHash(hHash, pProviderInfo->dwKeySpec, NULL, 0, NULL, &iSig) != FALSE &&
   CryptSignHash(hHash, pProviderInfo->dwKeySpec, NULL, 0, pSig = snewn(iSig, BYTE), &iSig) != FALSE)

But then in the breakpoint hits and the siglen = 0 which is not good.

openssh-putty-cac.txt
putty.log

Request: Pageant icon different color

Hi,

As I need to run different versions of Pageant, it will be desirable if the CAC version will have a different icon. For example, one whith a green variation over the stock.

You agree?

Too many Certificates in pageant

Hi,

i want to use your pageant with cisco switches. But Putty showed this error message incomprehensibly, if the public-key is not present on the switch:

Putty does not attempt a "keyboard-interactive" auth as fallback.

Suggestion: Pageant "-run" command line

Hi @NoMoreFood ,

In my daily use I open a lot of times: PuTTY, Pageant and KeePass (with the KeeAgent plugin). So, I need to load the Pageant every time I start the PuTTY. Why? Because I don't like that other Pageants act as server (yes, I use them in a client mode). The problem is that: the first Pageant needs to be the server. So, if I like to use the Pageant-CAC I have two options:

1. Automatically load it at logon (it consumes memory).
2. Load it when I open the PuTTY.

So, my suggestion it's add a command-line "-run" to the pageant for running another binary when the Pageant it's loaded. In my case, this will be the PuTTY executable. So, starting a direct access to Pageant I can really open a new PuTTY session. This will grant that the Pageant it's loaded when I open the PuTTY for the first time.

Futhermore, the use of this parameter should imply that the window "Pageant is already running" will not be shown. As the Pageant will be called multiples times (or you can add too the command parameter "-nocheckrunning" if you prefer it).

You agree with this enhancement?
Thank you!

Pageant 0.69 cannot load smartcard certificate

I use Pageant with a Yubikey Neo on Windows 10 version 1703. On version 0.69, when starting Pageant and specifying a certificate name as command prompt argument, I get this error (both on the PIN caching version and on the master branch):

Selecting the certificate manually in Pageant doesn't work either.

Also, selecting the certificate in PuTTY works, but on connection the same error is displayed. Clicking "Copy to clipboard" in the Authentication parameters causes PuTTY to crash.

Suggestion: Pageant with Export Public Key certificate's

Hi,

I suggest to add a button with the name "Export Public Key" (or add the right button option with this option) for exporting the Public Key of the selected cert.

Other similar projects, when you do a double-click over a cert will copy the Public Key (the text used for paste into the ".authorized" file) to the clipboard. However, as this projects opens the Certificate Display windows when you double-click, then another option will be useful for copy the public key.

You agree?

Yubikey 4 PIV certificates

Hello,

Did anyone try Yubikey 4 as a smartcard holding the certificates? Because for me currently neither Putty CAC or Pageant CAC show Yubikey-stored certificates in certificate selection dialog. Only the software certificates are shown.

Yubikey 4 certs are displayed in certmgr.msc and also work correctly in Chrome/Edge (HTTPS client authentication) and in curl built with WinSSL. Putty is the only "missing link" for me.

I tried some changes from #2 (like changing chuid etc.) but no dice.

putty-cac crash when capi or pkcs key loaded

putty clashed when set capi cert or set pkcs cert button clicked.

an error is shown on event viewer

• Windows 10 1803
• putty-cac ver 0.7.3 and 0.7.4

windows xp

Is it compatibile with Windows XP with SP3 ?

Suggestion: Make a Chocolatey install package

Would you mind, if I create a package for https://chocolatey.org/ ?

Bug: "The already running Pageant refused to add the key"

Hi,

When you like to load a CAPI cerfiticicate using the command-line and the Pageant it's already running, then you can't load a new certificate.

Example:

• If you start with "C:\Program Files\PuTTY\pageant.exe" CAPI:2a361e0c4c53e9f357207b48d9e4762e3a840521 then the Pageant starts and loads this certificate.

• However, if you first execute "C:\Program Files\PuTTY\pageant.exe" and after you run
  "C:\Program Files\PuTTY\pageant.exe" CAPI:2a361e0c4c53e9f357207b48d9e4762e3a840521 then you see a Window Error with the message "The already running Pageant refused to add the key".

Please, can you improve this behaviour?
The idea is to have the option to load any certificate at any time.
Thank you!

PIV / CAC authentication for "pscp.exe" and "psftp.exe" not available?

I am told that although PIV/CAC auth works for "putty.exe" it does not for "pscp.exe" or "psftp.exe".

(The smart card manager reports that the card uses PKCS#1 SHA-256 with RSA encryption)

Is that in fact the case? If not, any ideas on why this user is having problems with it would be appreciated.

Thank you.
Ken

RFC6187 / X.509v3 support?

This might be a stupid question - but putty-cac does not support RFC6187 ("x509v3*") does it, and instead uses only pubkey method even if certificate is loaded from CAPI?

Since the only open implementation seems to be PKIX-SSH I guess implementing RFC6187 is too much of a nightmare?

virus?

Greetings.

I've been trying to download https://github.com/NoMoreFood/putty-cac/blob/master/binaries/x64/pageant.exe which I believe is version 0.70.2 .

My Symantec Endpoint Protection is marking it "Infected" with "WS.Reputation.1"

I found version 0.70.1 and it appears that Symantec is happy with this version.

Can you please look into this?

(Side note -- I know this is a github thing and not a you thing, but the "tags" are sorted in a weird way, so 0.70 is above 0.70.u2 and 0.70.u1 even though 0.70.u1/2 are newer.)

Question: How does the certificate gets converted into ssh-rsa string?

Hello,

I would like to know more about how is the ssh-rsa string is generated from the certificate.

The main question is: what algorithm is used for certificate convertion and how does it work with openssh? The most confusing part, is that it seems to be not certificate authentication per se... but it still works somehow...

Also, the CAPI:e495b3a063cd6a779ea810007d066ecd27da17f9 part seems unimportant (I've deleted it, and the auth still worked), is it just there so that you could more easily distinguish the keys in the authorized_keys file?

Autoload Certs loads too many certs

We have users with lots of different certificates (multiple YubiKeys, VPN certs, etc.). It's nearly impossible for users to determine which certificate to add to pageant/putty, and "Autoload Certs" loads all of the available certs which leads to errors like:

The smart card cannot perform the requested operation or the operation requires a different smart card.

We need a way to load just the certificate for the current user from the connected smart card.

Suggestion: Pageant PKCS#11 libraries shortcut

Hi,

Some times I use (or I test) the PKCS#11 API. However, It's a pain to search each time for the DLL library.

Why not include a list of used libraries? This will provide a more user friendly interface.

You agree? 😄

"Remember Certs" and "Force PIN Caching" issues

1. If both "Remember Certs" and "Force PIN Caching" are disabled, when attempting to enable "Remember Certs", "Force PIN Caching" is also automatically enabled.

2. If "Remember Certs" is enabled, enabling/disabling "Force PIN Caching" works as expected.

3. If "Force PIN Caching" is enabled and "Remember Certs" is disabled, its impossible to enable "Remember Certs" without first disabling "Force PIN Caching" (which then as point 1, will enable both)

Built-in support for Yubikeys

After lots of trying I finally found a way to use my Yubikey paired with Putty-CAC.
Though there are 2 programs in between. One of them being OpenSC, which in turn seems to need Yubico-PIV-Manager (which loads the certificate into Windows certmanager where it can be read by OpenSC as pkcs-11).
Is there a way to simply start Pageant.exe and import the Yubikey without having to initialize the Yubico-PIV-Manager as well as OpenSC beforehand?
Thanks in advance once more!