SSH HSM Public Key Authentication

See more SSH Examples

Demonstrates SSH public-key authentication using a private key stored on an HSM — a USB token or smart card — accessed through PKCS#11. A session is opened with the vendor's driver, the key handles are located, and an SshKey object is bound to them with UsePkcs11.

const std = @import("std");
const chilkat = @import("chilkat");

pub fn main(init: std.process.Init) !void {
    const alloc = init.arena.allocator();

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // Demonstrates SSH public-key authentication using a private key stored on an HSM (a USB token
    // or smart card) accessed through PKCS#11.
    //
    // Note: Chilkat's PKCS#11 implementation runs on Windows, Linux, macOS, and other supported
    // operating systems.

    const pkcs11 = try chilkat.Pkcs11.init();
    defer pkcs11.deinit();

    // The PKCS#11 driver supplied by your HSM vendor: a .dll on Windows, a .so on Linux, or a
    // .dylib on macOS.
    pkcs11.setSharedLibPath("C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll");

    // The PIN should come from a secure source rather than being hard-coded.
    const pin = "0000";

    // Normal user = 1
    const user_type = 1;

    pkcs11.quickSession(user_type, pin) catch {
        std.debug.print("{s}\n", .{try pkcs11.getLastErrorText(alloc)});
        return;
    };

    // Describe the private key object to be located on the HSM.
    const json = try chilkat.JsonObject.init();
    defer json.deinit();
    json.updateString("class", "private_key") catch {};
    json.updateString("label", "MySshKey") catch {};

    const priv_handle = pkcs11.findObject(json);
    if (priv_handle == 0) {
        std.debug.print("{s}\n", .{try pkcs11.getLastErrorText(alloc)});
        return;
    }

    // Find the corresponding public key by changing the class in the same template.
    json.updateString("class", "public_key") catch {};

    const pub_handle = pkcs11.findObject(json);
    if (pub_handle == 0) {
        std.debug.print("{s}\n", .{try pkcs11.getLastErrorText(alloc)});
        return;
    }

    // Create an SSH key object that uses the HSM handles.  The key type may be "rsa" or "ec".
    const key = try chilkat.SshKey.init();
    defer key.deinit();
    const key_type = "rsa";
    key.usePkcs11(pkcs11, priv_handle, pub_handle, key_type) catch {
        std.debug.print("{s}\n", .{try key.getLastErrorText(alloc)});
        return;
    };

    const ssh = try chilkat.Ssh.init();
    defer ssh.deinit();

    const port = 22;
    ssh.connect("ssh.example.com", port) catch {
        std.debug.print("{s}\n", .{try ssh.getLastErrorText(alloc)});
        return;
    };

    // The corresponding public key must already be installed on the SSH server for the account.
    // The signing operation happens on the HSM -- the private key never leaves the device.
    ssh.authenticatePk("mySshLogin", key) catch {
        std.debug.print("{s}\n", .{try ssh.getLastErrorText(alloc)});
        return;
    };

    std.debug.print("Public-key authentication successful.\n", .{});

    ssh.disconnect();

    pkcs11.logout() catch {};
    pkcs11.closeSession() catch {};
}