ssh-agent-pkcs11 VS trezor-agent

It hasn't been able to do it in a meaningful way.

I've been patching support for this into ssh-agent for about a decade. I wrote a PKCS#11 module which talks to the SSH agent socket to forward your smartcard [0]. Doing so requires three changes to the protocol:

1. The ability to sign arbitrary data and get back the signed result [1]; normally you get back a hashed result [2].

2. The ability to decrypt data, this is what you said. This is less important since many things only require signatures (and not all algorithms support encryption/decryption).

3. The ability to request your certificates [3] [4] this one is kinda obvious.

The benefits of this are that you can use your smartcard on the remote host to do fully authenticated password-less sudo with pam_pkcs11. You can also do anything else that requires you to use your private key to be used, which can include fetching files (TLS client certificate authentication).

Within the US Government, passwords have been being phased out since 2004, but the requirements for authenticated privilege elevation remain.

Another way to accomplish this is to use SSH forwarding of your PC/SC socket but that's less portable and more fragile (and even less secure).

[0] https://github.com/rkeene/ssh-agent-pkcs11

[1] https://cackey.rkeene.org/fossil/artifact/0d0e90bbfdee672c?l...

[2] https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent...

[3] https://cackey.rkeene.org/fossil/artifact/0d0e90bbfdee672c?l...

[4] https://datatracker.ietf.org/doc/html/rfc6187#section-2.1

It doesn't support signing and authentication subkeys (But maybe it will soon!).

GPG "master keys" are on the Trezor, which has no mass storage. You can read more how to use if for GPG in here: https://github.com/romanz/trezor-agent/blob/master/doc/README-GPG.md. Trezor needs a PIN + passphrase typed on the device to be secure from physical attacks (Google: trezor hacked).

I use romanz/trezor-agent and it is recommended on the official trezor wiki.

it looks like someone on the github for the Trezor GPG has worked on it but I have no clue how to run this script. Here's the first link I found under the issues tab.

I'd been working with the trezor-gpg and trezor-ssh features recently, but found them difficult to configure in Windows. When I saw the WSL-2 article on usbipd, found everything worked great.

Ledger/Trezor have solved this since ~2016. I have a Ledger that has a private key inside and using a small open source tool (https://github.com/romanz/trezor-agent) I can SSH into machines, sign random data and Github commits and FIDO authenticate into several websites. All of that and knowing that these devices offer some of the best security out there.

SSH/PGP agent is a proxy application intended to work with https://github.com/romanz/trezor-agent