It's just the agent protocol, used by sshd instead of ssh, to make signing requests with a host key (instead of a user's identity key).
That's cool, I wasn't aware that the server supports the agent protocol as well. Thank you for the pointer!
It makes a lot of sense, since it avoids having to link the HSM/PCKS#11 stuff against sshd.
Re:We updated our RSA SSH host key
by throw0101b on Friday March 24, 2023 @10:59AM
(#35289907)
> I can't find any OpenSSH documentation of either (server-side) PCKS#11/HSM support
OpenSSHd talks to an ssh-agent that then talks to the HSM:
> Identifies the UNIX-domain socket used to communicate with an agent that has access to the private host keys. If the string "SSH_AUTH_SOCK" is specified, the location of the socket will be read from the SSH_AUTH_SOCK environment variable.
I‘m aware of the PKCS#11 integration in the OpenSSH client and have dabbled a bit with it but was not aware of any server side equivalent.
And how does TLS fit in here? SSH is a very different protocol from that, no?
Update: I can't find any OpenSSH documentation of either (server-side) PCKS#11/HSM support or kernel-mode cryptography (which also in the case of Linux only addresses symmetric encryption to my knowledge, at least the mainline kernel version I know of).
Maybe you're thinking of some other SSH implementation? The protocol definitely allows for server-side HSM usage, and Github at their scale is not bound to OpenSSH in any way.