(PureBasic) SSH HSM Public Key Authentication

Demonstrates how to authenticate with an SSH server using public key authentication using an HSM (USB token or smartcard).

Chilkat PureBasic Module Download Chilkat PureBasic Module

IncludeFile "CkPkcs11.pb"
IncludeFile "CkJsonObject.pb"
IncludeFile "CkSsh.pb"
IncludeFile "CkSshKey.pb"

Procedure ChilkatExample()

    ; This example assumes the Chilkat API to have been previously unlocked.
    ; See Global Unlock Sample for sample code.

    ; Note: Chilkat's PKCS11 implementation runs on Windows, Linux, MacOs, and other supported operating systems.

    pkcs11.i = CkPkcs11::ckCreate()
    If pkcs11.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ; This would be a path to a .dylib on MacOS, or a path to a .so shared lib on Linux.
    CkPkcs11::setCkSharedLibPath(pkcs11, "C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS1164.dll")
    pin.s = "0000"
    userType.i = 1

    ; Establish a PKCS11 logged-on session using the driver (.so, .dylib, or .dll) as specified in the SharedLibPath above.
    success.i = CkPkcs11::ckQuickSession(pkcs11,userType,pin)
    If success = 0
        Debug CkPkcs11::ckLastErrorText(pkcs11)
        CkPkcs11::ckDispose(pkcs11)
        ProcedureReturn
    EndIf

    ; Set PKCS11 attributes to find our desired private key object.
    json.i = CkJsonObject::ckCreate()
    If json.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkJsonObject::ckUpdateString(json,"class","private_key")
    CkJsonObject::ckUpdateString(json,"label","MySshKey")

    ; Get the PKCS11 handle to the private key located on the HSM.
    priv_handle.i = CkPkcs11::ckFindObject(pkcs11,json)

    ; Get the PKCS11 handle to the corresponding public key located on the HSM.
    CkJsonObject::ckUpdateString(json,"class","public_key")

    pub_handle.i = CkPkcs11::ckFindObject(pkcs11,json)

    key.i = CkSshKey::ckCreate()
    If key.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ; The key type can be "rsa" or "ec"
    keyType.s = "rsa"
    success = CkSshKey::ckUsePkcs11(key,pkcs11,priv_handle,pub_handle,keyType)
    If success = 0
        Debug CkSshKey::ckLastErrorText(key)
        CkPkcs11::ckDispose(pkcs11)
        CkJsonObject::ckDispose(json)
        CkSshKey::ckDispose(key)
        ProcedureReturn
    EndIf

    ssh.i = CkSsh::ckCreate()
    If ssh.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkSsh::ckConnect(ssh,"example.com",22)
    If success <> 1
        Debug CkSsh::ckLastErrorText(ssh)
        CkPkcs11::ckDispose(pkcs11)
        CkJsonObject::ckDispose(json)
        CkSshKey::ckDispose(key)
        CkSsh::ckDispose(ssh)
        ProcedureReturn
    EndIf

    ; Authenticate with the SSH server using the login and
    ; HSM private key.  (The corresponding public key should've 
    ; been installed on the SSH server beforehand.)
    success = CkSsh::ckAuthenticatePk(ssh,"myLogin",key)
    If success <> 1
        Debug CkSsh::ckLastErrorText(ssh)
        CkPkcs11::ckDispose(pkcs11)
        CkJsonObject::ckDispose(json)
        CkSshKey::ckDispose(key)
        CkSsh::ckDispose(ssh)
        ProcedureReturn
    EndIf

    Debug "Public-Key Authentication Successful!"


    CkPkcs11::ckDispose(pkcs11)
    CkJsonObject::ckDispose(json)
    CkSshKey::ckDispose(key)
    CkSsh::ckDispose(ssh)


    ProcedureReturn
EndProcedure