OpenSSH 10.x regression for PKCS#11 smart cards

[acdha]

Output of brew config

HOMEBREW_VERSION: 5.0.1
ORIGIN: https://github.com/Homebrew/brew
HEAD: e8b7739de9f5dfd154a742e83b2a72ac1222fed2
Last commit: 25 hours ago
Branch: stable
Core tap JSON: 13 Nov 18:00 UTC
Core cask tap JSON: 13 Nov 18:00 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_BAT_THEME: OneHalfDark
HOMEBREW_CASK_OPTS: []
HOMEBREW_DOWNLOAD_CONCURRENCY: 20
HOMEBREW_EDITOR: vim
HOMEBREW_FORBID_PACKAGES_FROM_PATHS: set
HOMEBREW_MAKE_JOBS: 10
Homebrew Ruby: 3.4.5 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.4.5/bin/ruby
CPU: deca-core 64-bit arm_firestorm_icestorm
Clang: 17.0.0 build 1700
Git: 2.51.2 => /opt/homebrew/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 15.7.2-arm64
CLT: 26.1.0.0.1.1761104275
Xcode: 26.1.1
Rosetta 2: false

Output of brew doctor

Your system is ready to brew.

Description of issue

OpenSSH 10.0 introduced a regression to the PKCS#11 interface. This breaks SSH public-key authentication using keys on smart cards or tokens such as Yubikeys using either Apple's official ssh-keychain.dylib or Yubico's libykcs11.

This was fixed upstream but the last 10.2 release was cut before that happened:

https://bugzilla.mindrot.org/show_bug.cgi?id=3879

openssh/openssh-portable@V_10_2_P1...V_10_2

Debian has cherry-picked the patch into their packages: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117720

I believe this is also behind https://bugzilla.suse.com/show_bug.cgi?id=1253184.

I think it would be useful for Homebrew to consider back-porting that patch as well because the failure mode here can be that someone is unable to authenticate with a fairly obscure error.

[p-linnane]

I've opened Homebrew/homebrew-core#254333 to add the patches.

[acdha]

Thanks! I wasn't sure whether it was better to open an issue or the discussion for something like this.

[p-linnane]

Issue is fine since it's a bug that should be fixed in the package.

[p-linnane]

@acdha Can you brew reinstall openssh and let me know if your issue is fixed?

[acdha]

That worked perfectly, thank you!

[pentiumoverdrive]

Is this patched version available?

I just upgraded openssh and it broke yubikey support for ssh-agent.
Running OpenSSH_10.2p1, OpenSSL 3.6.0 1 Oct 2025

did a reinstall as well, no difference.
Should not these patches make it OpenSSH_10.2p2?

[p-linnane]

No, we don't change the version number when we add a patch. That's an upstream decision.

The formula hasn't been changed since I added this patch and it was confirmed working. You might be encountering a different issue, or the patch doesn't cover what you're trying to do.

[pentiumoverdrive]

Alright, I know several people who the 10.x upgrade broke yubikey integration.
We load the key handler from the discoverable ssh key in the yubikey into ssh-agent as follows:
(all ssh commands starts from /opt/homebrew/bin/)

eval `ssh-agent`
ssh-add -K
Enter PIN for authenticator:
Resident identity added: ED25519-SK SHA256:...
Resident identity added: ED25519-SK SHA256:...

Then we ssh into something and the yubikey human touch verification never activates (lights up) and nothing happens if you touch it anyway. So eventuelly the ssh login times out.
I downgraded to OpenSSH_9.9p2, OpenSSL 3.6.0 1 Oct 2025 and everything is back to normal.
Is this not related to this particular patched regressions or have we hit something else?

[SMillerDev]

The original Debian bug mentions that it fails to ask for a pin. That's not what you describe though. I think you should report this separately.