Non-interactive open_asym

[karalabe]

Currently I can start a shell session with the --device-pubkey flag set, and then manually inject the key via:

yubihsm> connect
yubihsm> session open_async 0 secret.key

Seems that whereas there's support for specifying the yubikey based asymmetric auth options on the CLI, there is no flag to specify the private key to use directly. Would it be possible to add one so I could use yubihsm-shell non-interactively for user-managed private keys too?

---

Also, a related ask, the --device-pubkey flag currently takes a raw hex string, which seems an odd one. The key would usually be distributed to someone in an attested certificate that they could look at, from which it's easy to get the PEM/DER pubkey out, but getting the raw hex is quite a feat:

$ openssl x509 -in devicekey.cert -noout -pubkey \ 
    | openssl ec -pubin -noout -text 2>/dev/null \
    | grep '^    ' | tr -d ' :\n'

Would it be possible to expand the flag so it can be a file too, and also whether it could be backed by something a bit more standard (e.g. PEM) rather than a raw hex dump? Thank you

[aveenismail]

I have now created tickets to consider these features for the next release