It hasn't been able to do it in a meaningful way. I've been patching support for this into ssh-agent for about a decade. I wrote a PKCS#11 module which talks

It hasn't been able to do it in a meaningful way. I've been patching support for this into ssh-agent for about a decade. I wrote a PKCS#11 module which talks to the SSH agent socket to forward your smartcard [0]. Doing so requires three changes to the protocol: 1. The ability to sign arbitrary data and get back the signed result [1]; normally you get back a hashed result [2]. 2. The ability to decrypt data, this is what you said. This is less important since many things only require signatures (and not all algorithms support encryption/decryption). 3. The ability to request your certificates [3] [4] this one is kinda obvious. The benefits of this are that you can use your smartcard on the remote host to do fully authenticated password-less sudo with pam_pkcs11. You can also do anything else that requires you to use your private key to be used, which can include fetching files (TLS client certificate authentication). Within the US Government, passwords have been being phased out since 2004, but the requirements for authenticated privilege elevation remain. Another way to accomplish this is to use SSH forwarding of your PC/SC socket but that's less portable and more fragile (and even less secure). [0] https://github.com/rkeene/ssh-agent-pkcs11 https://github.com/rkeene/ssh-agent-pkcs11 [1] https://cackey.rkeene.org/fossil/artifact/0d0e90bbfdee672c?ln=481-482%20561-563%20573-576 https://cackey.rkeene.org/fossil/artifact/0d0e90bbfdee672c?l... [2] https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent-00#section-4.5.1 https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent... [3] https://cackey.rkeene.org/fossil/artifact/0d0e90bbfdee672c?ln=296-312 https://cackey.rkeene.org/fossil/artifact/0d0e90bbfdee672c?l... [4] https://datatracker.ietf.org/doc/html/rfc6187#section-2.1 https://datatracker.ietf.org/doc/html/rfc6187#section-2.1