  	sc_unlock(card);
  	if (r < 0) {
  		error("sc_pkcs15_decipher() failed: %s", sc_strerror(r));
-@@ -423,9 +472,14 @@
+@@ -185,6 +242,9 @@
+ 	return -1;
+ }
+ 
++#define SC_USAGE_SIGN 		SC_PKCS15_PRKEY_USAGE_SIGN | \
++				SC_PKCS15_PRKEY_USAGE_SIGNRECOVER
++
+ static int
+ sc_sign(int type, u_char *m, unsigned int m_len,
+ 	unsigned char *sigret, unsigned int *siglen, RSA *rsa)
+@@ -193,7 +253,15 @@
+ 	int r;
+ 	unsigned long flags = 0;
+ 
+-	r = sc_prkey_op_init(rsa, &key_obj);
++	/* XXX: sc_prkey_op_init will search for a pkcs15 private
++	 * key object with the sign or signrecover usage flag set.
++	 * If the signing key has only the non-repudiation flag set
++	 * the key will be rejected as using a non-repudiation key
++	 * for authentication is not recommended. Note: This does not
++	 * prevent the use of a non-repudiation key for authentication
++	 * if the sign or signrecover flag is set as well. 
++	 */
++	r = sc_prkey_op_init(rsa, &key_obj, SC_USAGE_SIGN);
+ 	if (r)
+ 		return -1;
+ 	/* FIXME: length of sigret correct? */
+@@ -423,9 +491,14 @@
  		}
  		key_count = r;
  	}

 
 SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
 	sshconnect.o sshconnect1.o sshconnect2.o
diff -udrNP openssh-3.6.1p2.orig/scard-opensc.c openssh-3.6.1p2/scard-opensc.c
--- openssh-3.6.1p2.orig/scard-opensc.c	2002-04-23 14:48:46.000000000 +0200
+++ openssh-3.6.1p2/scard-opensc.c	2003-06-16 11:35:13.000000000 +0200
@@ -89,6 +89,12 @@
 	r = sc_establish_context(&ctx, "openssh");
 	if (r)
 		goto err;

 	r = sc_connect_card(ctx->reader[sc_reader_id], 0, &card);
 	if (r)
 		goto err;
@@ -104,7 +112,8 @@
 /* private key operations */
 
 static int
-sc_prkey_op_init(RSA *rsa, struct sc_pkcs15_object **key_obj_out)
+sc_prkey_op_init(RSA *rsa, struct sc_pkcs15_object **key_obj_out,
+	unsigned int usage)
 {
 	int r;
 	struct sc_priv_data *priv;
@@ -124,7 +133,8 @@
 			goto err;
 		}
 	}
-	r = sc_pkcs15_find_prkey_by_id(p15card, &priv->cert_id, &key_obj);
+	r = sc_pkcs15_find_prkey_by_id_usage(p15card, &priv->cert_id, 
+		usage, &key_obj);
 	if (r) {
 		error("Unable to find private key from SmartCard: %s",
 		      sc_strerror(r));
@@ -133,12 +143,55 @@
 	key = key_obj->data;
 	r = sc_pkcs15_find_pin_by_auth_id(p15card, &key_obj->auth_id,
 					  &pin_obj);
