  
  SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
  	sshconnect.o sshconnect1.o sshconnect2.o
+diff -udrNP openssh-3.6.1p2.orig/scard.c openssh-3.6.1p2/scard.c
+--- openssh-3.6.1p2.orig/scard.c	2002-06-23 23:23:20.000000000 +0200
++++ openssh-3.6.1p2/scard.c	2003-07-23 12:19:29.000000000 +0200
+@@ -35,6 +35,9 @@
+ #include "readpass.h"
+ #include "scard.h"
+ 
++/* currently unused */
++int ask_for_pin = 0;
++
+ #if OPENSSL_VERSION_NUMBER < 0x00907000L
+ #define USE_ENGINE
+ #define RSA_get_default_method RSA_get_default_openssl_method
+diff -udrNP openssh-3.6.1p2.orig/scard.h openssh-3.6.1p2/scard.h
+--- openssh-3.6.1p2.orig/scard.h	2002-07-04 02:14:18.000000000 +0200
++++ openssh-3.6.1p2/scard.h	2003-07-23 12:18:46.000000000 +0200
+@@ -33,6 +33,8 @@
+ #define SCARD_ERROR_NOCARD	-2
+ #define SCARD_ERROR_APPLET	-3
+ 
++extern int ask_for_pin;
++
+ Key	**sc_get_keys(const char *, const char *);
+ void	 sc_close(void);
+ int	 sc_put_key(Key *, const char *);
 diff -udrNP openssh-3.6.1p2.orig/scard-opensc.c openssh-3.6.1p2/scard-opensc.c
 --- openssh-3.6.1p2.orig/scard-opensc.c	2002-04-23 14:48:46.000000000 +0200
-+++ openssh-3.6.1p2/scard-opensc.c	2003-06-16 11:35:13.000000000 +0200
-@@ -89,6 +89,12 @@
++++ openssh-3.6.1p2/scard-opensc.c	2003-07-23 12:26:00.000000000 +0200
+@@ -38,6 +38,8 @@
+ #include "readpass.h"
+ #include "scard.h"
+ 
++int ask_for_pin=0;
++
+ #if OPENSSL_VERSION_NUMBER < 0x00907000L && defined(CRYPTO_LOCK_ENGINE)
+ #define USE_ENGINE
+ #define RSA_get_default_method RSA_get_default_openssl_method
+@@ -89,6 +91,12 @@
  	r = sc_establish_context(&ctx, "openssh");
  	if (r)
  		goto err;

 	r = sc_lock(card);
 	if (r) {
 		error("Unable to lock smartcard: %s", sc_strerror(r));
@@ -173,7 +221,8 @@
 	r = sc_prkey_op_init(rsa, &key_obj);
 	if (r)
 		return -1;
-	r = sc_pkcs15_decipher(p15card, key_obj, 0, from, flen, to, flen);

 	sc_unlock(card);
 	if (r < 0) {
 		error("sc_pkcs15_decipher() failed: %s", sc_strerror(r));
@@ -185,6 +242,9 @@
 	return -1;
 }
 
+#define SC_USAGE_SIGN 		SC_PKCS15_PRKEY_USAGE_SIGN | \
+				SC_PKCS15_PRKEY_USAGE_SIGNRECOVER
+
 static int
 sc_sign(int type, u_char *m, unsigned int m_len,
 	unsigned char *sigret, unsigned int *siglen, RSA *rsa)
@@ -193,7 +253,15 @@
 	int r;
 	unsigned long flags = 0;
 
-	r = sc_prkey_op_init(rsa, &key_obj);
+	/* XXX: sc_prkey_op_init will search for a pkcs15 private
+	 * key object with the sign or signrecover usage flag set.
+	 * If the signing key has only the non-repudiation flag set
+	 * the key will be rejected as using a non-repudiation key
+	 * for authentication is not recommended. Note: This does not
+	 * prevent the use of a non-repudiation key for authentication
+	 * if the sign or signrecover flag is set as well. 
+	 */
+	r = sc_prkey_op_init(rsa, &key_obj, SC_USAGE_SIGN);
 	if (r)
 		return -1;
 	/* FIXME: length of sigret correct? */
@@ -423,9 +491,14 @@
 		}
 		key_count = r;
 	}
