Update the manpages with respect to SSH agents (46c906e) - derivepassphrase.git

Update the manpages with respect to SSH agents

Marco Ricci commited on 2026-02-08 19:38:24
Zeige 2 geänderte Dateien mit 201 Einfügungen und 19 Löschungen.

Add a section on SSH agent socket providers, and documentation for the
new `--ssh-agent-socket-provider` option and the new "The SSH agent
socket provider %s is not in derivepassphrase's provider registry."
error message.  Also update the section on SSH key suitability, and
remove the entry on Windows incompatibility from the Bugs section.

docs/reference/derivepassphrase-vault.1.md c1a0503..b56ce16
share/man/man1/derivepassphrase-vault.1 0fcc675..3f1645f

docs/reference/derivepassphrase-vault.1.md

Zeige Datei @ 46c906e

@@ -23,7 +23,7 @@ The derivation is also <em>deterministic</em>, given the same inputs, thus the r
 
 The service name and constraints themselves also need not be kept secret; the latter are usually stored in a world-readable file to ease repeated entry of passphrase constraints.
 
-In lieu of a master passphrase, a master SSH key can also be used if there is a reachable, running SSH agent currently holding this key and if the key type is supported.  (See ["SSH KEY SUITABILITY"](#ssh-key-suitability) and ["BUGS"](#bugs) below.)  This too is compatible with <i>vault</i>(1).
+In lieu of a master passphrase, a master SSH key can also be used if there is a reachable, running SSH agent currently holding this key and if the key type is supported.  (See ["SSH AGENT SOCKET PROVIDERS"](#ssh-agent-socket-providers), ["SSH KEY SUITABILITY"](#ssh-key-suitability) and ["BUGS"](#bugs) below.)  This too is compatible with <i>vault</i>(1).
 
 ## OPTIONS
 
@@ -47,6 +47,9 @@ All character constraints refer to ASCII printable characters only (space (`U+00
 
     See also ["Configuration"](#configuration) for how this interacts with a stored passphrase or SSH key.
 
+    <b>derivepassphrase</b> uses so-called <i>SSH agent socket providers</i> to configure how it connects to the SSH agent.
+    See ["SSH AGENT SOCKET PROVIDERS"](#ssh-agent-socket-providers) for details.
+
 <b>-l</b> <var>n</var>, <b>-</b><b>-length</b> <var>n</var>
 :   Force the passphrase to have the length <var>n</var>.
     Defaults to the length <b>20</b> if not specified, or if explicitly specified as <code>0</code>.
@@ -181,6 +184,14 @@ The compatibility and extension options modify the behavior to enable additional
 
     (<i>vault</i>(1) behaves as if `--print-notes-after` were always given.)
 
+<b>-</b><b>-ssh-agent-socket-provider</b> <var>PROVIDER</var>
+:   When deriving a passphrase using an SSH key, use the named socket provider to connect to the SSH agent.
+    If not given, use the provider given in the configuration file, if any, else a platform-appropriate default provider.
+
+    (See ["SSH AGENT SOCKET PROVIDERS"](#ssh-agent-socket-providers) for details.)
+
+    (<i>vault</i>(1) behaves as if the built-in `ssh_auth_sock_on_unix` provider were always requested.)
+
 ### Other Options
 
 <b>-</b><b>-debug</b>
@@ -216,16 +227,58 @@ The script assumes a conforming <i>sh</i>(1), with support for "here" documents.
 
     **Do not run these emitted shell scripts directly without double-checking their output first!**
 
+## SSH AGENT SOCKET PROVIDERS
+
+An <dfn>SSH agent socket provider</dfn> is a named configuration (and associated support code) that teaches <b>derivepassphrase</b> how to connect to a specific SSH agent.
+Such providers can either be built-in, or contributed by third-party software, and may be dependent on a specific operating system and/or further third-party software.
+
+<b>derivepassphrase</b> ships with the following built-in providers:
+
+`ssh_auth_sock_on_posix`
+:   connects to an SSH agent named by the `SSH_AUTH_SOCK` enviroment variable, using UNIX domain sockets
+
+`ssh_auth_sock_on_windows`
+:   connects to an SSH agent named by the `SSH_AUTH_SOCK` enviroment variable, using Windows named pipes
+
+`openssh_on_windows`
+:   connects to the Powershell/"Win32" port of OpenSSH at its standard address, using Windows named pipes
+
+`pageant_on_windows`
+:   connects to Pageant on Windows at its standard address, using Windows named pipes
+
+and the following standard aliases:
+
+`unix_domain`
+:   alias for `ssh_auth_sock_on_posix`
+
+`windows_named_pipe`
+:   alias for `ssh_auth_sock_on_windows`
+
+`posix`
+:   alias for `unix_domain`
+
+`windows`
+:   alias for `windows_named_pipe`
+
+`native`
+:   alias for `posix` or `windows`, depending on the operating system
+
+(You are strongly advised to use a true provider name instead of an alias, if feasible.)
+
+The list of currently available and otherwise known SSH agent socket providers is part of the feature information emitted by `--version`.
+
 ## SSH KEY SUITABILITY
 
 An SSH key is <dfn>suitable</dfn> for use with <b>derivepassphrase vault</b> if the SSH agent guarantees that signatures produced with this key will be <em>deterministic</em>, given the same message to be signed.
 This is a property specific to the key type, and sometimes the agent used:
 
-  * RSA, Ed25519 and Ed448 keys are always suitable.
-    OpenSSH’s <i>ssh-agent</i>(1) supports only these keys as suitable keys.
+  * RSA, Ed25519 and Ed448 keys are always suitable, by design of the key type.
 
   * DSA and ECDSA keys are suitable if the SSH agent supports deterministic DSA signatures, e.g. by implementing RFC 6979.
-    PuTTY’s <i>pageant</i>(1) supports this, in addition to the always-suitable keys mentioned above.
+
+  * As of version 10.2 (October 2025), OpenSSH’s <i>ssh-agent</i>(1) supports only some of the always-suitable key types: RSA and Ed25519 keys.
+
+  * As of version 0.83 (February 2025), PuTTY’s <i>pageant</i>(1) supports all the key types mentioned above, including DSA and ECDSA keys via deterministic signatures.
 
 ## ENVIRONMENT
 
@@ -390,6 +443,14 @@ The <b>derivepassphrase vault</b> utility exits 0 on success, and >0 if an error
 
     (Exactly what it says.)
 
+<!-- Message-ID: ErrMsgTemplate.UNKNOWN_SSH_AGENT_SOCKET_PROVIDER -->
+??? failure "`The SSH agent socket provider %s is not in derivepassphrase's provider registry.`"
+
+    The requested SSH agent socket provider is unknown to <b>derivepassphrase</b>.
+    The provider name may be misspelled, or it may be provided by an external software package that is not installed on this system.
+
+    The list of SSH agent socket providers currently known to <b>derivepassphrase</b> may be queried via <b>derivepassphrase vault <span>-</span>-version</b>.
+
 <!-- Message-ID: ErrMsgTemplate.USER_ABORTED_EDIT -->
 ??? failure "`Not saving any new notes: the user aborted the request.`"
 
@@ -556,5 +617,3 @@ Exceptions:
 
   * The defaults are dictated by <i>vault</i>(1), necessitating the ["Compatibility and extension options"](#compatibility-and-extension-options).
     (WONTFIX.)
-
-  * The Windows version does not support SSH keys because Python on Windows does not support the predominant type of inter-process communication used by SSH agents on Windows.

share/man/man1/derivepassphrase-vault.1

Zeige Datei @ 46c906e

@@ -81,6 +81,7 @@ key can also be used if there is a reachable, running
 .Tn SSH
 agent currently holding this key and if the key type is supported.
 (See
+.Sx "SSH AGENT SOCKET PROVIDERS" ,
 .Sx "SSH KEY SUITABILITY"
 and
 .Sx BUGS
@@ -156,6 +157,16 @@ See also
 for how this interacts with a stored passphrase or
 .Tn SSH
 key.
+.Pp
+.Nm derivepassphrase
+uses so-called
+.Dq Tn SSH No agent socket providers
+to configure how it connects to the
+.Tn SSH
+agent.
+See
+.Sx "SSH AGENT SOCKET PROVIDERS"
+for details.
 .
 .It Fl l Ar n , Fl \-length Ar n
 Force the passphrase to have the length
@@ -482,6 +493,25 @@ behaves as if
 .Fl \-print\-notes\-after
 were always given.)
 .
+.It Fl \-ssh\-agent\-socket\-provider Ar PROVIDER
+When deriving a passphrase using an SSH key, use the named socket provider
+to connect to the
+.Tn SSH
+agent.
+If not given, use the provider given in the configuration file, if any,
+else a platform-appropriate default provider.
+.Pp
+.
+(See
+.Sx "SSH AGENT SOCKET PROVIDERS"
+for details.)
+.Pp
+.
+.Xr ( vault 1
+behaves as if the built-in
+.Li ssh_auth_sock_on_unix
+provider were always requested.)
+.
 .El
 .
 .Ss Other options
@@ -556,6 +586,78 @@ Do not run these emitted shell scripts directly without double-checking
 their output first!
 .Ef
 .
+.Sh SSH AGENT SOCKET PROVIDERS
+.
+An
+.Dq Tn SSH No agent socket provider
+is a named configuration
+.Pq and associated support code
+that teaches
+.Nm derivepassphrase
+how to connect to a specific
+.Tn SSH
+agent.
+Such providers can either be built-in, or contributed by third-party software,
+and may be dependent on a specific operating system and/or further third-party
+software.
+.Pp
+.Nm derivepassphrase
+ships with the following built-in providers:
+.Bl -ohang -offset indent
+.It Li ssh_auth_sock_on_posix
+connects to an
+.Tn SSH
+agent named by the
+.Ev SSH_AUTH_SOCK
+environment variable, using
+.Tn UNIX
+domain sockets
+.It Li ssh_auth_sock_on_windows
+connects to an
+.Tn SSH
+agent named by the
+.Ev SSH_AUTH_SOCK
+environment variable, using Windows named pipes
+.It Li openssh_on_windows
+connects to the
+.Pf Powershell Pf / Dq Win32
+port of
+.Tn OpenSSH
+at its standard address, using Windows named pipes
+.It Li pageant_on_windows
+connects to Pageant on Windows at its standard address, using Windows named pipes
+.El
+.Pp
+and the following standard aliases:
+.Bl -ohang -offset indent
+.It Li unix_domain
+alias for
+.Li ssh_auth_sock_on_posix
+.It Li windows_named_pipe
+alias for
+.Li ssh_auth_sock_on_windows
+.It Li posix
+alias for
+.Li unix_domain
+.It Li windows
+alias for
+.Li windows_named_pipe
+.It Li native
+alias for
+.Li posix
+or
+.Li windows ,
+depending on the operating system
+.El
+.Pp
+(You are strongly advised to use a true provider name instead of an alias,
+if feasible.)
+.Pp
+The list of currently available and otherwise known
+.Tn SSH
+agent socket providers is part of the feature information emitted by
+.Fl \-version .
+.
 .Sh SSH KEY SUITABILITY
 .
 An
@@ -580,10 +682,7 @@ and sometimes the agent used:
 .Tn Ed25519
 and
 .Tn Ed448
-keys are always suitable.
-.Tn OpenSSH Ns No 's
-.Xr ssh-agent 1
-supports only these keys as suitable keys.
+keys are always suitable, by design of the key type.
 .
 .It
 .Tn DSA
@@ -595,9 +694,26 @@ agent supports deterministic
 .Tn DSA
 signatures, e.g. by implementing
 .Tn RFC 6979 .
+.
+.It
+As of version 10.2 (October 2025),
+.Tn OpenSSH Ns No 's
+.Xr ssh-agent 1
+supports only some of the always-suitable key types:
+.Tn RSA
+and
+.Tn Ed25519
+keys.
+.
+.It
+As of version 0.83 (February 2025),
 .Tn PuTTY Ns No 's
 .Xr pageant 1
-supports this, in addition to the always-suitable keys mentioned above.
+supports all key types mentioned above, including
+.Tn DSA
+and
+.Tn ECDSA
+keys via deterministic signatures.
 .
 .El
 .
@@ -879,6 +995,21 @@ agent must fulfill to be suitable.
 .
 (Exactly what it says.)
 .
+.\" Message-ID: ErrMsgTemplate.UNKNOWN_SSH_AGENT_SOCKET_PROVIDER
+.It The SSH agent socket provider %s is not in derivepassphrase's provider registry.
+The requested
+.Tn SSH
+agent socket provider is unknown to
+.Nm derivepassphrase .
+The provider name may be misspelled, or it may be provided by an external
+software package that is not installed on this system.
+.Pp
+The list of
+.Tn SSH agent socket providers currently known to
+.Nm derivepassphrase
+may be queried via
+.Li derivepassphrase vault Fl \-version .
+.
 .\" Message-ID: ErrMsgTemplate.USER_ABORTED_EDIT
 .It Not saving any new notes: the user aborted the request.
 (Exactly what it says.)
@@ -1178,13 +1309,5 @@ necessitating the
 .Sx Compatibility and extension options .
 .Pq WONTFIX.
 .
-.It
-The Windows version does not support
-.Tn SSH
-keys because Python on Windows does not support the predominant type of
-inter-process communication used by
-.Tn SSH
-agents on Windows.
-.
 .El
 .


...	...	@@ -23,7 +23,7 @@ The derivation is also <em>deterministic</em>, given the same inputs, thus the r
23	23
24	24	The service name and constraints themselves also need not be kept secret; the latter are usually stored in a world-readable file to ease repeated entry of passphrase constraints.
25	25
26		-In lieu of a master passphrase, a master SSH key can also be used if there is a reachable, running SSH agent currently holding this key and if the key type is supported. (See ["SSH KEY SUITABILITY"](#ssh-key-suitability) and ["BUGS"](#bugs) below.) This too is compatible with <i>vault</i>(1).
	26	+In lieu of a master passphrase, a master SSH key can also be used if there is a reachable, running SSH agent currently holding this key and if the key type is supported. (See ["SSH AGENT SOCKET PROVIDERS"](#ssh-agent-socket-providers), ["SSH KEY SUITABILITY"](#ssh-key-suitability) and ["BUGS"](#bugs) below.) This too is compatible with <i>vault</i>(1).
27	27
28	28	## OPTIONS
29	29
...	...	@@ -47,6 +47,9 @@ All character constraints refer to ASCII printable characters only (space (`U+00
47	47
48	48	See also ["Configuration"](#configuration) for how this interacts with a stored passphrase or SSH key.
49	49
	50	+ <b>derivepassphrase</b> uses so-called <i>SSH agent socket providers</i> to configure how it connects to the SSH agent.
	51	+ See ["SSH AGENT SOCKET PROVIDERS"](#ssh-agent-socket-providers) for details.
	52	+
50	53	<b>-l</b> <var>n</var>, <b>-</b><b>-length</b> <var>n</var>
51	54	: Force the passphrase to have the length <var>n</var>.
52	55	Defaults to the length <b>20</b> if not specified, or if explicitly specified as <code>0</code>.
...	...	@@ -181,6 +184,14 @@ The compatibility and extension options modify the behavior to enable additional
181	184
182	185	(<i>vault</i>(1) behaves as if `--print-notes-after` were always given.)
183	186
	187	+<b>-</b><b>-ssh-agent-socket-provider</b> <var>PROVIDER</var>
	188	+: When deriving a passphrase using an SSH key, use the named socket provider to connect to the SSH agent.
	189	+ If not given, use the provider given in the configuration file, if any, else a platform-appropriate default provider.
	190	+
	191	+ (See ["SSH AGENT SOCKET PROVIDERS"](#ssh-agent-socket-providers) for details.)
	192	+
	193	+ (<i>vault</i>(1) behaves as if the built-in `ssh_auth_sock_on_unix` provider were always requested.)
	194	+
184	195	### Other Options
185	196
186	197	<b>-</b><b>-debug</b>
...	...	@@ -216,16 +227,58 @@ The script assumes a conforming <i>sh</i>(1), with support for "here" documents.
216	227
217	228	Do not run these emitted shell scripts directly without double-checking their output first!
218	229
	230	+## SSH AGENT SOCKET PROVIDERS
	231	+
	232	+An <dfn>SSH agent socket provider</dfn> is a named configuration (and associated support code) that teaches <b>derivepassphrase</b> how to connect to a specific SSH agent.
	233	+Such providers can either be built-in, or contributed by third-party software, and may be dependent on a specific operating system and/or further third-party software.
	234	+
	235	+<b>derivepassphrase</b> ships with the following built-in providers:
	236	+
	237	+`ssh_auth_sock_on_posix`
	238	+: connects to an SSH agent named by the `SSH_AUTH_SOCK` enviroment variable, using UNIX domain sockets
	239	+
	240	+`ssh_auth_sock_on_windows`
	241	+: connects to an SSH agent named by the `SSH_AUTH_SOCK` enviroment variable, using Windows named pipes
	242	+
	243	+`openssh_on_windows`
	244	+: connects to the Powershell/"Win32" port of OpenSSH at its standard address, using Windows named pipes
	245	+
	246	+`pageant_on_windows`
	247	+: connects to Pageant on Windows at its standard address, using Windows named pipes
	248	+
	249	+and the following standard aliases:
	250	+
	251	+`unix_domain`
	252	+: alias for `ssh_auth_sock_on_posix`
	253	+
	254	+`windows_named_pipe`
	255	+: alias for `ssh_auth_sock_on_windows`
	256	+
	257	+`posix`
	258	+: alias for `unix_domain`
	259	+
	260	+`windows`
	261	+: alias for `windows_named_pipe`
	262	+
	263	+`native`
	264	+: alias for `posix` or `windows`, depending on the operating system
	265	+
	266	+(You are strongly advised to use a true provider name instead of an alias, if feasible.)
	267	+
	268	+The list of currently available and otherwise known SSH agent socket providers is part of the feature information emitted by `--version`.
	269	+
219	270	## SSH KEY SUITABILITY
220	271
221	272	An SSH key is <dfn>suitable</dfn> for use with <b>derivepassphrase vault</b> if the SSH agent guarantees that signatures produced with this key will be <em>deterministic</em>, given the same message to be signed.
222	273	This is a property specific to the key type, and sometimes the agent used:
223	274
224		- * RSA, Ed25519 and Ed448 keys are always suitable.
225		- OpenSSH’s <i>ssh-agent</i>(1) supports only these keys as suitable keys.
	275	+ * RSA, Ed25519 and Ed448 keys are always suitable, by design of the key type.
226	276
227	277	* DSA and ECDSA keys are suitable if the SSH agent supports deterministic DSA signatures, e.g. by implementing RFC 6979.
228		- PuTTY’s <i>pageant</i>(1) supports this, in addition to the always-suitable keys mentioned above.
	278	+
	279	+ * As of version 10.2 (October 2025), OpenSSH’s <i>ssh-agent</i>(1) supports only some of the always-suitable key types: RSA and Ed25519 keys.
	280	+
	281	+ * As of version 0.83 (February 2025), PuTTY’s <i>pageant</i>(1) supports all the key types mentioned above, including DSA and ECDSA keys via deterministic signatures.
229	282
230	283	## ENVIRONMENT
231	284
...	...	@@ -390,6 +443,14 @@ The <b>derivepassphrase vault</b> utility exits 0 on success, and >0 if an error
390	443
391	444	(Exactly what it says.)
392	445
	446	+<!-- Message-ID: ErrMsgTemplate.UNKNOWN_SSH_AGENT_SOCKET_PROVIDER -->
	447	+??? failure "`The SSH agent socket provider %s is not in derivepassphrase's provider registry.`"
	448	+
	449	+ The requested SSH agent socket provider is unknown to <b>derivepassphrase</b>.
	450	+ The provider name may be misspelled, or it may be provided by an external software package that is not installed on this system.
	451	+
	452	+ The list of SSH agent socket providers currently known to <b>derivepassphrase</b> may be queried via <b>derivepassphrase vault <span>-</span>-version</b>.
	453	+
393	454	<!-- Message-ID: ErrMsgTemplate.USER_ABORTED_EDIT -->
394	455	??? failure "`Not saving any new notes: the user aborted the request.`"
395	456
...	...	@@ -556,5 +617,3 @@ Exceptions:
556	617
557	618	* The defaults are dictated by <i>vault</i>(1), necessitating the ["Compatibility and extension options"](#compatibility-and-extension-options).
558	619	(WONTFIX.)
559		-
560		- * The Windows version does not support SSH keys because Python on Windows does not support the predominant type of inter-process communication used by SSH agents on Windows.

...	...	@@ -81,6 +81,7 @@ key can also be used if there is a reachable, running
81	81	.Tn SSH
82	82	agent currently holding this key and if the key type is supported.
83	83	(See
	84	+.Sx "SSH AGENT SOCKET PROVIDERS" ,
84	85	.Sx "SSH KEY SUITABILITY"
85	86	and
86	87	.Sx BUGS
...	...	@@ -156,6 +157,16 @@ See also
156	157	for how this interacts with a stored passphrase or
157	158	.Tn SSH
158	159	key.
	160	+.Pp
	161	+.Nm derivepassphrase
	162	+uses so-called
	163	+.Dq Tn SSH No agent socket providers
	164	+to configure how it connects to the
	165	+.Tn SSH
	166	+agent.
	167	+See
	168	+.Sx "SSH AGENT SOCKET PROVIDERS"
	169	+for details.
159	170	.
160	171	.It Fl l Ar n , Fl \-length Ar n
161	172	Force the passphrase to have the length
...	...	@@ -482,6 +493,25 @@ behaves as if
482	493	.Fl \-print\-notes\-after
483	494	were always given.)
484	495	.
	496	+.It Fl \-ssh\-agent\-socket\-provider Ar PROVIDER
	497	+When deriving a passphrase using an SSH key, use the named socket provider
	498	+to connect to the
	499	+.Tn SSH
	500	+agent.
	501	+If not given, use the provider given in the configuration file, if any,
	502	+else a platform-appropriate default provider.
	503	+.Pp
	504	+.
	505	+(See
	506	+.Sx "SSH AGENT SOCKET PROVIDERS"
	507	+for details.)
	508	+.Pp
	509	+.
	510	+.Xr ( vault 1
	511	+behaves as if the built-in
	512	+.Li ssh_auth_sock_on_unix
	513	+provider were always requested.)
	514	+.
485	515	.El
486	516	.
487	517	.Ss Other options
...	...	@@ -556,6 +586,78 @@ Do not run these emitted shell scripts directly without double-checking
556	586	their output first!
557	587	.Ef
558	588	.
	589	+.Sh SSH AGENT SOCKET PROVIDERS
	590	+.
	591	+An
	592	+.Dq Tn SSH No agent socket provider
	593	+is a named configuration
	594	+.Pq and associated support code
	595	+that teaches
	596	+.Nm derivepassphrase
	597	+how to connect to a specific
	598	+.Tn SSH
	599	+agent.
	600	+Such providers can either be built-in, or contributed by third-party software,
	601	+and may be dependent on a specific operating system and/or further third-party
	602	+software.
	603	+.Pp
	604	+.Nm derivepassphrase
	605	+ships with the following built-in providers:
	606	+.Bl -ohang -offset indent
	607	+.It Li ssh_auth_sock_on_posix
	608	+connects to an
	609	+.Tn SSH
	610	+agent named by the
	611	+.Ev SSH_AUTH_SOCK
	612	+environment variable, using
	613	+.Tn UNIX
	614	+domain sockets
	615	+.It Li ssh_auth_sock_on_windows
	616	+connects to an
	617	+.Tn SSH
	618	+agent named by the
	619	+.Ev SSH_AUTH_SOCK
	620	+environment variable, using Windows named pipes
	621	+.It Li openssh_on_windows
	622	+connects to the
	623	+.Pf Powershell Pf / Dq Win32
	624	+port of
	625	+.Tn OpenSSH
	626	+at its standard address, using Windows named pipes
	627	+.It Li pageant_on_windows
	628	+connects to Pageant on Windows at its standard address, using Windows named pipes
	629	+.El
	630	+.Pp
	631	+and the following standard aliases:
	632	+.Bl -ohang -offset indent
	633	+.It Li unix_domain
	634	+alias for
	635	+.Li ssh_auth_sock_on_posix
	636	+.It Li windows_named_pipe
	637	+alias for
	638	+.Li ssh_auth_sock_on_windows
	639	+.It Li posix
	640	+alias for
	641	+.Li unix_domain
	642	+.It Li windows
	643	+alias for
	644	+.Li windows_named_pipe
	645	+.It Li native
	646	+alias for
	647	+.Li posix
	648	+or
	649	+.Li windows ,
	650	+depending on the operating system
	651	+.El
	652	+.Pp
	653	+(You are strongly advised to use a true provider name instead of an alias,
	654	+if feasible.)
	655	+.Pp
	656	+The list of currently available and otherwise known
	657	+.Tn SSH
	658	+agent socket providers is part of the feature information emitted by
	659	+.Fl \-version .
	660	+.
559	661	.Sh SSH KEY SUITABILITY
560	662	.
561	663	An
...	...	@@ -580,10 +682,7 @@ and sometimes the agent used:
580	682	.Tn Ed25519
581	683	and
582	684	.Tn Ed448
583		-keys are always suitable.
584		-.Tn OpenSSH Ns No 's
585		-.Xr ssh-agent 1
586		-supports only these keys as suitable keys.
	685	+keys are always suitable, by design of the key type.
587	686	.
588	687	.It
589	688	.Tn DSA
...	...	@@ -595,9 +694,26 @@ agent supports deterministic
595	694	.Tn DSA
596	695	signatures, e.g. by implementing
597	696	.Tn RFC 6979 .
	697	+.
	698	+.It
	699	+As of version 10.2 (October 2025),
	700	+.Tn OpenSSH Ns No 's
	701	+.Xr ssh-agent 1
	702	+supports only some of the always-suitable key types:
	703	+.Tn RSA
	704	+and
	705	+.Tn Ed25519
	706	+keys.
	707	+.
	708	+.It
	709	+As of version 0.83 (February 2025),
598	710	.Tn PuTTY Ns No 's
599	711	.Xr pageant 1
600		-supports this, in addition to the always-suitable keys mentioned above.
	712	+supports all key types mentioned above, including
	713	+.Tn DSA
	714	+and
	715	+.Tn ECDSA
	716	+keys via deterministic signatures.
601	717	.
602	718	.El
603	719	.
...	...	@@ -879,6 +995,21 @@ agent must fulfill to be suitable.
879	995	.
880	996	(Exactly what it says.)
881	997	.
	998	+.\" Message-ID: ErrMsgTemplate.UNKNOWN_SSH_AGENT_SOCKET_PROVIDER
	999	+.It The SSH agent socket provider %s is not in derivepassphrase's provider registry.
	1000	+The requested
	1001	+.Tn SSH
	1002	+agent socket provider is unknown to
	1003	+.Nm derivepassphrase .
	1004	+The provider name may be misspelled, or it may be provided by an external
	1005	+software package that is not installed on this system.
	1006	+.Pp
	1007	+The list of
	1008	+.Tn SSH agent socket providers currently known to
	1009	+.Nm derivepassphrase
	1010	+may be queried via
	1011	+.Li derivepassphrase vault Fl \-version .
	1012	+.
882	1013	.\" Message-ID: ErrMsgTemplate.USER_ABORTED_EDIT
883	1014	.It Not saving any new notes: the user aborted the request.
884	1015	(Exactly what it says.)
...	...	@@ -1178,13 +1309,5 @@ necessitating the
1178	1309	.Sx Compatibility and extension options .
1179	1310	.Pq WONTFIX.
1180	1311	.
1181		-.It
1182		-The Windows version does not support
1183		-.Tn SSH
1184		-keys because Python on Windows does not support the predominant type of
1185		-inter-process communication used by
1186		-.Tn SSH
1187		-agents on Windows.
1188		-.
1189	1312	.El
1190	1313	.
1191	1314