I can get the public key out of my PIV card (using PuTTy) but I am unable to get the private key, which I would like to emulate the card by running Pageant. Is there any way to get the private key out of the card?
RELATED: Can I user CAPI 2-factor authentication in MobaXterm?
No, smartcards by design have no method of revealing the private key.
But you do not need to extract the private key – SSH authentication only requires the ability to sign (and the whole concept of "key agents" is built on that). Just as PuTTY-CAC can create signatures using your smartcard via CAPI (or PKCS#11), Pageant-CAC can do exactly the same.
You can't extract the private key out of a PIV smartcard, as this is done as a secure vault for the private key. But you can use a Putty agent compatible with Pageant which uses a PIV card as a secure key storage, that's the clear goal of PIVageant, that my company developed. It can work with any SSH/SFTP software that can use Pageant such as Putty, Kitty, WinSCP, X2Go client, Fork, ...
