Bug 1687230

Description of Problem:
When using ssh-agent with ecdsa-sha2-nistp384 key on a security key (Yubikey 5 NC in this case) ssh-agent fails to sign and then seg faults.  FWIW RSA keys on a security key work with ssh-agent.

How reproducible:
Consistently

Steps to reproduce:
# Create ECDSA key
$ yubico-piv-tool -s 9a -AECCP384 -a generate -o public.pem --key
Enter management key: 
Successfully generated a new private key.
$ yubico-piv-tool -a verify-pin -a selfsign-certificate -s 9a -S "/CN=SSH key/" -i public.pem -o cert.pem
Enter PIN: 
Successfully verified PIN.
Successfully generated a new self signed certificate.
$ yubico-piv-tool -a import-certificate -s 9a -i cert.pem --key
Enter management key: 
Successfully imported a new certificate.
$ ssh-keygen -D /usr/lib64/opensc-pkcs11.so -e
ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBIYBDDS9N+FlOyRviNzcg6RNGFU37MdSfgWFOWOvS/ge9BPl976rU27gvo/Vd+sIp7VHZYrVL8vidQ1pjb8DMr0lbSRnSFk6YPw4MPqEdPl0QLwzCBsR6niM2i4D2cm5EA==
# Copy the public key to localhost ~/.ssh/authorized_keys file
$ echo 'ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBIYBDDS9N+FlOyRviNzcg6RNGFU37MdSfgWFOWOvS/ge9BPl976rU27gvo/Vd+sIp7VHZYrVL8vidQ1pjb8DMr0lbSRnSFk6YPw4MPqEdPl0QLwzCBsR6niM2i4D2cm5EA==' > ~/.ssh/authorized_keys
# Cleanup any currently running ssh-agent and start a ssh-agent in debug mode
$ pkill -9 ssh-agent; rm -rf /tmp/ssh-*; ssh-agent -D
SSH_AUTH_SOCK=/tmp/ssh-gbmJQM6y7tq8/agent.9141; export SSH_AUTH_SOCK;
echo Agent pid 9141;
# In another terminal add the SSH_AUTH_SOCK environment variable
$ SSH_AUTH_SOCK=/tmp/ssh-gbmJQM6y7tq8/agent.9141; export SSH_AUTH_SOCK;
$ ssh-add -s /usr/lib64/opensc-pkcs11.so
Enter passphrase for PKCS#11: 
Card added: /usr/lib64/opensc-pkcs11.so
$ ssh-add -L
ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBIYBDDS9N+FlOyRviNzcg6RNGFU37MdSfgWFOWOvS/ge9BPl976rU27gvo/Vd+sIp7VHZYrVL8vidQ1pjb8DMr0lbSRnSFk6YPw4MPqEdPl0QLwzCBsR6niM2i4D2cm5EA== /usr/lib64/opensc-pkcs11.so
$ ssh localhost
$ ssh localhost

Actual results:
$ ssh localhost
sign_and_send_pubkey: signing failed: agent refused operation
user@localhost: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
$ ssh localhost

Now notice in the ssh-agent debug output it failed to sign, and when we ran ssh localhost again ssh-agent seg faulted
echo Agent pid 9141;
process_sign_request2: sshkey_sign: error in libcrypto
Segmentation fault

Expected results:
Successfully authenticated against ssh server

Additional info:
$ cat /etc/fedora-release 
Fedora release 29 (Twenty Nine)
$ rpm -qa | grep -E 'ssh|opensc|yubico-piv'
NetworkManager-ssh-1.2.7-5.fc29.x86_64
opensc-0.19.0-3.fc29.x86_64
libssh2-1.8.0-8.fc29.x86_64
libssh-0.8.7-1.fc29.x86_64
qemu-block-ssh-3.0.0-3.fc29.x86_64
openssh-7.9p1-4.fc29.x86_64
openssh-server-7.9p1-4.fc29.x86_64
sshpass-1.06-6.fc29.x86_64
yubico-piv-tool-1.6.2-1.fc29.x86_64
NetworkManager-ssh-gnome-1.2.7-5.fc29.x86_64
openssh-clients-7.9p1-4.fc29.x86_64