11–20 of 109 posts
From the FAQ: > Q: How do I import my current SSH keys, or export my Secretive Keys? > A: The secure enclave doesn't allow import or export of private keys. For any new computer, you should just create a new set of keys. If you're using a smart card, you might be able to export your private key from the vendor's software. I don't get it. If so, how am I supposed to back up my keys in case of a hardware failure or har…
Does this mean that the Secure Enclave is accessible by the user? If so, it prompts so many questions. How much disk space is available on the Enclave, for example.
Totally a tangent, but it's interesting that we still refer to things as "disk space" even in the era of flash storage
Is a similar service available for yubikeys connected to linux machines?
https://www.esev.com/blog/post/2015-01-pgp-ssh-key-on-yubike...
https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PK...
The yubikey (at least some models) can work as a smartcard.
From the FAQ: > Q: How do I import my current SSH keys, or export my Secretive Keys? > A: The secure enclave doesn't allow import or export of private keys. For any new computer, you should just create a new set of keys. If you're using a smart card, you might be able to export your private key from the vendor's software. I don't get it. If so, how am I supposed to back up my keys in case of a hardware failure or har…
This is actually the perfect scenario because an attacker can never get hold of the private key. That means that the key is unique: If it's in your hands, it means an attacker doesn't have it. Most smart cards work this way, they generate the private key inside and it can never leave the hardware, you can only prove you have it by using it to sign or encrypt something.
This is very different from SSH keyfiles on disk which can be stolen in many ways, and as such can be compromised without you ever knowing about it.
It's really cool that we can now use this functionality for SSH too. I currently use Yubikeys in OpenPGP mode for this but I might switch to this once I get a T2-enabled Mac.
Earlier quoted context omitted.
Totally a tangent, but it's interesting that we still refer to things as "disk space" even in the era of flash storage
I wonder what a better term for disk storage would be. Block storage, in the way that cloud services refer to it? Just plain "storage"?
Volatile Memory gets “erased” when powered off
Does this mean that the Secure Enclave is accessible by the user? If so, it prompts so many questions. How much disk space is available on the Enclave, for example.
You don’t actually need to store Secure Enclave protected data in the enclave. Can “wrap” it with the enclave’s key and store it on your own disk.
From the FAQ: > Q: How do I import my current SSH keys, or export my Secretive Keys? > A: The secure enclave doesn't allow import or export of private keys. For any new computer, you should just create a new set of keys. If you're using a smart card, you might be able to export your private key from the vendor's software. I don't get it. If so, how am I supposed to back up my keys in case of a hardware failure or har…
Like the others have said: You just use multiple. You can just add multiple keys to the authorized_keys file. This is actually the perfect scenario because an attacker can never get hold of the private key. That means that the key is unique: If it's in your hands, it means an attacker doesn't have it. Most smart cards work this way, they generate the private key inside and it can never leave the hardware, you can onl…
From the FAQ: > Q: How do I import my current SSH keys, or export my Secretive Keys? > A: The secure enclave doesn't allow import or export of private keys. For any new computer, you should just create a new set of keys. If you're using a smart card, you might be able to export your private key from the vendor's software. I don't get it. If so, how am I supposed to back up my keys in case of a hardware failure or har…
You aren't. It is the same with Yubikeys, if you use them. You are supposed to generate a certificate per user and device they are using for authentication, which is not a big deal at least for remote login on servers, as you can set an arbitrary number of valid SSH keys.
Earlier quoted context omitted.
I wonder what a better term for disk storage would be. Block storage, in the way that cloud services refer to it? Just plain "storage"?
Non Volatile Memory Volatile Memory gets “erased” when powered off