Live data from Hacker News

Yubico with new 4096-bit keys and gpg-agent for ssh authentication

trmm.net

11–20 of 51 posts

Re: Yubico with new 4096-bit keys and gpg-agent for ssh authentication

#11
post #9

Nitrokey[1] is about the same price as Yubico but has open source firmware & hardware . You might also know them as CryptoStick[2]. [1] https://www.nitrokey.com/ [2] https://blog.mozilla.org/security/2013/02/13/using-cryptosti...

That looks very nice, but it's rather more expensive than the Yubikey. The latter has NFC+U2F in a stick costing $50, whereas the former costs $50 for a stick that has neither.

Re: Yubico with new 4096-bit keys and gpg-agent for ssh authentication

#12
post #9

Nitrokey[1] is about the same price as Yubico but has open source firmware & hardware . You might also know them as CryptoStick[2]. [1] https://www.nitrokey.com/ [2] https://blog.mozilla.org/security/2013/02/13/using-cryptosti...

That looks very nice, but it's rather more expensive than the Yubikey. The latter has NFC+U2F in a stick costing $50, whereas the former costs $50 for a stick that has neither.

What’s the use case for NFC?

Re: Yubico with new 4096-bit keys and gpg-agent for ssh authentication

#13
post #12

Earlier quoted context omitted.

That looks very nice, but it's rather more expensive than the Yubikey. The latter has NFC+U2F in a stick costing $50, whereas the former costs $50 for a stick that has neither.

What’s the use case for NFC?

For usage with mobile applications, where NFC is typically available but USB Host is not, I would imagine.

Re: Yubico with new 4096-bit keys and gpg-agent for ssh authentication

#15
post #6

Is there any way to store an ssh server key in it, or an https server's key? Basically turning this into a mini-HSM ?

Yubico have a product specifically for that use case: https://www.yubico.com/products/yubihsm/

My mistake, it doesn't appear to support that functionality. I'll have to look into it further.

Re: Yubico with new 4096-bit keys and gpg-agent for ssh authentication

#16
post #12

Earlier quoted context omitted.

That looks very nice, but it's rather more expensive than the Yubikey. The latter has NFC+U2F in a stick costing $50, whereas the former costs $50 for a stick that has neither.

What’s the use case for NFC?

Using PGP on your smartphone without giving it access to your PGP key - https://grepular.com/An_NFC_PGP_SmartCard_For_Android - That's how I use it anyway.

Re: Yubico with new 4096-bit keys and gpg-agent for ssh authentication

#17
post #2

I'm surprised that more folks haven't just gone to 8,192-bit keys, out of an abundance of caution.

4,096 is already an abundance of caution. You might as well say people should go to 32,768 just to be sure. Then somebody else would come along and say, "why not 65,536?"

Indeed. Mostly, it's just a question of whether or not the software will support a key of such size. Typically, I would recommend that, unless you've a good reason to use a smaller key (like support concerns), one should use the biggest key one possibly can use at the time the key is generated. Though, if one is doing key rotation as one should be, one can always adjust up as needed as time goes on.

Re: Yubico with new 4096-bit keys and gpg-agent for ssh authentication

#20
post #12

Earlier quoted context omitted.

What’s the use case for NFC?

For usage with mobile applications, where NFC is typically available but USB Host is not, I would imagine.

On Android, you typically have USB host (at least on any phone that someone interested in this tech would buy). On iOS it's moot since NFC is gimped and can't be used by apps.
Post reply on HN