How to use FIDO2 USB keys with SSH • Hacker News Board

Re: How to use FIDO2 USB keys with SSH

#11

Post by arianvanp » Tue, Jun 30, 2020, 1:40 PM UTC

Bedon292 wrote: post #9

Am I missing something? The commands for resident and non-resident appear to be identical. Edit: They fixed it.

they have the addition of -O resident

from ssh-keygen:

       resident
              Indicate that the key should be stored on the FIDO authenticator itself.  Resident keys may be supported  on
              FIDO2 tokens and typically require that a PIN be set on the token prior to generation.  Resident keys may be
              loaded off the token using ssh-add(1).

from ssh-add:

        -K     Load resident keys from a FIDO authenticator

Re: How to use FIDO2 USB keys with SSH

#12

Post by StavrosK » Tue, Jun 30, 2020, 1:41 PM UTC

Bedon292 wrote: post #9

Am I missing something? The commands for resident and non-resident appear to be identical. Edit: They fixed it.

Sorry, copy/paste fail. Fixed now, thanks!

Re: How to use FIDO2 USB keys with SSH

#13

Post by nobodyshere » Tue, Jun 30, 2020, 1:41 PM UTC

arianvanp wrote: post #11

Bedon292 wrote: post #9

Am I missing something? The commands for resident and non-resident appear to be identical. Edit: They fixed it.

they have the addition of -O resident from ssh-keygen: resident Indicate that the key should be stored on the FIDO authenticator itself. Resident keys may be supported on FIDO2 tokens and typically require that a PIN be set on the token prior to generation. Resident keys may be loaded off the token using ssh-add(1). from ssh-add: -K Load resident keys from a FIDO authenticator

Can't make that part work on Mac.

Re: How to use FIDO2 USB keys with SSH

#14

Post by StavrosK » Tue, Jun 30, 2020, 1:42 PM UTC

arianvanp wrote: post #11

Bedon292 wrote: post #9

Am I missing something? The commands for resident and non-resident appear to be identical. Edit: They fixed it.

they have the addition of -O resident from ssh-keygen: resident Indicate that the key should be stored on the FIDO authenticator itself. Resident keys may be supported on FIDO2 tokens and typically require that a PIN be set on the token prior to generation. Resident keys may be loaded off the token using ssh-add(1). from ssh-add: -K Load resident keys from a FIDO authenticator

I had the same command in both by mistake :/

Re: How to use FIDO2 USB keys with SSH

#15

Post by StavrosK » Tue, Jun 30, 2020, 1:43 PM UTC

spiridow wrote: post #10

I'm really excited to see more and more people talk about FIDO2. If you're interested about this topic, I gave a talk about it yesterday: https://news.ycombinator.com/item?id=23689606

That's very useful, thank you! I've been looking for something that goes into a bit more detail, so your talk is timely.

Re: How to use FIDO2 USB keys with SSH

#16

Post by notaplumber » Tue, Jun 30, 2020, 1:44 PM UTC

StavrosK wrote: post #14

arianvanp wrote: post #11

Earlier quoted context omitted.

they have the addition of -O resident from ssh-keygen: resident Indicate that the key should be stored on the FIDO authenticator itself. Resident keys may be supported on FIDO2 tokens and typically require that a PIN be set on the token prior to generation. Resident keys may be loaded off the token using ssh-add(1). from ssh-add: -K Load resident keys from a FIDO authenticator

I had the same command in both by mistake :/

You still do?

EDIT: I see it now.

Re: How to use FIDO2 USB keys with SSH

#17

Post by StavrosK » Tue, Jun 30, 2020, 1:44 PM UTC

notaplumber wrote: post #16

StavrosK wrote: post #14

Earlier quoted context omitted.

I had the same command in both by mistake :/

You still do? EDIT: I see it now.

It just takes a while for the site to deploy.

Re: How to use FIDO2 USB keys with SSH

#18

Post by StavrosK » Tue, Jun 30, 2020, 1:45 PM UTC

nobodyshere wrote: post #13

arianvanp wrote: post #11

Earlier quoted context omitted.

they have the addition of -O resident from ssh-keygen: resident Indicate that the key should be stored on the FIDO authenticator itself. Resident keys may be supported on FIDO2 tokens and typically require that a PIN be set on the token prior to generation. Resident keys may be loaded off the token using ssh-add(1). from ssh-add: -K Load resident keys from a FIDO authenticator

Can't make that part work on Mac.

Unfortunately, MacOS still ships with SSH 8.1, AFAIK.

Re: How to use FIDO2 USB keys with SSH

#19

Post by ta17711771 » Tue, Jun 30, 2020, 1:56 PM UTC

StavrosK wrote: post #8

dboreham wrote: post #5

I've waited 10 years for this.

Same here, and I just absolutely love how well it works. Now if Android SSH apps add support for it, my SSH life will be complete.

Can you do it with Termux or T-UI somehow? Addons?

Re: How to use FIDO2 USB keys with SSH

#20

Post by jjoonathan » Tue, Jun 30, 2020, 2:33 PM UTC

spiridow wrote: post #10

I'm really excited to see more and more people talk about FIDO2. If you're interested about this topic, I gave a talk about it yesterday: https://news.ycombinator.com/item?id=23689606

Here's a browser compatibility matrix (I know, OP is about SSH).

FIDO2/U2F Just Works in:

    Chrome on Windows
    Firefox on Windows
    Chrome on Mac
    Firefox on Mac
    Chrome in Ubuntu 20
    Firefox in Ubuntu 20

Wall of shame (FIDO2/U2F does not Just Work in):

    Safari

EDIT: it does work out-of-the-box in Ubuntu 20, my bad.