Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Store an SSH Key on a Yubikey

xeiaso.net

Post reply on HN
Print view View original

11–20 of 154 posts

Re: How to Store an SSH Key on a Yubikey

#11

Post by Hackbraten »

stingraycharles wrote: post #6
nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

As someone who uses Yubikey for about 5 years for SSH, GPG and O2F, an extra key is indeed the solution I use. Effectively it means all integrations must support multiple keys, and you’ll have to register both. Of course, this doesn’t work everywhere, such as AWS. In those cases, I typically use my “main” key. I’d argue that the key breaking due to wear or being lost is less of a risk than human error: just last week…

> Of course, this doesn’t work everywhere, such as AWS

I’ve worked around that by creating one IAM user per Yubikey.

Re: How to Store an SSH Key on a Yubikey

#12

Post by tazjin »

The problem with this approach is that the `-sk` keys need to be supported server-side (I'm not sure if that support goes beyond including them in a list of recognised key types, but it doesn't matter).

As a result, lots of systems that are not bleeding edge still don't accept them, for example Gerrit.

Re: How to Store an SSH Key on a Yubikey

#15

Post by jopsen »

nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

Most providers also let you create recovery codes. Or signup for TOTP which gives you a QR code.

Print those out and store them somewhere. Then if you loose your yubikey you recover access with those.

If you're too lazy to print them, the just store them in an encrypted tarball, using a very long password (and then rarely open it).

Having the extra key is also fine, but it means you need to have the key around whenever you signup for a new service.

In an ideal world, I would encrypt recovery codes with a public-key and have the private key for decoding them buried in the back yard.

Re: How to Store an SSH Key on a Yubikey

#17

Post by artdigital »

stingraycharles wrote: post #6
nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

As someone who uses Yubikey for about 5 years for SSH, GPG and O2F, an extra key is indeed the solution I use. Effectively it means all integrations must support multiple keys, and you’ll have to register both. Of course, this doesn’t work everywhere, such as AWS. In those cases, I typically use my “main” key. I’d argue that the key breaking due to wear or being lost is less of a risk than human error: just last week…

I have a question - do you disable regular OTP 2FA on services you use the Yubikey? I have one too and religiously added it to all kinds of things, but each service allowed me to just skip the yubikey when a regular OTP code was entered, effectively making me not use the yubikey

Re: How to Store an SSH Key on a Yubikey

#18

Post by ylk »

vladvasiliu wrote: post #2

> As of OpenSSH 8.2 (Feburary 14, 2020) you are able to store an SSH private key on a yubikey! Here's how to do it. Many systems still don't have OpenSSH 8.2 (Windows 11, older debian stable, etc). For those, another solution is to use the PGP applet of the YubiKey, which exposes a regular RSA key. This guide has worked well for me: https://github.com/drduh/YubiKey-Guide You can jump to the SSH sections if that's all…

> which exposes a regular RSA key

With newer Yubikeys you can also use ECC PGP keys:

> Support for Elliptic Curve Cryptographic Algorithms have been added to the YubiKey 5.2.3 and above firmware.

https://developers.yubico.com/PGP/YubiKey_5.2.3_Enhancements...

Re: How to Store an SSH Key on a Yubikey

#19

Post by aborsy »

stingraycharles wrote: post #6
nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

As someone who uses Yubikey for about 5 years for SSH, GPG and O2F, an extra key is indeed the solution I use. Effectively it means all integrations must support multiple keys, and you’ll have to register both. Of course, this doesn’t work everywhere, such as AWS. In those cases, I typically use my “main” key. I’d argue that the key breaking due to wear or being lost is less of a risk than human error: just last week…

You pull your GPG key from offline backups, reset the applet and load it again.

The same Gpg key can be used for SSH too.

You can generate keys inside Yubikey, but you also have the option of bring your own key, which surely you keep safe offline.

Post reply on HN