Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Store an SSH Key on a Yubikey

xeiaso.net

Post reply on HN
Print view View original

111–120 of 154 posts

Re: How to Store an SSH Key on a Yubikey

#111

Post by samatman »

nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

My Precursor† arrived last week, I'm optimistic about the direction the project is going in. Once the ecosystem is fleshed out, we should be able to store secrets with high reliability and deniability, combine this with something like tarsnap and it should be possible to recover everything off a piece of paper, from anywhere, with a fresh device.

†: https://www.bunniestudios.com/blog/?p=5921

Re: How to Store an SSH Key on a Yubikey

#112

Post by veganjay »

vletal wrote: post #109
veganjay wrote: post #108

Is there a way to show which SSH keys are loaded on the Yubikey? (It looks like you can store multiple) Also, how can one remove the SSH keys from the Yubikey? I've tried to find articles and SSH on the Yubikey gets very confusing as there seem to be so many techniques!

In the blogpost they give an example of exactly that $ ssh-add -L sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKgGePSwpBuHUhrFCRLch9Usqi7L0fKtgTRnh6F/R+ruAAAABHNzaDo= cadey@shachi Seems like the key is exposed as ssh agent.

Thanks - "ssh-add -L" talks to the ssh-agent and asks what keys are loaded. That shows all keys including keys from the yubikey and from the local filesystem.

I am looking for a command that shows what's on the yubikey.

From what I gather, if the command from the article is run: "ssh-keygen -t ed25519-sk -O resident", the key is stored in a FIDO2 slot.

If that's the case, my question is how to show what is in the FIDO2 slots and how to delete them?

Re: How to Store an SSH Key on a Yubikey

#113

Post by amluto »

gruturo wrote: post #34
nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

You're not wrong, but this is exactly the use case for a USB security stick. The key is in there, cannot be extracted in any way*, can only be "used" (not accessed or copied, just used for crypto operations) while the stick is plugged in, and without it it's impossible to proceed. It kind of goes without saying that losing the key results in you getting locked out - if there was any other way there wouldn't really be…

The spare in safe storage has limited value: you have to take it out of the safe to enroll it. This is technically easy to solve (with public key cryptography), but I don’t think FIDO/CTAP/WebAuthn has any ability to do this.

Re: How to Store an SSH Key on a Yubikey

#114

Post by veganjay »

veganjay wrote: post #112
vletal wrote: post #109

Earlier quoted context omitted.

In the blogpost they give an example of exactly that $ ssh-add -L sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKgGePSwpBuHUhrFCRLch9Usqi7L0fKtgTRnh6F/R+ruAAAABHNzaDo= cadey@shachi Seems like the key is exposed as ssh agent.

Thanks - "ssh-add -L" talks to the ssh-agent and asks what keys are loaded. That shows all keys including keys from the yubikey and from the local filesystem. I am looking for a command that shows what's on the yubikey. From what I gather, if the command from the article is run: "ssh-keygen -t ed25519-sk -O resident", the key is stored in a FIDO2 slot. If that's the case, my question is how to show what is in the FID…

Found it:

Install ykman: https://github.com/Yubico/yubikey-manager#linux

Show FIDO2 credentials:

    $ ykman fido credentials list
    ssh: 0000000000000000000000000000000000000000000000000000000000000000 openssh
Delete:

    $ ykman fido credentials delete CREDENTIAL

Re: How to Store an SSH Key on a Yubikey

#115

Post by archi42 »

tialaramex wrote: post #86
archi42 wrote: post #38

> This should work on other FIDO keys like Google's Titan, but we don't have access to one over here and as such haven't tested it. For my trusty HyperFIDO Mini (usb id 0x2ccf:0x0880) this doesn't work, though it's rather old (1st gen) and maybe they refreshed it to support this. ssh-keygen fails with "Key enrollment failed: requested feature not supported". I wanted to replace it with a USB-C (& maybe NFC) device an…

The feature causing this is -O resident which tells the device, "Hey, you need to remember these credentials" (ie they are resident on the device). For WebAuthn this enables "usernameless" login. You rock up to a random PC anywhere in the world, go to example.com, just click "Sign in", and your authenticator is like, "Hi example.com, according to my records I am archi42, user 123456-ACBDE-123 and as proof here's a si…

Thanks, I appreciate the effort you put into the answer; though I know how ssh keys work and the basics about FIDO as well ;-)

I got the hyperfido 5 years ago and doubted they're still selling the same hardware today. I exchanged a few mails someone from their C-suite back then on the topic of using the keys for SSH, and it wasn't easily possible back then (also: he seemed very nice [cue Canada meme], so I didn't want to spread falsehoods about the company on HN). Actually I checked right now, and their current offerings seem to support FIDO2 (also: the model number & name changed slightly). So I suppose their current generation should work.

//edit: ah, your pointer was still worth the effort. I tried non-resident and ecdsa-sk works with my key (but not ed2219-sk). I still need a new key because I want to have a resident key :)

Re: How to Store an SSH Key on a Yubikey

#116

Post by gwbas1c »

> such as the Tongues you received as a kid when you were forced into learning the bible against your will

Wait, what? My wife stopped going to Awanas when some leader told her she was going to hell for not learning the Bible verses. Later I learned that her father was pissed off about the whole situation.

Re: How to Store an SSH Key on a Yubikey

#117

Post by spike021 »

gwbas1c wrote: post #116

> such as the Tongues you received as a kid when you were forced into learning the bible against your will Wait, what? My wife stopped going to Awanas when some leader told her she was going to hell for not learning the Bible verses. Later I learned that her father was pissed off about the whole situation.

As someone who was in an Awana...club(?) for most of my childhood, I never had this happen. That sucks. Some people are way too crazy.

Re: How to Store an SSH Key on a Yubikey

#119

Post by veganjay »

Some additional information:

- https://www.yubico.com/blog/github-now-supports-ssh-security...

- https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht...

- https://developers.yubico.com/SSH/

The second link describes the advantages/disadvantages of non-resident vs. resident keys.

Re: How to Store an SSH Key on a Yubikey

#120

Post by m-p-3 »

nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

I personally store a printed copy of an emergency-only SSH key (ed25519) in a safe, also formatted as a QR code to quickly import it if something goes wrong. The key is short enough to fit within a QR code length limit, and I can quickly scan it to my computer using my 2D barcode scanner.

I just import my `authorized_keys` that I keep up-to-date on my new server when I do the initial setup.

Post reply on HN