Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Store an SSH Key on a Yubikey

xeiaso.net

Post reply on HN
Print view View original

121–130 of 154 posts

Re: How to Store an SSH Key on a Yubikey

#121

Post by sbf501 »

nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

You're not overthinking it at all. I have two YubiKeys for that reason. I also have a fire safe with some important docs in it (hopefully the yubikey won't melt!). Plus, I'm older, and I'm getting forgetful, and I worry I'll forget my long lastpass master password some day, let alone all my SSH keys. There are real assets tied to my passwords. Fortunately at my age I have a relationship with my estate lawyer, and financial advisor, who has power of attorney so most of that is safe, but I don't think anyone has really figured out how to handle long-term digital assets. In fact, I'm actually working on a side project to do this.

Re: How to Store an SSH Key on a Yubikey

#122

Post by sbf501 »

gwbas1c wrote: post #116

> such as the Tongues you received as a kid when you were forced into learning the bible against your will Wait, what? My wife stopped going to Awanas when some leader told her she was going to hell for not learning the Bible verses. Later I learned that her father was pissed off about the whole situation.

I dated a charismatic christian who did the whole laying-hands on thing and speaking in tongues as a kid. Weird stuff. But not any weirder than any other religion system comparitavely.

Re: How to Store an SSH Key on a Yubikey

#123

Post by sbf501 »

xena wrote: post #91
a-dub wrote: post #90

but wait a minute... this is just storing the private key material on the yubikey like any storage device and it is loaded and copied right off every time you use it, right? doesn't that defeat the point of using a yubikey where the private key itself is never read from the device during authentication?

Author of the article here. From what I understand it puts the private key material on the Yubikey itself and then during the signing part of SSH authentication the SSH client asks the yubikey to do the signature. The private key never leaves the device.

Can you also include a screen shot of the ssh connection process? The article stops abruptly at the most interesting part: using the key.

Re: How to Store an SSH Key on a Yubikey

#124

Post by staticassertion »

infthi wrote: post #67
gruturo wrote: post #34

Earlier quoted context omitted.

You're not wrong, but this is exactly the use case for a USB security stick. The key is in there, cannot be extracted in any way*, can only be "used" (not accessed or copied, just used for crypto operations) while the stick is plugged in, and without it it's impossible to proceed. It kind of goes without saying that losing the key results in you getting locked out - if there was any other way there wouldn't really be…

> cannot be extracted in any way There was (is?) a vulnerability in Google Titan keys (and some Yubico products as well) that allowed cloning of keys (having a physical access is a pre-requisite). https://news.ycombinator.com/item?id=25675556

If you lose a key you have to take action as if it were compromised, because there may always be key recovery attacks, but chances are the vast majority of attackers aren't going to build a machine learning, electromagnetic measurement recovery system.

Also the Yubikey NEO that was impacted by this is pretty old, released in 2012 I believe.

> 1. The impacted Yubico Yubikey Neo is an old product no more available for sale. All FIDO U2F Yubico Yubikeys currently available on their webstore are based on a newer secure element from Infineon, and are not impacted by our work to our knowledge.

Re: How to Store an SSH Key on a Yubikey

#125

Post by chmod600 »

amluto wrote: post #113
gruturo wrote: post #34

Earlier quoted context omitted.

You're not wrong, but this is exactly the use case for a USB security stick. The key is in there, cannot be extracted in any way*, can only be "used" (not accessed or copied, just used for crypto operations) while the stick is plugged in, and without it it's impossible to proceed. It kind of goes without saying that losing the key results in you getting locked out - if there was any other way there wouldn't really be…

The spare in safe storage has limited value: you have to take it out of the safe to enroll it. This is technically easy to solve (with public key cryptography), but I don’t think FIDO/CTAP/WebAuthn has any ability to do this.

Not sure I follow. Don't you just need to save the public key somewhere, and use that to enroll? Why would you need access to the yubikey itself to enroll?

Re: How to Store an SSH Key on a Yubikey

#126

Post by staticassertion »

mschuster91 wrote: post #75
yakak wrote: post #36

Earlier quoted context omitted.

I think people start with trying to do the best practice too early. Just using one key as your primary authentication adds a lot of security as other authentication methods aren't as routinely exposed. That's enough to get started and makes it easier to think about backups when one is ready for multiple keys.

> Just using one key as your primary authentication adds a lot of security Yeah, and look just how often people lose or wash their phones or their keys, or how easy it is to break off a Yubikey that is on a keychain (e.g. when a cat pulls on it). Then you are usually royally screwed.

OK, how often? Seems like a relatively infrequent issue, although at the scale of cell phones it certainly happens "often".

But you aren't really screwed, you can recover your accounts. You still know your password, you likely have an associated email, you may have even written down your recovery codes.

Re: How to Store an SSH Key on a Yubikey

#127

Post by yakak »

mschuster91 wrote: post #87
yakak wrote: post #82

Earlier quoted context omitted.

Sounds like FUD to me. If you lose your primary method you have to remember the password to unlock your secondary software ssh key.. Possibly remembering a password is a huge crisis but I had that crisis before using tokens, i.e. returning to my work desktop after a vacation.

> If you lose your primary method you have to remember the password to unlock your secondary software ssh key.. The post I was replying to was talking about 2FA in general, not just for SSH keys. Many people take the advertisements of Facebook, Google, Twitter et al. to push for 2FA as pure gospel, but completely neglect "worst case recovery" scenarios - and then run into stone walls when it inevitably happens, becau…

> something happens only for 0.001% of all users

Like a fisher taking their account and convincing support they are the real user? You can't really blame fido for the fact that consolidation made a dangerous situation. I'm very happy with my past choices to intentionally lock myself out as a failsafe over a 50/50 chance that it's me who gets an account back.

Re: How to Store an SSH Key on a Yubikey

#128

Post by markstos »

Unless I've missed something, SSH keys stored on Yubikeys are still hampered because you aren't allowed to a touch policy of "touch never".

Imagine needing to touch the Yubikey with each "git pull" or using Ansible to operate over SSH on a dozen servers in parallel, and needing to touch the Yubikey once for each server.

The feature request I'm tracking is here: https://github.com/FiloSottile/yubikey-agent/issues/95

The proposed feature would allow setting a touch policy for the SSH key.

Re: How to Store an SSH Key on a Yubikey

#129

Post by xena »

markstos wrote: post #128

Unless I've missed something, SSH keys stored on Yubikeys are still hampered because you aren't allowed to a touch policy of "touch never". Imagine needing to touch the Yubikey with each "git pull" or using Ansible to operate over SSH on a dozen servers in parallel, and needing to touch the Yubikey once for each server. The feature request I'm tracking is here: https://github.com/FiloSottile/yubikey-agent/issues/95 T…

If you use SSH ControlMaster sockets, it's not so bad in practice. It can be a pain at times, but I think the security is worth it.

Re: How to Store an SSH Key on a Yubikey

#130

Post by eximius »

gruturo wrote: post #34
nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

You're not wrong, but this is exactly the use case for a USB security stick. The key is in there, cannot be extracted in any way*, can only be "used" (not accessed or copied, just used for crypto operations) while the stick is plugged in, and without it it's impossible to proceed. It kind of goes without saying that losing the key results in you getting locked out - if there was any other way there wouldn't really be…

I actually wish there was an in-between model that supported key extraction.

Let me store my key in a secure, offline, physical device... and extract to clone it when my yubikey is worryingly old.

My threat model does not include physical attacks, but storage of a key on-device or in backups? Or forgetting a password for an encrypted archive? yep.

Post reply on HN