Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Store an SSH Key on a Yubikey

xeiaso.net

Post reply on HN
Print view View original

141–150 of 154 posts

Re: How to Store an SSH Key on a Yubikey

#141

Post by macrolime »

tjoff wrote: post #71
nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

I haven't kept track of these, but are there no solutions to have a master key that one can create any number of keys from? And where that would not require one to update all hundred services using it.

I think this can do that

https://github.com/Logicwax/gpg-hd

Re: How to Store an SSH Key on a Yubikey

#142

Post by amluto »

chmod600 wrote: post #125
amluto wrote: post #113

Earlier quoted context omitted.

The spare in safe storage has limited value: you have to take it out of the safe to enroll it. This is technically easy to solve (with public key cryptography), but I don’t think FIDO/CTAP/WebAuthn has any ability to do this.

Not sure I follow. Don't you just need to save the public key somewhere, and use that to enroll? Why would you need access to the yubikey itself to enroll?

I’m only deeply familiar with the U2F (legacy) protocol, and such devices don’t expose a key pair usable for this purpose. When you enroll, you need to communicate with the token.

But more generally, this is a protocol issue. You can’t enroll your Yubikey with your browser and then, later, have your browser enroll that key with a WebAuthn-using site. You have to put the key in your USB port at the time you enroll with a website. And you can’t do this if it’s in a safe.

Re: How to Store an SSH Key on a Yubikey

#143

Post by xena »

jazzythom wrote: post #139

Wait is generation on the host? Nonono you generate a GPG key on the key then export the public key and derive the SSH key. These instructions are wrong the host never should store the key even if airgapped

Doing that means I have to use GPG. I am not paid enough to use GPG.

Re: How to Store an SSH Key on a Yubikey

#144

Post by staticassertion »

mschuster91 wrote: post #132
staticassertion wrote: post #126

Earlier quoted context omitted.

OK, how often? Seems like a relatively infrequent issue, although at the scale of cell phones it certainly happens "often". But you aren't really screwed, you can recover your accounts. You still know your password, you likely have an associated email, you may have even written down your recovery codes.

You can't login without the second factor and only the password because that is literally the entire point of having a second factor. You should not be able to reset a 2FA token purely by having access to the target's email (or SMS) account in a halfway decent system. Your only hope will be the recovery codes but well, how many people actually read the fine print on these?

I'm saying that if you have the password and the email address, bypassing 2FA would not be unreasonable, and it's what most services end up doing (for better or worse). Recovery codes are the ideal, of course.

But yeah, this is also why every new Android/iOS device can act as a FIDO2 token - the more tokens people have, the easier it is to recover with a second token vs having to fall back to less safe methods.

Re: How to Store an SSH Key on a Yubikey

#145

Post by enasterosophes »

stingraycharles wrote: post #8
enasterosophes wrote: post #3

Something else that is quite nice is that you can switch to certificate auth and use your yubikey to protect an ed25519-sk certificate authority.

How does that work, do you know a good tutorial for this?

Look for a tutorial on ssh certificate auth, and use ed25519-sk keys for the CA.

Re: How to Store an SSH Key on a Yubikey

#146

Post by enasterosophes »

Diti wrote: post #44
enasterosophes wrote: post #3

Something else that is quite nice is that you can switch to certificate auth and use your yubikey to protect an ed25519-sk certificate authority.

But PIV only supports keys up to 2048 bits. :<

I didn't say anything about PIV. The article I was replying to is talking about sk keys, and so am I.

Re: How to Store an SSH Key on a Yubikey

#148

Post by rgoulter »

xena wrote: post #77
Sharparam wrote: post #73

Earlier quoted context omitted.

If only there was some kind of international standard for date formatting we could use to get around that issue...

Owner of the blog here. I use the same date format on my website as I do on my phone: https://twitter.com/theprincessxena/status/15312403676008529...

The parent comment is just teasing about ISO 8601. :o) YYYY-MM-DD is a nice way to write a date.

Re: How to Store an SSH Key on a Yubikey

#149

Post by Too »

eximius wrote: post #130
gruturo wrote: post #34

Earlier quoted context omitted.

You're not wrong, but this is exactly the use case for a USB security stick. The key is in there, cannot be extracted in any way*, can only be "used" (not accessed or copied, just used for crypto operations) while the stick is plugged in, and without it it's impossible to proceed. It kind of goes without saying that losing the key results in you getting locked out - if there was any other way there wouldn't really be…

I actually wish there was an in-between model that supported key extraction. Let me store my key in a secure, offline, physical device... and extract to clone it when my yubikey is worryingly old. My threat model does not include physical attacks, but storage of a key on-device or in backups? Or forgetting a password for an encrypted archive? yep.

Yubihsm can do that. Not sure about yubikey. It’s called export wrapped. Here wrapped means the export is encrypted by another key first. The only catch (feature) is that the key must be created with this capability on its initial creation, you can’t export a key that disallows exporting.

Re: How to Store an SSH Key on a Yubikey

#150

Post by moontear »

xena wrote: post #77
Sharparam wrote: post #73

Earlier quoted context omitted.

If only there was some kind of international standard for date formatting we could use to get around that issue...

Owner of the blog here. I use the same date format on my website as I do on my phone: https://twitter.com/theprincessxena/status/15312403676008529...

Woah that’s even more interesting! „M05 30, Mon“. May I ask where you are from or where that date format is used?
Post reply on HN