How to Store an SSH Key on a Yubikey

Post by mihaigalos » Tue, May 31, 2022, 1:34 PM UTC

stingraycharles wrote: post #6

nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

As someone who uses Yubikey for about 5 years for SSH, GPG and O2F, an extra key is indeed the solution I use. Effectively it means all integrations must support multiple keys, and you’ll have to register both. Of course, this doesn’t work everywhere, such as AWS. In those cases, I typically use my “main” key. I’d argue that the key breaking due to wear or being lost is less of a risk than human error: just last week…

Post by jopsen » Wed, Jun 01, 2022, 1:50 PM UTC

TimWolla wrote: post #29

xaduha wrote: post #25

Earlier quoted context omitted.

I suggest testing it yourself in any case, I don't think this article is correct in this. I did try it in the past with Google Titan and not a Yubikey and I could be wrong. EDIT: `-O resident` might be what is doing it though, I wasn't aware of this option.

> EDIT: `-O resident` might be what is doing it though, I wasn't aware of this option. Indeed. This will use FIDO 2 Discoverable Credentials / Resident Keys. Those are fully stored on-key (but their number is limited): https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Gu... . Non-resident keys will basically give out the private key encrypted with a static master key as the key handle and thus support an unli…