Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Store an SSH Key on a Yubikey

xeiaso.net

Post reply on HN
Print view View original

21–30 of 154 posts

Re: How to Store an SSH Key on a Yubikey

#21

Post by krzyk »

INTPenis wrote: post #10
stingraycharles wrote: post #6

Earlier quoted context omitted.

As someone who uses Yubikey for about 5 years for SSH, GPG and O2F, an extra key is indeed the solution I use. Effectively it means all integrations must support multiple keys, and you’ll have to register both. Of course, this doesn’t work everywhere, such as AWS. In those cases, I typically use my “main” key. I’d argue that the key breaking due to wear or being lost is less of a risk than human error: just last week…

>just last week I had to enter the admin GPG code for the first time in years, and I forgot it initially Now this is scary. I'm going to reveal some of my opsec but my password manager (pass(1)) does have yubikeys registered but it also accepts my GPG key. So even if I lose my yubikeys I can still unlock all the passwords, otp codes and everything I have in there. I just can't feel comfortable with any other solution…

I use pass also but only with GPG and I feel a bit uncomfortable that I don't know anything about GPG, I don't remember if I set a password there or how to move it to another computer for backup or sync of the stored data in pass.

Re: How to Store an SSH Key on a Yubikey

#22

Post by BoppreH »

nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

That's a very good question and in my opinion the biggest flaw with almost all new 2FA/passwordless systems. The "best practice" is to get a second yubikey or store recovery codes on paper, but that requires keeping them close to you because you'll need to update your backup on every new signup.

That makes these systems entirely useless at protecting against house fires, signups while away from home, or simply services that are too lazy to support your backup style (looking at you, AWS).

I think what we need is one master key that can be backed up in a offsite location (e.g. safe deposit box, lawyer, parents, trusted friends), and then have all subsequent secrets generated from it, or encrypted with it and stored somewhere publicly accessible.

Re: How to Store an SSH Key on a Yubikey

#23

Post by xvector »

nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

> but don't really know where I would feel comfortable storing the extra key

So this doesn't really matter, because with enough incorrect PIN attempts the YubiKey will wipe the credentials. Store it somewhere it won't get destroyed, but don't worry too much about theft.

Re: How to Store an SSH Key on a Yubikey

#24

Post by aborsy »

phaer wrote: post #9
nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

I think the official recommendation is to store a second yubikey in a safe location. Personally I just generated my key offline (on a tails livecd) and backed it up to two different LUKS-encrypted USB sticks. One of those is stored at my place and another one at a trusted person, in case my flat burns down or so. The yubikey itself only stores subkeys, my master key stays on said USB sticks. Been using this setup for…

No need for LUKS usb. Gpg stores private keys encrypted with a password.

At that point, you can store the encrypted key anywhere.

Re: How to Store an SSH Key on a Yubikey

#25

Post by xaduha »

jopsen wrote: post #16

Curious, if you delete the stub in ~/.ssh/id_ed25519_sk, can you then recover the key? Or does the on-the-fly key generation use random bytes stored in the stub?

I suggest testing it yourself in any case, I don't think this article is correct in this. I did try it in the past with Google Titan and not a Yubikey and I could be wrong.

EDIT: `-O resident` might be what is doing it though, I wasn't aware of this option.

Re: How to Store an SSH Key on a Yubikey

#27

Post by rgoulter »

artdigital wrote: post #17
stingraycharles wrote: post #6

Earlier quoted context omitted.

As someone who uses Yubikey for about 5 years for SSH, GPG and O2F, an extra key is indeed the solution I use. Effectively it means all integrations must support multiple keys, and you’ll have to register both. Of course, this doesn’t work everywhere, such as AWS. In those cases, I typically use my “main” key. I’d argue that the key breaking due to wear or being lost is less of a risk than human error: just last week…

I have a question - do you disable regular OTP 2FA on services you use the Yubikey? I have one too and religiously added it to all kinds of things, but each service allowed me to just skip the yubikey when a regular OTP code was entered, effectively making me not use the yubikey

If you have only one Yubikey, and use it as the only factor of authentication to a website, you'll need to ensure you store the 2FA recovery codes safely. Whereas, if you have both Yubikey and TOTP as factors of authentication, if you lose the Yubikey, you'll still be able to login.

I view that as "Yubikey more convenient than TOTP". You can either use TOTP, or the Yubikey, and it's easier to tap a button than to enter a code.

Re: How to Store an SSH Key on a Yubikey

#28

Post by lordnacho »

nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

If your whole life is on your phone like me, just attach a yubi to your actual keychain (which is stuck to your phone) and then you'll always be thinking about where your phone/wallet/keys/security are all the time.

Then put the second key on your desk. My yubi happens to be annoying to fiddle with since it's on my keychain, so I use the desk one for signing most of the time.

If there's a house fire, you'll have your phone on you. If you lose your phone, you'll have a key at home.

Re: How to Store an SSH Key on a Yubikey

#29

Post by TimWolla »

xaduha wrote: post #25
jopsen wrote: post #16

Curious, if you delete the stub in ~/.ssh/id_ed25519_sk, can you then recover the key? Or does the on-the-fly key generation use random bytes stored in the stub?

I suggest testing it yourself in any case, I don't think this article is correct in this. I did try it in the past with Google Titan and not a Yubikey and I could be wrong. EDIT: `-O resident` might be what is doing it though, I wasn't aware of this option.

> EDIT: `-O resident` might be what is doing it though, I wasn't aware of this option.

Indeed. This will use FIDO 2 Discoverable Credentials / Resident Keys. Those are fully stored on-key (but their number is limited): https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Gu....

Non-resident keys will basically give out the private key encrypted with a static master key as the key handle and thus support an unlimited number of keys. If you lose the key handle, then the key is gone. That's probably what you were experiencing with your Titan.

Re: How to Store an SSH Key on a Yubikey

#30

Post by seodisparate »

You can use a GPG key stored on a YubiKey with openssh, but with some caveats:

1. gpg-agent must act as your ssh-agent (which means ssh-agent should be disabled and replaced by gpg-agent).

2. If using `pinentry-curses` (YubiKey usually permits access to the contained GPG key via the use of a pin), you must have `export GPG_TTY=$(tty)` (or your shell's equivalent of setting the GPG_TTY environment value to the output of `tty`).

3. You can fetch the public key of your GPG key with `ssh-add -L` (gpg-agent must be acting as your ssh-agent, and the YubiKey with the GPG key has to be plugged in).

4. You must have the line `enable-ssh-support` in your `$GNUPGHOME/gpg-agent.conf`.

I used a guide[1] to set up a GPG key on to a YubiKey, and for those who don't want to use GPG, the guide also has a section[2] about just using an SSH key as well.

[1]: https://github.com/drduh/YubiKey-Guide

[2]: https://github.com/drduh/YubiKey-Guide#ssh

Post reply on HN