Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to use FIDO2 USB keys with SSH

stavros.io

Post reply on HN
Print view View original

51–60 of 99 posts

Re: How to use FIDO2 USB keys with SSH

#51

Post by simias »

StavrosK wrote: post #26
simias wrote: post #23

I've been using my Yubikey in GnuPG smartcard mode for years to do the same thing, from what I can see from this tutorial FIDO2 seems a bit easier to setup initially but it also seems much less widely supported at the moment. Are there other tradeoffs to consider?

I think those are pretty much the only ones, the Yubikey in GPG smartcard mode was always too fiddly for me and interfered with my agent in other ways, but this is trivial to set up and use. Also, a big draw of the USB SSH key for me is that I can plug it in to other computers and connect to my servers, which smartcard mode didn't do, so that was a big drawback for me.

Yeah fiddly is the right word, although once the painful initial configuration is done it generally works fairly well in my experience.

Being able to easily migrate to a new computer sounds like a great feature though.

Re: How to use FIDO2 USB keys with SSH

#52

Post by simias »

tialaramex wrote: post #46
simias wrote: post #23

I've been using my Yubikey in GnuPG smartcard mode for years to do the same thing, from what I can see from this tutorial FIDO2 seems a bit easier to setup initially but it also seems much less widely supported at the moment. Are there other tradeoffs to consider?

Going FIDO-SSH can perhaps be cheaper than PIV, especially if, as we very much want, FIDO is popular which will tend to drive down prices. Cheaper/ simpler FIDO2 products (from Yubico) exist if this feature is the only thing you want from a Yubikey. I don't know if that's a future Yubico are enthusiastic about, but I don't see much reason to hate it as an end user. Even cheaper and even simpler FIDO products (from ma…

I always assumed that the relatively high price of the Yubikey had more to do with it being a relatively niche product than the cost of production, after all it's not much more than a cheap microcontroller underneath all that.

Was I wrong to make this assumption? Why would FIDO tokens be significantly cheaper and/or more popular?

If anything it seems like at first it's going to fragment the market even more.

Re: How to use FIDO2 USB keys with SSH

#53

Post by [deleted] »

StavrosK wrote: post #3
RL_Quine wrote: post #2

Be aware literally nothing supports this unless it's your own kernel. Gitlab? No. Github? No. My gateway with a hand built gentoo kernel? Yes. It seems functional, but you've also got to be aware that `ed25519-sk` and `ecdsa-sk` have sort of spotty support in the devices too. `ed25519-sk` does not work on a Yubikey <5, for example.

> Be aware literally nothing supports this unless it's your own kernel. Ubuntu 20.04 and later supports this, and, since that's LTS, it means that quite a few servers and machines will be supporting it already. Github/Gitlab aren't supporting it yet, but given how great it is for security, I think they have a big incentive to speed up support. > ed25519-ek does not work on a Yubikey That's no problem, since you can j…

[deleted]

Re: How to use FIDO2 USB keys with SSH

#54

Post by tialaramex »

simias wrote: post #52
tialaramex wrote: post #46

Earlier quoted context omitted.

Going FIDO-SSH can perhaps be cheaper than PIV, especially if, as we very much want, FIDO is popular which will tend to drive down prices. Cheaper/ simpler FIDO2 products (from Yubico) exist if this feature is the only thing you want from a Yubikey. I don't know if that's a future Yubico are enthusiastic about, but I don't see much reason to hate it as an end user. Even cheaper and even simpler FIDO products (from ma…

I always assumed that the relatively high price of the Yubikey had more to do with it being a relatively niche product than the cost of production, after all it's not much more than a cheap microcontroller underneath all that. Was I wrong to make this assumption? Why would FIDO tokens be significantly cheaper and/or more popular? If anything it seems like at first it's going to fragment the market even more.

A full-blown Yubikey has modifiable firmware and a relatively large amount of rewritable Flash storage. I assume those features aren't free.

A FIDO authenticator has no modifiable state beyond maybe some sort of counter, it has a random secret key which makes it unique from its siblings, and that's it. No firmware update feature, no storage.

The crypto hardware is also simpler. FIDO was defined in terms of these nice compact elliptic curve schemes. The keys are small, the operations are simple, I'd be surprised if dedicated silicon to implement this isn't cheaper, and if you're just running it on a cheap microcontroller I'd be surprised if you can't get away with a cheaper microcontroller than you would need to implement RSA encryption and whatever else a Yubikey can do.

Finally in terms of volume, it makes sense to give all your 5000 staff a FIDO key. "Go to the enrollment page we built by this Friday. Enrol your FIDO key. Call the help desk if you have problems. From next Monday these are mandatory". You can lock down common corporate web SSO solutions with it for example, outfits like Duo will let you just check one box and you can now answer "Yes" to pages of questions your CISO is supposed to fill out every year.

It doesn't make sense to give out 5000 traditional Yubikeys. A dozen to a dev team for PIV? Maybe. But the lady who does 2.5 days per week in the accounts department? She doesn't need PIV. She can use a FIDO key to sign into the accounts web app though.

Re: How to use FIDO2 USB keys with SSH

#55

Post by traceroute66 »

DCKing wrote: post #29

EDIT: I misunderstood the post, and what I describe below is not true! I'm incredibly excited about FIDO2, but this is quite underwhelming honestly. I'd like to SSH with a credential on my Yubikey, not by a credential or configuration already stored on my computer that is unlocked by my Yubikey. I'd like to be able to plug in my Yubikey anywhere and go. My Linux desktop, my Macbook, my Windows desktop, my Android pho…

"Yubikey with GPG/PIV for SSH"

There's no need to mess around with the GPG side of the Yubikey to get SSH working. Just the "plain" side of the Yubikey will work (which is great on a Mac because all you need is the basic dylibs - downloadable from Yubi and easily mv/cp installable in the relevant lib dir - rather than needing to mess around installing gpg). Added bonus is you enforce touch for key usage.

Re: How to use FIDO2 USB keys with SSH

#57

Post by conradev »

jjoonathan wrote: post #20
spiridow wrote: post #10

I'm really excited to see more and more people talk about FIDO2. If you're interested about this topic, I gave a talk about it yesterday: https://news.ycombinator.com/item?id=23689606

Here's a browser compatibility matrix (I know, OP is about SSH). FIDO2/U2F Just Works in: Chrome on Windows Firefox on Windows Chrome on Mac Firefox on Mac Chrome in Ubuntu 20 Firefox in Ubuntu 20 Wall of shame (FIDO2/U2F does not Just Work in): Safari EDIT: it does work out-of-the-box in Ubuntu 20, my bad.

I've been using my YubiKey 5Ci in Safari on macOS and iOS since macOS 10.15[1] and iOS 13.3[2] (which came out several months ago), and Safari supports FIDO2 + WebAuthn just fine.

[1] https://developer.apple.com/documentation/safari-release-not...

[2] https://developer.apple.com/documentation/ios-ipados-release...

Re: How to use FIDO2 USB keys with SSH

#58

Post by Freak_NL »

j88439h84 wrote: post #56

Is this instead of typing a password to unlock the ssh key?

If you wish. You can decide if you want a passphrase on the generated key or not, just as you can with a classic SSH key. It's probably best to use a passphrase and have ssh-agent remember it for you until you shut down the computer. That way you enter your passphrase the first time using SSH with that key after logging in, and ask you to tap the physical U2F key, and only ask for the interaction with the physical key afterwards.

When I SSH to a host configured like this, the Yubikey U2F key I am using blinks to ask me to touch it. It's really quite neat.

Re: How to use FIDO2 USB keys with SSH

#59

Post by OJFord »

simias wrote: post #23

I've been using my Yubikey in GnuPG smartcard mode for years to do the same thing, from what I can see from this tutorial FIDO2 seems a bit easier to setup initially but it also seems much less widely supported at the moment. Are there other tradeoffs to consider?

You can use an OpenPGP card more generally than just for SSH auth.

E.g. other auth, and GPG encryption - such as with `pass`.

Re: How to use FIDO2 USB keys with SSH

#60

Post by Freak_NL »

StavrosK wrote: post #3
RL_Quine wrote: post #2

Be aware literally nothing supports this unless it's your own kernel. Gitlab? No. Github? No. My gateway with a hand built gentoo kernel? Yes. It seems functional, but you've also got to be aware that `ed25519-sk` and `ecdsa-sk` have sort of spotty support in the devices too. `ed25519-sk` does not work on a Yubikey <5, for example.

> Be aware literally nothing supports this unless it's your own kernel. Ubuntu 20.04 and later supports this, and, since that's LTS, it means that quite a few servers and machines will be supporting it already. Github/Gitlab aren't supporting it yet, but given how great it is for security, I think they have a big incentive to speed up support. > ed25519-ek does not work on a Yubikey That's no problem, since you can j…

Debian 11 too, out of the box. It took a bit of work to use a newer openssh-client on my Ubuntu 18.04 laptop, but that was manageable.
Post reply on HN