Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Store an SSH Key on a Yubikey

xeiaso.net

Post reply on HN
Print view View original

81–90 of 154 posts

Re: How to Store an SSH Key on a Yubikey

#81

Post by pid-1 »

nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

After buiyng a Yubikey and using it for like one year, I now use 1Password to manage all my MFA.

It can work like Google Authenticator (using OTP), except it's not tied to a single device.

Not as safe as Yubikey, but likely a good compromise between security and user stupidity protection.

Also:

- 1Pw blocks itself after a few min without use.

- Installing 1Pw for the first time in a device is a bit more bureaucratic than a simple login.

I really think any MFA needs something to protect users from forgetting stuff to be successful. Even if it's something stupid like going physically to a store. I can't stand the idea that by loosing my two keys I will loose access to all my things and there's no one who can help me.

Re: How to Store an SSH Key on a Yubikey

#82

Post by yakak »

mschuster91 wrote: post #75
yakak wrote: post #36

Earlier quoted context omitted.

I think people start with trying to do the best practice too early. Just using one key as your primary authentication adds a lot of security as other authentication methods aren't as routinely exposed. That's enough to get started and makes it easier to think about backups when one is ready for multiple keys.

> Just using one key as your primary authentication adds a lot of security Yeah, and look just how often people lose or wash their phones or their keys, or how easy it is to break off a Yubikey that is on a keychain (e.g. when a cat pulls on it). Then you are usually royally screwed.

Sounds like FUD to me. If you lose your primary method you have to remember the password to unlock your secondary software ssh key..

Possibly remembering a password is a huge crisis but I had that crisis before using tokens, i.e. returning to my work desktop after a vacation.

Re: How to Store an SSH Key on a Yubikey

#83

Post by gspr »

nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

My thinking is the same. That's why I, in addition to the second USB stick, also have a plain-text copy stored on paper in a safe. EC keys are even short enough that you don't have to involve a printer in the process.

Re: How to Store an SSH Key on a Yubikey

#84

Post by tialaramex »

tazjin wrote: post #12

The problem with this approach is that the `-sk` keys need to be supported server-side (I'm not sure if that support goes beyond including them in a list of recognised key types, but it doesn't matter). As a result, lots of systems that are not bleeding edge still don't accept them, for example Gerrit.

The support is substantially more than "including them in a list of recognised key types" because the FIDO device is deliberately unwilling to do anything except emit FIDO-style signatures, so you need to understand those signatures and verify them.

On the other hand, probably we should have learned by now that even apparently trivial verification steps are too easy to get wrong (or plain omit) and so you really want to delegate all of this work to just one implementation which was actually written by people who know what they're doing and, preferably also formally verified as correct since people who "know what they're doing" still make far too many mistakes. Thus, maybe there shouldn't be so many independent (and likely in some cases, wrong) implementations of this check.

Re: How to Store an SSH Key on a Yubikey

#85

Post by tialaramex »

beagle3 wrote: post #52
phaer wrote: post #9

Earlier quoted context omitted.

I think the official recommendation is to store a second yubikey in a safe location. Personally I just generated my key offline (on a tails livecd) and backed it up to two different LUKS-encrypted USB sticks. One of those is stored at my place and another one at a trusted person, in case my flat burns down or so. The yubikey itself only stores subkeys, my master key stays on said USB sticks. Been using this setup for…

Does this also work for the WebAuthn / U2F / TOTP use cases, or just the PGP/PIV/SSH ones?

No. There is no way to push a value for the symmetric key that probably makes the FIDO (thus U2F / WebAuthn) feature work. You can tell the Yubikey to pick a random new one, effectively wiping your key (and rendering any credentials previously minted with it now invalid) but you can't write one over USB and this was I believe intentional.

Re: How to Store an SSH Key on a Yubikey

#86

Post by tialaramex »

archi42 wrote: post #38

> This should work on other FIDO keys like Google's Titan, but we don't have access to one over here and as such haven't tested it. For my trusty HyperFIDO Mini (usb id 0x2ccf:0x0880) this doesn't work, though it's rather old (1st gen) and maybe they refreshed it to support this. ssh-keygen fails with "Key enrollment failed: requested feature not supported". I wanted to replace it with a USB-C (& maybe NFC) device an…

The feature causing this is -O resident which tells the device, "Hey, you need to remember these credentials" (ie they are resident on the device).

For WebAuthn this enables "usernameless" login. You rock up to a random PC anywhere in the world, go to example.com, just click "Sign in", and your authenticator is like, "Hi example.com, according to my records I am archi42, user 123456-ACBDE-123 and as proof here's a signature made with my unique private key" and the site checks its database and signs you in. Convenient and fairly secure (most devices with such a feature expect a PIN, or a fingerprint, or some such factor beyond "something you have" in the form of the authenticator itself).

For SSH, this means the magic file that makes SSH with FIDO work can be regenerated on another client machine by just asking it to spit out the credentials.

Chances are your device does not have this feature, usernameless login on the web is rare, so few people need this, and of course it's a considerable extra hardware implementation burden. Yubico products have it though, as do some others, and the phone implementations (iPhone, newer Android) likewise.

If you mostly use the same machines (laptop, maybe a desktop) for SSH, the resident feature isn't important, just don't write "-O resident" and remember that although they aren't a security feature the resulting files are unique and if you don't have them you can't log in. If you regularly use different machines for SSH login because you're say, a roaming technician logging in to physical hardware on site or you insist on travelling very light, then it's very valuable and worth upgrading to get the resident feature.

Re: How to Store an SSH Key on a Yubikey

#87

Post by mschuster91 »

yakak wrote: post #82
mschuster91 wrote: post #75

Earlier quoted context omitted.

> Just using one key as your primary authentication adds a lot of security Yeah, and look just how often people lose or wash their phones or their keys, or how easy it is to break off a Yubikey that is on a keychain (e.g. when a cat pulls on it). Then you are usually royally screwed.

Sounds like FUD to me. If you lose your primary method you have to remember the password to unlock your secondary software ssh key.. Possibly remembering a password is a huge crisis but I had that crisis before using tokens, i.e. returning to my work desktop after a vacation.

> If you lose your primary method you have to remember the password to unlock your secondary software ssh key..

The post I was replying to was talking about 2FA in general, not just for SSH keys. Many people take the advertisements of Facebook, Google, Twitter et al. to push for 2FA as pure gospel, but completely neglect "worst case recovery" scenarios - and then run into stone walls when it inevitably happens, because FB/GOOG/TWTR don't offer any sort of customer support (other than raising threads on HN, and even that is similar to winning the lottery) and Amazon AWS doesn't offer multiple 2FA keys at all.

The laws of statistics mean that even if something happens only for 0.001% of all users, at the scale of the big tech companies it still hits tens to hundreds of thousands of people, who have no recourse at all and are now completely and forever locked out of their online identity. Simply because they have not known about the failure modes.

We here, who debate on HN, know about the dangers and how to prevent them. But our parents? Our siblings? They do not, and companies push them to extremely irresponsible practices nevertheless. We can't go and claim on the one side (when fighting against surveillance, backdoors etc.) that our online identities and presences are extensions of our minds and should be protected, and at the same time make it so extremely easy for people to lose access to them!

Re: How to Store an SSH Key on a Yubikey

#88

Post by NavinF »

nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

That’s what makes these keys so secure. Most people I know keep one on their person (keychain), one in a locations they have easy access to (hidden at home), and one off-site. You still have a password as the first line of defense so don’t overthink it.

Re: How to Store an SSH Key on a Yubikey

#89

Post by beagle3 »

tialaramex wrote: post #85
beagle3 wrote: post #52

Earlier quoted context omitted.

Does this also work for the WebAuthn / U2F / TOTP use cases, or just the PGP/PIV/SSH ones?

No. There is no way to push a value for the symmetric key that probably makes the FIDO (thus U2F / WebAuthn) feature work. You can tell the Yubikey to pick a random new one, effectively wiping your key (and rendering any credentials previously minted with it now invalid) but you can't write one over USB and this was I believe intentional.

Thanks. I will wait until it’s actually possible to create back up webauthn keys (rather than enlisting two keys with every service).

Re: How to Store an SSH Key on a Yubikey

#90

Post by a-dub »

but wait a minute... this is just storing the private key material on the yubikey like any storage device and it is loaded and copied right off every time you use it, right?

doesn't that defeat the point of using a yubikey where the private key itself is never read from the device during authentication?

Post reply on HN