Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to use FIDO2 USB keys with SSH

stavros.io

Post reply on HN
Print view View original

91–99 of 99 posts

Re: How to use FIDO2 USB keys with SSH

#91

Post by knorker »

xaduha wrote: post #87
knorker wrote: post #85

Earlier quoted context omitted.

What makes you say it's not particularly suited for SSH?

Because they were made for a different purpose, with extra hoops you need to jump through.

U2F was made for a different purpose too.

I don't see what's so extra hoop-y about telling SSH "use key from industry standard PKCS#11". That's literally what it's there for, and when Yubico added PIV support that instantly added support to multiple operating systems (incl Linux & Windows) where SSH keys "just work".

I can take a yubikey today from my Linux system, plug it into a Windows machine, and Putty with wincrypt support "just works". Because that's how it was designed.

Re: How to use FIDO2 USB keys with SSH

#92

Post by xaduha »

knorker wrote: post #91
xaduha wrote: post #87

Earlier quoted context omitted.

Because they were made for a different purpose, with extra hoops you need to jump through.

U2F was made for a different purpose too. I don't see what's so extra hoop-y about telling SSH "use key from industry standard PKCS#11". That's literally what it's there for, and when Yubico added PIV support that instantly added support to multiple operating systems (incl Linux & Windows) where SSH keys "just work". I can take a yubikey today from my Linux system, plug it into a Windows machine, and Putty with wincr…

You're using yubikey agent or ykcs11 or yubico-piv-tool or somesuch nonsense most likely that actually provides PKCS#11. That is it wraps whatever PIV is supposed to do and gives you PKCS#11 interface. I'm talking about something that isn't Yubico specific and provides PKCS#11 and PKCS#15 with OpenSC straight ootb.

e.g. issues that described here are avoided https://github.com/FiloSottile/yubikey-agent#alternatives

Re: How to use FIDO2 USB keys with SSH

#93

Post by knorker »

xaduha wrote: post #92
knorker wrote: post #91

Earlier quoted context omitted.

U2F was made for a different purpose too. I don't see what's so extra hoop-y about telling SSH "use key from industry standard PKCS#11". That's literally what it's there for, and when Yubico added PIV support that instantly added support to multiple operating systems (incl Linux & Windows) where SSH keys "just work". I can take a yubikey today from my Linux system, plug it into a Windows machine, and Putty with wincr…

You're using yubikey agent or ykcs11 or yubico-piv-tool or somesuch nonsense most likely that actually provides PKCS#11. That is it wraps whatever PIV is supposed to do and gives you PKCS#11 interface. I'm talking about something that isn't Yubico specific and provides PKCS#11 and PKCS#15 with OpenSC straight ootb. e.g. issues that described here are avoided https://github.com/FiloSottile/yubikey-agent#alternatives

I'm using opensc straight of the box, with vanilla SSH. I am using ssh-agent, but it works just as well without it.

I can pop my yubikey into a plain vanilla install of Linux and run "ssh -oPKCS11Provider=/path/to/opensc-pkcs11.so user@host.com".

Or just put this into your ~/.ssh/config

Host *

  PKCS11Provider /path/to/opensc-pkcs11.so
Or on a Windows plain vanilla system I just pop the key in and tell putty-cryptoapi to use "the smartcard key". Windows pops up my pinentry dialog, then I touch to verify physical presence, and in I go.

I agree that the gpg-agent way is yuck. But I still don't understand what you mean about the PKCS#11 way though. Yes, setting up the key required yubico tooling. Is that what you're talking about?

Re: How to use FIDO2 USB keys with SSH

#94

Post by knorker »

Xylakant wrote: post #74
closeparen wrote: post #73

Earlier quoted context omitted.

OpenSSH doesn't do X.509, how would PIV mode or a smartcard help?

Yubikeys work in PIV mode with openssh, it just requires the necessary module and some invocation dance with ssh-agent https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PK... or Filippo Valsordas yubikey-agent https://github.com/FiloSottile/yubikey-agent

What invocation dance?

This works:

"ssh -oPKCS11Provider=/path/to/opensc-pkcs11.so user@host.com"

Or you place that in your ~/.ssh/config

Host *

  PKCS11Provider /path/to/opensc-pkcs11.so

Re: How to use FIDO2 USB keys with SSH

#95

Post by tialaramex »

crote wrote: post #77
tialaramex wrote: post #54

Earlier quoted context omitted.

A full-blown Yubikey has modifiable firmware and a relatively large amount of rewritable Flash storage. I assume those features aren't free. A FIDO authenticator has no modifiable state beyond maybe some sort of counter, it has a random secret key which makes it unique from its siblings, and that's it. No firmware update feature, no storage. The crypto hardware is also simpler. FIDO was defined in terms of these nice…

That's not really true anymore. Yubikeys haven't supported firmware modification for years due to security reasons, and FIDO2 keys often have storage in order to support Resident Keys.

I was not aware that Yubikeys no longer can be firmware updated. My impression was that they just don't permit user firmware modification by policy but that is clearly wrong.

FIDO Security Keys are cheaper than FIDO2 Security Keys which is what I'd expect from what I wrote, they don't need any storage.

Re: How to use FIDO2 USB keys with SSH

#96

Post by xaduha »

knorker wrote: post #93
xaduha wrote: post #92

Earlier quoted context omitted.

You're using yubikey agent or ykcs11 or yubico-piv-tool or somesuch nonsense most likely that actually provides PKCS#11. That is it wraps whatever PIV is supposed to do and gives you PKCS#11 interface. I'm talking about something that isn't Yubico specific and provides PKCS#11 and PKCS#15 with OpenSC straight ootb. e.g. issues that described here are avoided https://github.com/FiloSottile/yubikey-agent#alternatives

I'm using opensc straight of the box, with vanilla SSH. I am using ssh-agent, but it works just as well without it. I can pop my yubikey into a plain vanilla install of Linux and run "ssh -oPKCS11Provider=/path/to/opensc-pkcs11.so user@host.com". Or just put this into your ~/.ssh/config Host * PKCS11Provider /path/to/opensc-pkcs11.so Or on a Windows plain vanilla system I just pop the key in and tell putty-cryptoapi…

I never owned a yubikey and things probably changed over the years also since I last looked into it. But even so what you have there is a proprietary applet with lots of extensions https://developers.yubico.com/PIV/Introduction/Yubico_extens...

If it works with OpenSC out of the box, then that's because Yubico made it to work. I pretty sure that if you tried to use a publicly available PIV applet that does its PIV duties in accordance with the specs you are not going to have a good time trying to pair it with OpenSSH.

Re: How to use FIDO2 USB keys with SSH

#97

Post by knorker »

xaduha wrote: post #96
knorker wrote: post #93

Earlier quoted context omitted.

I'm using opensc straight of the box, with vanilla SSH. I am using ssh-agent, but it works just as well without it. I can pop my yubikey into a plain vanilla install of Linux and run "ssh -oPKCS11Provider=/path/to/opensc-pkcs11.so user@host.com". Or just put this into your ~/.ssh/config Host * PKCS11Provider /path/to/opensc-pkcs11.so Or on a Windows plain vanilla system I just pop the key in and tell putty-cryptoapi…

I never owned a yubikey and things probably changed over the years also since I last looked into it. But even so what you have there is a proprietary applet with lots of extensions https://developers.yubico.com/PIV/Introduction/Yubico_extens... If it works with OpenSC out of the box, then that's because Yubico made it to work. I pretty sure that if you tried to use a publicly available PIV applet that does its PIV du…

Well… do you still say that it's not particularly well suited, then?

If yes, then why?

Re: How to use FIDO2 USB keys with SSH

#98

Post by xaduha »

knorker wrote: post #97
xaduha wrote: post #96

Earlier quoted context omitted.

I never owned a yubikey and things probably changed over the years also since I last looked into it. But even so what you have there is a proprietary applet with lots of extensions https://developers.yubico.com/PIV/Introduction/Yubico_extens... If it works with OpenSC out of the box, then that's because Yubico made it to work. I pretty sure that if you tried to use a publicly available PIV applet that does its PIV du…

Well… do you still say that it's not particularly well suited, then? If yes, then why?

Decide for yourself, PIV is an old and sprawling monstrosity and if you go from the specs, then no, it's not particularly suited for this relatively simple task. Proprietary PIV applet made by Yubico might be, but is that a good thing? Not in my book when they easily could've done what Philip Wendland did there with IsoApplet, having several applets and switching between them is basic stuff.

Re: How to use FIDO2 USB keys with SSH

#99

Post by jjoonathan »

conradev wrote: post #57
jjoonathan wrote: post #20

Earlier quoted context omitted.

Here's a browser compatibility matrix (I know, OP is about SSH). FIDO2/U2F Just Works in: Chrome on Windows Firefox on Windows Chrome on Mac Firefox on Mac Chrome in Ubuntu 20 Firefox in Ubuntu 20 Wall of shame (FIDO2/U2F does not Just Work in): Safari EDIT: it does work out-of-the-box in Ubuntu 20, my bad.

I've been using my YubiKey 5Ci in Safari on macOS and iOS since macOS 10.15[1] and iOS 13.3[2] (which came out several months ago), and Safari supports FIDO2 + WebAuthn just fine. [1] https://developer.apple.com/documentation/safari-release-not... [2] https://developer.apple.com/documentation/ios-ipados-release...

Confirmed, WebAuthn works on Safari, MacOS 10.15.5, and https://demo.yubico.com/ .

My mistake was to assume that AWS saying "Your browser does not support U2F security keys." meant that Safari didn't support U2F keys. Given AWS's well-earned reputation for half-assing things I really shouldn't have trusted their assessment, but I did. My bad.

Post reply on HN