Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Store an SSH Key on a Yubikey

xeiaso.net

Post reply on HN
Print view View original

91–100 of 154 posts

Re: How to Store an SSH Key on a Yubikey

#91

Post by xena »

a-dub wrote: post #90

but wait a minute... this is just storing the private key material on the yubikey like any storage device and it is loaded and copied right off every time you use it, right? doesn't that defeat the point of using a yubikey where the private key itself is never read from the device during authentication?

Author of the article here. From what I understand it puts the private key material on the Yubikey itself and then during the signing part of SSH authentication the SSH client asks the yubikey to do the signature. The private key never leaves the device.

Re: How to Store an SSH Key on a Yubikey

#92

Post by jordemort »

a-dub wrote: post #90

but wait a minute... this is just storing the private key material on the yubikey like any storage device and it is loaded and copied right off every time you use it, right? doesn't that defeat the point of using a yubikey where the private key itself is never read from the device during authentication?

No, the private key never leaves the YubiKey. SSH and GPG talk to the YubiKey as if it were a smartcard - data is send to the key to be signed or encrypted.

Re: How to Store an SSH Key on a Yubikey

#93

Post by a-dub »

xena wrote: post #91
a-dub wrote: post #90

but wait a minute... this is just storing the private key material on the yubikey like any storage device and it is loaded and copied right off every time you use it, right? doesn't that defeat the point of using a yubikey where the private key itself is never read from the device during authentication?

Author of the article here. From what I understand it puts the private key material on the Yubikey itself and then during the signing part of SSH authentication the SSH client asks the yubikey to do the signature. The private key never leaves the device.

that's how i would hope it would work, but isn't the key in this example getting loaded into the agent?

Re: How to Store an SSH Key on a Yubikey

#94

Post by zrail »

a-dub wrote: post #93
xena wrote: post #91

Earlier quoted context omitted.

Author of the article here. From what I understand it puts the private key material on the Yubikey itself and then during the signing part of SSH authentication the SSH client asks the yubikey to do the signature. The private key never leaves the device.

that's how i would hope it would work, but isn't the key in this example getting loaded into the agent?

The agent is a shim that talks to the Yubikey.

Re: How to Store an SSH Key on a Yubikey

#95

Post by a-dub »

zrail wrote: post #94
a-dub wrote: post #93

Earlier quoted context omitted.

that's how i would hope it would work, but isn't the key in this example getting loaded into the agent?

The agent is a shim that talks to the Yubikey.

interesting, just read through the release notes. pretty cool.

i think a small discussion of this (and how the agent/key handles/resident mode work) would make an excellent addition to the blog post. it was very clear how to set it up, but left me with questions as to if i should...

in practice i would wonder about backup authentication methods and key rotation....

but otherwise all in all pretty cool.

Re: How to Store an SSH Key on a Yubikey

#96

Post by veganjay »

Thanks for sharing the article. I followed it and it was very simple to set up.

In the past, I postponed setting this up after I encountered issues. I tried to run "ykman", but it seemed to fight with "yubioath-desktop". It was tricky to debug and I ended up rebooting. I think the reason was that I installed "yubioath-desktop" using snap, which runs "pcscd" as a snap service, and "ykman" wants to start the "pcscd" system service.

Either case, for this tutorial, I skipped the part running 'ykman'. Basically the only commands were:

    ssh-keygen -t ed25519-sk -O resident

    ssh-add -K

Re: How to Store an SSH Key on a Yubikey

#98

Post by WhyNotHugo »

nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

Keeping an extra key stored away works well enough.

IF my primary key gets lots, I'd hope the one backup one won't suddenly fail that same day -- if it does, then there's a problem.

The annoying bit is having to add all 2FA tokens to the backup one -- which is tricky if you want to store if off-site, since you need to bring it in every once in a while to add all the new 2FA secrets to it.

Re: How to Store an SSH Key on a Yubikey

#99

Post by staticassertion »

nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

I keep my backup key in a drawer with a bunch of papers and records and shit. It's also where I keep my 2FA backup codes, and a few other decryption keys.

Re: How to Store an SSH Key on a Yubikey

#100

Post by WhyNotHugo »

pid-1 wrote: post #81
nextlevelwizard wrote: post #4

I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…

After buiyng a Yubikey and using it for like one year, I now use 1Password to manage all my MFA. It can work like Google Authenticator (using OTP), except it's not tied to a single device. Not as safe as Yubikey, but likely a good compromise between security and user stupidity protection. Also: - 1Pw blocks itself after a few min without use. - Installing 1Pw for the first time in a device is a bit more bureaucratic…

1Password is super convenient for MFA, but it's really FAKE MFA. You password and the OTP secret are both stored together, in the same vault, guarded by the same password.

If one is leaked or accessed, so is the other.

It only really provide protection against the most basic / passive MITM attacks.

Post reply on HN