Yubico with new 4096-bit keys and gpg-agent for ssh authentication
1–10 of 51 posts
Re: Yubico with new 4096-bit keys and gpg-agent for ssh authentication
#2I'm surprised that more folks haven't just gone to 8,192-bit keys, out of an abundance of caution.
Re: Yubico with new 4096-bit keys and gpg-agent for ssh authentication
#3Are the github keys they sold cheaply compatible with 4096 bit keys? I'm loathe to buy another, considering i've got 3 already...
Re: Yubico with new 4096-bit keys and gpg-agent for ssh authentication
#4I'm surprised that more folks haven't just gone to 8,192-bit keys, out of an abundance of caution.
4,096 is already an abundance of caution. You might as well say people should go to 32,768 just to be sure. Then somebody else would come along and say, "why not 65,536?"
Re: Yubico with new 4096-bit keys and gpg-agent for ssh authentication
#5Are the github keys they sold cheaply compatible with 4096 bit keys? I'm loathe to buy another, considering i've got 3 already...
As far as I'm aware, Yubikey 4 and Yubikey Nano 4 can do 4096; the older ones like the NEO can only do 2048.
Not that 2048 is flawed as such: it's still north of 100 bits workfactor at the moment, as far as I gather. 3072 would be equivalent to about 128 (similar to the EC algorithms secp256r1 or Curve25519), and 4096 is some extra insurance on top. (As a benchmark: Snowden used 4096-bit RSA keys for GnuPG.) Anything bigger than that could introduce OpenPGP compatibility troubles.
All of these are secure when correctly implemented. (Yubikey use NXP chips. I don't have much to say beyond that, I haven't audited them.) All of them will fall to Shor's algorithm on a quantum computer of sufficient size, but we're not likely to have one of those for a good few years, if they're possible.
Re: Yubico with new 4096-bit keys and gpg-agent for ssh authentication
#6Is there any way to store an ssh server key in it, or an https server's key? Basically turning this into a mini-HSM ?
Re: Yubico with new 4096-bit keys and gpg-agent for ssh authentication
#7Is there any way to store an ssh server key in it, or an https server's key? Basically turning this into a mini-HSM ?
[deleted]
Re: Yubico with new 4096-bit keys and gpg-agent for ssh authentication
#8May I offer my article on an excellent password manager complementing the Yubico devices well? https://drupalwatchdog.com/blog/2015/6/yubikey-neo-and-bette...
Re: Yubico with new 4096-bit keys and gpg-agent for ssh authentication
#9Nitrokey[1] is about the same price as Yubico but has open source firmware & hardware. You might also know them as CryptoStick[2].
[2] https://blog.mozilla.org/security/2013/02/13/using-cryptosti...
Re: Yubico with new 4096-bit keys and gpg-agent for ssh authentication
#10Are the github keys they sold cheaply compatible with 4096 bit keys? I'm loathe to buy another, considering i've got 3 already...
No, because the github / U2F keys don’t have any writeable local storage.