How to Store an SSH Key on a Yubikey
xeiaso.net
How to Store an SSH Key on a Yubikey
1–10 of 154 posts
Re: How to Store an SSH Key on a Yubikey
#2> As of OpenSSH 8.2 (Feburary 14, 2020) you are able to store an SSH private key on a yubikey! Here's how to do it.
Many systems still don't have OpenSSH 8.2 (Windows 11, older debian stable, etc). For those, another solution is to use the PGP applet of the YubiKey, which exposes a regular RSA key.
This guide has worked well for me: https://github.com/drduh/YubiKey-Guide
You can jump to the SSH sections if that's all you're after.
There's a missing piece for Windows, since the agent coming with WinGPG won't be reachable by SSH. Some guy on GitHub put out a workaround, but I can't find it right now.
--
edit: The workaround for Windows is this one: https://github.com/rupor-github/win-gpg-agent
Re: How to Store an SSH Key on a Yubikey
#3Something else that is quite nice is that you can switch to certificate auth and use your yubikey to protect an ed25519-sk certificate authority.
Re: How to Store an SSH Key on a Yubikey
#4I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?)
I'm probably just over thinking this and overly paranoid.
Re: How to Store an SSH Key on a Yubikey
#5Something else that is quite nice is that you can switch to certificate auth and use your yubikey to protect an ed25519-sk certificate authority.
this.
Re: How to Store an SSH Key on a Yubikey
#6I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…
As someone who uses Yubikey for about 5 years for SSH, GPG and O2F, an extra key is indeed the solution I use.
Effectively it means all integrations must support multiple keys, and you’ll have to register both. Of course, this doesn’t work everywhere, such as AWS. In those cases, I typically use my “main” key.
I’d argue that the key breaking due to wear or being lost is less of a risk than human error: just last week I had to enter the admin GPG code for the first time in years, and I forgot it initially, which caused the device to lock itself, and apparently the recovery code didn’t work. Caused me a few hours of stress to get it resolved.
So yeah it requires some discipline. What’s important is that you need to identity the services you absolutely cannot lose access to: in my case it’s my email and password manager. For those two, I properly manage backup codes, regularly test both yubikeys, etc. The rest can all be recovered through email, if it needs to be.
Re: How to Store an SSH Key on a Yubikey
#7For those who like to know more details about Yubikeys, I found this pretty interesting: https://www.youtube.com/watch?v=INi-xKpYjbE
Re: How to Store an SSH Key on a Yubikey
#8Something else that is quite nice is that you can switch to certificate auth and use your yubikey to protect an ed25519-sk certificate authority.
How does that work, do you know a good tutorial for this?
Re: How to Store an SSH Key on a Yubikey
#9I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…
I think the official recommendation is to store a second yubikey in a safe location.
Personally I just generated my key offline (on a tails livecd) and backed it up to two different LUKS-encrypted USB sticks. One of those is stored at my place and another one at a trusted person, in case my flat burns down or so. The yubikey itself only stores subkeys, my master key stays on said USB sticks.
Been using this setup for about 5 years now and it's been working well for me so far. Once a year, I extend my gpg keys expiration time by using on of the USB sticks.
Re: How to Store an SSH Key on a Yubikey
#10I know Yubikeys are pretty old hat by now, but I still feel weirded out by relying something like this into a USB stick. I just know I would lose the key at some point locking me out from everything. Of course the solution is to have two keys, but don't really know where I would feel comfortable storing the extra key (also how often do you check that it still works?) I'm probably just over thinking this and overly pa…
As someone who uses Yubikey for about 5 years for SSH, GPG and O2F, an extra key is indeed the solution I use. Effectively it means all integrations must support multiple keys, and you’ll have to register both. Of course, this doesn’t work everywhere, such as AWS. In those cases, I typically use my “main” key. I’d argue that the key breaking due to wear or being lost is less of a risk than human error: just last week…
>just last week I had to enter the admin GPG code for the first time in years, and I forgot it initially
Now this is scary.
I'm going to reveal some of my opsec but my password manager (pass(1)) does have yubikeys registered but it also accepts my GPG key. So even if I lose my yubikeys I can still unlock all the passwords, otp codes and everything I have in there.
I just can't feel comfortable with any other solution than my head being the final master key.