3 ms·

Am I correct that YubiKey users are unaffected by this vulnerability? As I understand it, the private key never enters into memory.

• feld 11y ago
  I guess it depends on what you mean? I have yubikey 2FA on my servers for SSH, but also have SSH keys. I use SSH keys when I can, and yubikey when I don't have my SSH keys handy. I suppose if you're doing yubikey+password auth and don't have any keys configured for your ssh client you're fine because... you don't have any keys? :)
  • Freaky 11y ago
    You can use a Yubikey NEO to handle key authentication on your computer's behalf: https://blog.habets.se/2013/02/GPG-and-SSH-with-Yubikey-NEO https://blog.habets.se/2013/02/GPG-and-SSH-with-Yubikey-NEO
    • feld 11y ago
      Sure, but this capability isn't unique to Yubikey. The question was just worded confusingly. Really it's just "ssh key on a smart card".
      • devin 11y ago
        Yes, my bad on the wording of the original question.
  • Xylakant 11y ago
    yubikeys support ssh key auth (via gpg-agent in ssh mode). It's sometimes a bit wobbly, but in general works fine.
    • devin 11y ago
      This is what I was referring to, and what I'm using, not 2FA. In this case, the PK stored on my YubiKey Neo never makes it into memory.
• rkeene2 11y ago
  Using any sort of hardware security module, such as a smartcard (which some YubiKey devices can operate as) will not allow your private key to be compromised because you have no access to your private key -- it's on a whole separate computer (the HSM) and your only access to it is by sending APDUs to that computer. For a typical smartcard the only thing you can ask it to do with your private key is to perform cryptographic operations on data with it. Many smartcard applets require that you authenticate yourself to the smartcard before they will even do that. I use a smartcard with a NIST SP 800-73 applet on it for all my SSH (and TLS) sessions and do not have any other SSH keys.