3 ms·

How do you feel about Yubikey-based keys? Asking for a friend...

• subway 10y ago
  Most workflows utilizing OpenPGP cards (like the Yubikey) encourage better key hygiene. Generally you'd create a certification key which lives offline 100% of the time, with a subkey issued to the Yubikey. This means your offline key can persist for a very long time while you can safely rotate the day to day subkey. Unfortunately while these workflows are encouraged, the tooling doesn't exist to make it a trivial operation for folks not familiar with proper key hygiene.
• matheusmoreira 10y ago
  I have a YubiKey myself and they're really convenient. There's a cryptoprocessor inside so the key doesn't have to leave the device. I think it's more secure than a regular computer connected to the internet. After reading¹² about this subject, I believe a reasonable level of security and ease-of-use can be achieved through the following process: 1. Boot a live Linux distribution such as Tails on a computer disconnected from the Internet. 2. Create the OpenPGP master key. 3. Initialize the YubiKey with subkeys. 4. Store the master key offline using paperkey³ and a machine-readable code. The YubiKey is secure and convenient enough for daily use; the subkeys can be easily revoked and the hardware reinitialized with new keys. Master key operations such as key signing and changing expiration dates require loading the master key into the offline live operating system. Much more of a hassle but hopefully not as frequent as YubiKey use. Printing the master key on quality paper ensures³ it will survive for a long time. ¹ http://security.stackexchange.com/a/51776/9252 http://security.stackexchange.com/a/51776/9252 ² http://security.stackexchange.com/a/31598/9252 http://security.stackexchange.com/a/31598/9252 ³ http://www.jabberwocky.com/software/paperkey/ http://www.jabberwocky.com/software/paperkey/