3 ms·

You can use your yubikey to store your subkeys (still generated on the yubikey itself) while your master key is stored somewhere else. If you lose your yubikey

by helper 9y ago

You can use your yubikey to store your subkeys (still generated on the yubikey itself) while your master key is stored somewhere else. If you lose your yubikey you can revoke the subkeys and generate new ones signed by your existing master key.

jopsen 9y ago
With few exceptions: A) you won't be able to decrypt old messages B) you'll have to upload new public SSH keys to all servers If you use 'pass' for storing passwords, then (A) will make your password store unavailable. And (B) is a lot of places you have to update. In fact I aim to make it impossible to connect and update my servers key without having the existing key. -- In short, since sub-key infrastructure really works for signatures, it seems easiest to just backup your subkeys.
- beagle3 9y ago
  > B) you'll have to upload new public SSH keys to all servers openssh supports a CA model, so .. you can set it up so that the servers trust the CA and the CA blesses the new key. Obviously, it just shifts the "but what if we lose the .." question from the user key to the CA key, but in many cases it makes a difference.
  - Xylakant 9y ago
    You could also have some sort of mechanism that updates the various servers (puppet, ...) or central authentication via LDAP. SSH logins are the least of my worries. Not being able to access my passwords would suck, though :)
- rkeene2 9y ago
  My password manager, hunter2 (https://chiselapp.com/user/rkeene/repository/hunter2/ https://chiselapp.com/user/rkeene/repository/hunter2/ ), overcomes this by spring multiple keys per password. If you change the password then all keys that currently know the password will also be updates.
  - Xylakant 9y ago
    pass() can make passwords readable by multiple keys as well, but then I'd have to add the keys before loosing one. Possible, but, well, a usb stick in a safe location does the job for me currently.

by helper 9y ago

jopsen 9y ago

With few exceptions: A) you won't be able to decrypt old messages B) you'll have to upload new public SSH keys to all servers If you use 'pass' for storing passwords, then (A) will make your password store unavailable. And (B) is a lot of places you have to update. In fact I aim to make it impossible to connect and update my servers key without having the existing key. -- In short, since sub-key infrastructure really works for signatures, it seems easiest to just backup your subkeys.

beagle3 9y ago
> B) you'll have to upload new public SSH keys to all servers openssh supports a CA model, so .. you can set it up so that the servers trust the CA and the CA blesses the new key. Obviously, it just shifts the "but what if we lose the .." question from the user key to the CA key, but in many cases it makes a difference.
- Xylakant 9y ago
  You could also have some sort of mechanism that updates the various servers (puppet, ...) or central authentication via LDAP. SSH logins are the least of my worries. Not being able to access my passwords would suck, though :)
rkeene2 9y ago
My password manager, hunter2 (https://chiselapp.com/user/rkeene/repository/hunter2/ https://chiselapp.com/user/rkeene/repository/hunter2/ ), overcomes this by spring multiple keys per password. If you change the password then all keys that currently know the password will also be updates.
- Xylakant 9y ago
  pass() can make passwords readable by multiple keys as well, but then I'd have to add the keys before loosing one. Possible, but, well, a usb stick in a safe location does the job for me currently.