4 ms·

If someone can confirm that non-RSA (ECC, any curve) keys work with this or any guide, I'd appreciate hearing it. As far as I can tell, ECC silently and inexpli

by sowbug 9y ago

If someone can confirm that non-RSA (ECC, any curve) keys work with this or any guide, I'd appreciate hearing it. As far as I can tell, ECC silently and inexplicably fails at the ssh step. RSA seems to work fine. This is Ubuntu 16.04, which comes with GnuPG 2.1.11.

subway 9y ago
No. You need a token running an OpenPGP Card 3.0+ applet for ECC. The Yubikey, while capable of doing ECC in other applets (like the PIV applet) only implements OpenPGP Card 2.1 (maybe 2.2?). Ledger did an OpenPGP Card 3.0 implementation that looks interesting, though the token is pricey: https://github.com/LedgerHQ/blue-app-openpgp-card https://github.com/LedgerHQ/blue-app-openpgp-card
- danieldk 9y ago
  An additional data point: Some gnuk tokens, such as the Nitrokey Start support Curve25519, also for SSH authentication (I use this). Of course, gnuk tokens have a different set of trade-offs: - In contrast to Yubikeys, the firmware is open source and can be verified. - It uses a curve that is considered safe [1]. Some security experts don't trust the NIST curves. - In contrast to the Yubikey, it does not use tamper-resistant storage, but just a regular microcontroller. AFAIK it does store the keys encrypted though. - There is no physical confirmation for key use, only PIN confirmation (with a maximum number of tries). However, gnuk keys are very affordable. E.g. I purchased my Nitrokeys for 29 Euro each. A completely different approach is to use your phone (and its secure element) as a crypto token. E.g. using Krypton [2]. Of course, this is only viable if you trust your phone manufacturer and operating system. [1] https://safecurves.cr.yp.to https://safecurves.cr.yp.to [2] https://krypt.co https://krypt.co
  - sowbug 9y ago
    Which version of GnuPG are you using? (BTW re "AFAIK it does store the keys encrypted though," I'd be cautious about relying on that encryption. The keyspace for PINs is tiny and trivially brute-forceable. And if you choose to use a strong passphrase for your Gnuk token that is capable of resisting brute force, you're giving up one of the main usability benefits of committing a secret to a hardware token. I know they're working on something called KDF-DO that might offload key stretching to the host, but it's still going to be the case that PINs will be brute-forceable.)
    - danieldk 9y ago
      Which version of GnuPG are you using? Version 2.2.5. The keyspace for PINs is tiny and trivially brute-forceable. Good point!
      - sowbug 9y ago
        Thanks. I'll wait for Ubuntu 18.04 to arrive and hope it contains a 2.2.x version, which might behave better.
      - sowbug 9y ago
        Confirmed that 2.2.5 on Ubuntu 16.04 works with NIST P-256 for SSH authentication. For future reference, installing GnuPG 2.2.5 turned out to be easier than I expected. I visited http://http.us.debian.org/debian/pool/main/g/gnupg2/ http://http.us.debian.org/debian/pool/main/g/gnupg2/, downloaded the .deb I wanted, tried installing with dpkg -i, and then downloaded further dependencies until it worked. Last time I tried, I built GnuPG from source, which ended up with something that mostly worked, but it failed my personal sysadmin test of being able to remember how I did it in case I needed to build a new machine with the same characteristics.
- sowbug 9y ago
  Your answer makes sense, but I believe I do have a 3.0-compliant token. It's Gnuk tip of tree running on some STM32-based piece of dryer lint. According to Gnuk's README, it does support OpenPGP Card 3.0 (though the documentation is inconsistent about that). So I'm beginning to suspect it's the version of GnuPG that I have, but I don't think it's that out of date. https://anonscm.debian.org/cgit/gnuk/gnuk/gnuk.git/tree/README#n37 https://anonscm.debian.org/cgit/gnuk/gnuk/gnuk.git/tree/READ...
CaliforniaKarl 9y ago
u/subway answered the GPG portion in https://news.ycombinator.com/item?id=16480945 https://news.ycombinator.com/item?id=16480945 As for the PIV portion: Unfortunately, PIV will not work either. Right now, OpenSSH’s ssh-agent doesn’t have the ability to handle EDSA keys when using PKCS#11 (which is how the agent communicates with the “card”. The enhancement request is at https://bugzilla.mindrot.org/show_bug.cgi?id=2474 https://bugzilla.mindrot.org/show_bug.cgi?id=2474 Unfortunately, although people have been maintaining patches, there’s been no official action (that I know of) on this.
- subway 9y ago
  You might note that in the above directions, PKCS#11 is avoided anyway. They instead rely in using gpg-agent as an ssh agent.
  - CaliforniaKarl 9y ago
    True! For the article linked, PIV isn't used, and so my linked bug doesn't apply. But, with regard's to the parent comments's "this or any guide" qualifier, then this can become an important point, and so I think it's worth noting.

by sowbug 9y ago

subway 9y ago

No. You need a token running an OpenPGP Card 3.0+ applet for ECC. The Yubikey, while capable of doing ECC in other applets (like the PIV applet) only implements OpenPGP Card 2.1 (maybe 2.2?). Ledger did an OpenPGP Card 3.0 implementation that looks interesting, though the token is pricey: https://github.com/LedgerHQ/blue-app-openpgp-card https://github.com/LedgerHQ/blue-app-openpgp-card

danieldk 9y ago
An additional data point: Some gnuk tokens, such as the Nitrokey Start support Curve25519, also for SSH authentication (I use this). Of course, gnuk tokens have a different set of trade-offs: - In contrast to Yubikeys, the firmware is open source and can be verified. - It uses a curve that is considered safe [1]. Some security experts don't trust the NIST curves. - In contrast to the Yubikey, it does not use tamper-resistant storage, but just a regular microcontroller. AFAIK it does store the keys encrypted though. - There is no physical confirmation for key use, only PIN confirmation (with a maximum number of tries). However, gnuk keys are very affordable. E.g. I purchased my Nitrokeys for 29 Euro each. A completely different approach is to use your phone (and its secure element) as a crypto token. E.g. using Krypton [2]. Of course, this is only viable if you trust your phone manufacturer and operating system. [1] https://safecurves.cr.yp.to https://safecurves.cr.yp.to [2] https://krypt.co https://krypt.co
- sowbug 9y ago
  Which version of GnuPG are you using? (BTW re "AFAIK it does store the keys encrypted though," I'd be cautious about relying on that encryption. The keyspace for PINs is tiny and trivially brute-forceable. And if you choose to use a strong passphrase for your Gnuk token that is capable of resisting brute force, you're giving up one of the main usability benefits of committing a secret to a hardware token. I know they're working on something called KDF-DO that might offload key stretching to the host, but it's still going to be the case that PINs will be brute-forceable.)
  - danieldk 9y ago
    Which version of GnuPG are you using? Version 2.2.5. The keyspace for PINs is tiny and trivially brute-forceable. Good point!
    - sowbug 9y ago
      Thanks. I'll wait for Ubuntu 18.04 to arrive and hope it contains a 2.2.x version, which might behave better.
    - sowbug 9y ago
      Confirmed that 2.2.5 on Ubuntu 16.04 works with NIST P-256 for SSH authentication. For future reference, installing GnuPG 2.2.5 turned out to be easier than I expected. I visited http://http.us.debian.org/debian/pool/main/g/gnupg2/ http://http.us.debian.org/debian/pool/main/g/gnupg2/, downloaded the .deb I wanted, tried installing with dpkg -i, and then downloaded further dependencies until it worked. Last time I tried, I built GnuPG from source, which ended up with something that mostly worked, but it failed my personal sysadmin test of being able to remember how I did it in case I needed to build a new machine with the same characteristics.
sowbug 9y ago
Your answer makes sense, but I believe I do have a 3.0-compliant token. It's Gnuk tip of tree running on some STM32-based piece of dryer lint. According to Gnuk's README, it does support OpenPGP Card 3.0 (though the documentation is inconsistent about that). So I'm beginning to suspect it's the version of GnuPG that I have, but I don't think it's that out of date. https://anonscm.debian.org/cgit/gnuk/gnuk/gnuk.git/tree/README#n37 https://anonscm.debian.org/cgit/gnuk/gnuk/gnuk.git/tree/READ...

CaliforniaKarl 9y ago

u/subway answered the GPG portion in https://news.ycombinator.com/item?id=16480945 https://news.ycombinator.com/item?id=16480945 As for the PIV portion: Unfortunately, PIV will not work either. Right now, OpenSSH’s ssh-agent doesn’t have the ability to handle EDSA keys when using PKCS#11 (which is how the agent communicates with the “card”. The enhancement request is at https://bugzilla.mindrot.org/show_bug.cgi?id=2474 https://bugzilla.mindrot.org/show_bug.cgi?id=2474 Unfortunately, although people have been maintaining patches, there’s been no official action (that I know of) on this.

subway 9y ago
You might note that in the above directions, PKCS#11 is avoided anyway. They instead rely in using gpg-agent as an ssh agent.
- CaliforniaKarl 9y ago
  True! For the article linked, PIV isn't used, and so my linked bug doesn't apply. But, with regard's to the parent comments's "this or any guide" qualifier, then this can become an important point, and so I think it's worth noting.