3 ms·

No. You need a token running an OpenPGP Card 3.0+ applet for ECC. The Yubikey, while capable of doing ECC in other applets (like the PIV applet) only implements

by subway 9y ago

No. You need a token running an OpenPGP Card 3.0+ applet for ECC. The Yubikey, while capable of doing ECC in other applets (like the PIV applet) only implements OpenPGP Card 2.1 (maybe 2.2?). Ledger did an OpenPGP Card 3.0 implementation that looks interesting, though the token is pricey: https://github.com/LedgerHQ/blue-app-openpgp-card https://github.com/LedgerHQ/blue-app-openpgp-card

danieldk 9y ago
An additional data point: Some gnuk tokens, such as the Nitrokey Start support Curve25519, also for SSH authentication (I use this). Of course, gnuk tokens have a different set of trade-offs: - In contrast to Yubikeys, the firmware is open source and can be verified. - It uses a curve that is considered safe [1]. Some security experts don't trust the NIST curves. - In contrast to the Yubikey, it does not use tamper-resistant storage, but just a regular microcontroller. AFAIK it does store the keys encrypted though. - There is no physical confirmation for key use, only PIN confirmation (with a maximum number of tries). However, gnuk keys are very affordable. E.g. I purchased my Nitrokeys for 29 Euro each. A completely different approach is to use your phone (and its secure element) as a crypto token. E.g. using Krypton [2]. Of course, this is only viable if you trust your phone manufacturer and operating system. [1] https://safecurves.cr.yp.to https://safecurves.cr.yp.to [2] https://krypt.co https://krypt.co
- sowbug 9y ago
  Which version of GnuPG are you using? (BTW re "AFAIK it does store the keys encrypted though," I'd be cautious about relying on that encryption. The keyspace for PINs is tiny and trivially brute-forceable. And if you choose to use a strong passphrase for your Gnuk token that is capable of resisting brute force, you're giving up one of the main usability benefits of committing a secret to a hardware token. I know they're working on something called KDF-DO that might offload key stretching to the host, but it's still going to be the case that PINs will be brute-forceable.)
  - danieldk 9y ago
    Which version of GnuPG are you using? Version 2.2.5. The keyspace for PINs is tiny and trivially brute-forceable. Good point!
    - sowbug 9y ago
      Thanks. I'll wait for Ubuntu 18.04 to arrive and hope it contains a 2.2.x version, which might behave better.
    - sowbug 9y ago
      Confirmed that 2.2.5 on Ubuntu 16.04 works with NIST P-256 for SSH authentication. For future reference, installing GnuPG 2.2.5 turned out to be easier than I expected. I visited http://http.us.debian.org/debian/pool/main/g/gnupg2/ http://http.us.debian.org/debian/pool/main/g/gnupg2/, downloaded the .deb I wanted, tried installing with dpkg -i, and then downloaded further dependencies until it worked. Last time I tried, I built GnuPG from source, which ended up with something that mostly worked, but it failed my personal sysadmin test of being able to remember how I did it in case I needed to build a new machine with the same characteristics.
sowbug 9y ago
Your answer makes sense, but I believe I do have a 3.0-compliant token. It's Gnuk tip of tree running on some STM32-based piece of dryer lint. According to Gnuk's README, it does support OpenPGP Card 3.0 (though the documentation is inconsistent about that). So I'm beginning to suspect it's the version of GnuPG that I have, but I don't think it's that out of date. https://anonscm.debian.org/cgit/gnuk/gnuk/gnuk.git/tree/README#n37 https://anonscm.debian.org/cgit/gnuk/gnuk/gnuk.git/tree/READ...

by subway 9y ago

danieldk 9y ago

An additional data point: Some gnuk tokens, such as the Nitrokey Start support Curve25519, also for SSH authentication (I use this). Of course, gnuk tokens have a different set of trade-offs: - In contrast to Yubikeys, the firmware is open source and can be verified. - It uses a curve that is considered safe [1]. Some security experts don't trust the NIST curves. - In contrast to the Yubikey, it does not use tamper-resistant storage, but just a regular microcontroller. AFAIK it does store the keys encrypted though. - There is no physical confirmation for key use, only PIN confirmation (with a maximum number of tries). However, gnuk keys are very affordable. E.g. I purchased my Nitrokeys for 29 Euro each. A completely different approach is to use your phone (and its secure element) as a crypto token. E.g. using Krypton [2]. Of course, this is only viable if you trust your phone manufacturer and operating system. [1] https://safecurves.cr.yp.to https://safecurves.cr.yp.to [2] https://krypt.co https://krypt.co

sowbug 9y ago
Which version of GnuPG are you using? (BTW re "AFAIK it does store the keys encrypted though," I'd be cautious about relying on that encryption. The keyspace for PINs is tiny and trivially brute-forceable. And if you choose to use a strong passphrase for your Gnuk token that is capable of resisting brute force, you're giving up one of the main usability benefits of committing a secret to a hardware token. I know they're working on something called KDF-DO that might offload key stretching to the host, but it's still going to be the case that PINs will be brute-forceable.)
- danieldk 9y ago
  Which version of GnuPG are you using? Version 2.2.5. The keyspace for PINs is tiny and trivially brute-forceable. Good point!
  - sowbug 9y ago
    Thanks. I'll wait for Ubuntu 18.04 to arrive and hope it contains a 2.2.x version, which might behave better.
  - sowbug 9y ago
    Confirmed that 2.2.5 on Ubuntu 16.04 works with NIST P-256 for SSH authentication. For future reference, installing GnuPG 2.2.5 turned out to be easier than I expected. I visited http://http.us.debian.org/debian/pool/main/g/gnupg2/ http://http.us.debian.org/debian/pool/main/g/gnupg2/, downloaded the .deb I wanted, tried installing with dpkg -i, and then downloaded further dependencies until it worked. Last time I tried, I built GnuPG from source, which ended up with something that mostly worked, but it failed my personal sysadmin test of being able to remember how I did it in case I needed to build a new machine with the same characteristics.

sowbug 9y ago

Your answer makes sense, but I believe I do have a 3.0-compliant token. It's Gnuk tip of tree running on some STM32-based piece of dryer lint. According to Gnuk's README, it does support OpenPGP Card 3.0 (though the documentation is inconsistent about that). So I'm beginning to suspect it's the version of GnuPG that I have, but I don't think it's that out of date. https://anonscm.debian.org/cgit/gnuk/gnuk/gnuk.git/tree/README#n37 https://anonscm.debian.org/cgit/gnuk/gnuk/gnuk.git/tree/READ...