4 ms·
Neat! Out of curiosity, the YK4 supports PKCS#11 in PIV mode, why use GPG instead of that? I use it for SSH all the time. For SSL, I believe that OpenSSL has
by bonyt 8y ago
Neat! Out of curiosity, the YK4 supports PKCS#11 in PIV mode, why use GPG instead of that? I use it for SSH all the time.
For SSL, I believe that OpenSSL has a pkcs11 engine.
https://developers.yubico.com/YubiHSM2/Usage_Guides/OpenSSL_with_pkcs11_engine.html https://developers.yubico.com/YubiHSM2/Usage_Guides/OpenSSL_... (for the YubiHSM2, but the YK4 also supports PKCS#11 with OpenSC)
P.S. The color caps on those yubikeys in the photo are cool, are they 3D printed?
- xienze 8y agoI've found it a little easier to get going with GPG, especially on different operating systems. IIRC with PKCS you have to tell the SSH client to use a particular plugin? Whereas with GPG you just need GnuPG and have it act as the SSH agent. Plus you can forward the GnuPG socket and then anything you do on the remote server that requires GPG will pass through to the Yubikey -- I find this useful with pass and for signing Maven artifacts, just tap the Yubikey when encrypting/decrypting.
- benjojo12 8y agoGPG agent is just a convenience thing. It's already there and usable for most people with yubikey setups, Yup the caps are 3d printed! https://twitter.com/Benjojo12/status/929445558275756032 https://twitter.com/Benjojo12/status/929445558275756032 / https://www.thingiverse.com/thing:2641499 https://www.thingiverse.com/thing:2641499
- lvh 8y agoI’ve done both and found the GPG route marginally more reliable but YMMV. You might run in to fewer issues if you’re not on macOS; one example of a problematic interaction is that the official OpenSC installer package installs a tokend plugin that grabs the card as soon as you plug it in; but gpg wants to open it in exclusive mode even though it really only needs the OpenPGP applet, not the PIV applet. (I’m happy to accept that it’s GPG behaving badly here; the bottom line is just that if you want to use your card for and GPG and SSH and apparently TLS, gpg might be easier to get working than trying to use gpg + anything else. FWIW I hear gpgtools (the Mac distribution) merged a patch that fixed that behavior.)
- Walkman 8y agoI did not knew about that, thank you! I instantly changed my SSH key for the generated key in my YubiKey Neo and use it everywhere. Here is a tutorial is anyone is interested: https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PKCS11.html https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PK...
- bonyt 8y agoYeah, it's cool! A couple extra tips: - You can put "PKCS11Provider /usr/lib...." in your .ssh/config file (even tied to a specific Host block) to make it load the module automatically instead of having to use an argument every time you run ssh/sftp/scp/etc. - For windows, putty-cac works well with the built-in smartcard/crypto API (CAPI), even on machines where you don't have administrative access (like my work machine). It even has its own version of pageant, so it'll work with tools like WinSCP as well. https://risacher.org/putty-cac/ https://risacher.org/putty-cac/ https://github.com/NoMoreFood/putty-cac/releases https://github.com/NoMoreFood/putty-cac/releases
- Boulth 8y agoYep, putty cac works very nice. The only downside I found compared to gpg agent is that cac does not forget PIN when the card is removed (gpg agent does that and I like it).
- Walkman 8y agoI tried on both OS X and Linux, works fine, though on Linux it asks for the PIN every time, which is very annoying. Do you know a solution for that?