16 ms·
FIDO2 is nice and all. I do want a good pgp/ssh compatible card with Curve225519 and can’t find one - yubikey has RSA and P384 iirc, but none have 25519. (I n
by beagle3 7y ago
FIDO2 is nice and all.
I do want a good pgp/ssh compatible card with Curve225519 and can’t find one - yubikey has RSA and P384 iirc, but none have 25519.
(I need to sign data often; rsa 2048, the minimum rsa length acceptable at this point, is both slow on hardware elements and very long)
- CameronNemo 7y agoSeriously, this is my exact use case. I am using a yubikey with rsa 2048 right now, and I want something a bit stronger. Inexplicably, the Somu stretch goals start with ECDSA then go to Ed25519. Not that either will be reached anytime soon, or that reaching a stretch goal on a crowd funded campaign magically makes the feature appear. https://www.crowdsupply.com/solokeys/somu https://www.crowdsupply.com/solokeys/somu
- ecesena 7y agoSupport for openpgp is almost there: https://github.com/solokeys/openpgp https://github.com/solokeys/openpgp Note that the ed25519 is not as easy as it seems, ssh agent doesn’t support it yet. I wrote a couple notes/details in the somu campaign you linked, towards the end.
- jeremyw 7y agoLooks like this changed for series 5 keys. In August 2019: "the YubiKey now also supports ... Curve25519, the default curve used in ssh (EdDSA and Diffie-Hellman)", "Addition of Ed25519 signature support, a modern ECC curve". See https://www.yubico.com/blog/whats-new-in-yubikey-firmware-5-2-3/ https://www.yubico.com/blog/whats-new-in-yubikey-firmware-5-...
- beagle3 7y agoAwesome! Thanks, I missed that update!
- traceroute66 7y agoHave the OpenSSH devs finally relented and allowed support for PKCS#11 with ECC then ? ;-) Last I saw there were patches put forward to the devs since 2015 and they consistently refused to look at them, let alone merge them.
- vetrom 7y agoWhen last I checked, at least on linux/ubuntu the blocking issue was in opensc-pkcs11, not ssh.