4 ms·

> Use Ed25519 keys. > ... > You can use Yubikey and pretty much every other solution out there with with OpenSSH now. Unfortunately, you can't use Ed25519 ke

> Use Ed25519 keys. > ... > You can use Yubikey and pretty much every other solution out there with with OpenSSH now. Unfortunately, you can't use Ed25519 keys unless you have the latest/newest model(s) of Yubikey and that Yubikey came with at least a specific firmware version (5.2.3, IIRC). Even if that weren't so, there's still loads of popular / widely-used software that isn't even close to supporting Ed25519 (yet) but has supported RSA for years and years (and will continue to for the foreseeable future). I'd like to be able to "upgrade" to an Ed25519 key but I can't come up with any real reason to expand my collection of Yubikeys any further (I think I'm up to nine, at last count, and the three newest ones haven't even been opened!). I don't plan on purchasing another Yubikey until four or five of the ones I already have decide to call it quits, so I won't be using an Ed25519 key anytime in the next couple of years, at least. Even if I could start using an Ed25519 key with my Yubikeys today, I'd likely still have to keep an RSA key around for the "legacy" stuff, in which case I might as well just save myself the trouble and stick with RSA for a while longer. A private RSA (2048+) key on a Yubikey is still much "better", IMO, than a private Ed25519 key sitting on one's hard drive. In an ideal world we could all just switch everything over to Ed25519 at about the same time and then retire RSA shortly afterwards. It's gonna be a long time before everyone has ditched RSA keys and moved to Ed25519, though -- RSA isn't going anywhere anytime soon!

kitotik 7y ago
Assuming OpenSSH >=8.2 wouldn’t FIDO/U2F be the best convenience/security balance? It seems to work great with all the yubikeys I’ve tested with.
- jlgaddis 7y ago
  If you're using OpenSSH >= 8.2, Ed25519 support isn't really much of a concern. The vast majority of ("enterprise") Linux systems -- and, likewise, much of the "legacy" software in use today -- likely won't be running >= 8.2 for at least a few more years.
cookiengineer 7y ago
> I think I'm up to nine, at last count, and the three newest ones haven't even been opened! I am a bit confused. Aren't yubikeys able to store multiple keys on them? Why do you have to use so many? Why not instead e.g. a LUKS encrypted usb flashdrive?
- simcop2387 7y ago
  My recommendation anymore is keepassxc for movable ssh keys. It can put them into the agent and remove them automatically when screen locks or other events happen. Combined with a yubikey for 2fa on the database the security is pretty decent. A flash drive with a portable copy of keepassxc should work nicely.
- jlgaddis 7y ago
  > Why do you have to use so many? Well, I started out with a Symantec VIP Yubikey many, many years ago. Then, MtGox sent me one for 2FA after some compromise there. Later, I bought a "full-featured" Yubikey for use with GPG and SSH on my desktop / workstation. After that, I got two Nanos so that I could leave one, permanently, in each of a pair of laptops. Shortly after that, I decided I should have a spare -- you know, just in case. At some point, I received another pair of Nanos as free replacements due to one of the issues that Yubico had (weak RNG or something, I think?). Those two and the "spare" are the ones that are still unopened in the package. Finally, (I'm not really sure why but) I bought a pair of the "GitHub" U2F-only Yubikeys when there was some special deal going on. Now that I think about it, I don't think I've ever even used them either. The only ones that I really use are the ones that I leave in my workstation and my primary laptop (primarily used for SSH but, to a lesser extent, for signing git commits and unlocking KeePassXC databases as well). > Why not instead e.g. a LUKS encrypted usb flashdrive? Oh, I've got probably a dozen or so of those also!
charwalker 7y ago
I love my YubiKey but it is severely underused but that's me not them. I've had 3 over the past 4 years with 1 older basic model in my desk as a backup then 1 NFC enabled key on my keyring or person. The original NFC key died and has been replaced with a more recent model but I couldn't tell you what components it supports. I should look into setting it up with more things at home.

kitotik 7y ago

Assuming OpenSSH >=8.2 wouldn’t FIDO/U2F be the best convenience/security balance? It seems to work great with all the yubikeys I’ve tested with.

jlgaddis 7y ago
If you're using OpenSSH >= 8.2, Ed25519 support isn't really much of a concern. The vast majority of ("enterprise") Linux systems -- and, likewise, much of the "legacy" software in use today -- likely won't be running >= 8.2 for at least a few more years.

cookiengineer 7y ago

> I think I'm up to nine, at last count, and the three newest ones haven't even been opened! I am a bit confused. Aren't yubikeys able to store multiple keys on them? Why do you have to use so many? Why not instead e.g. a LUKS encrypted usb flashdrive?

simcop2387 7y ago
My recommendation anymore is keepassxc for movable ssh keys. It can put them into the agent and remove them automatically when screen locks or other events happen. Combined with a yubikey for 2fa on the database the security is pretty decent. A flash drive with a portable copy of keepassxc should work nicely.
jlgaddis 7y ago
> Why do you have to use so many? Well, I started out with a Symantec VIP Yubikey many, many years ago. Then, MtGox sent me one for 2FA after some compromise there. Later, I bought a "full-featured" Yubikey for use with GPG and SSH on my desktop / workstation. After that, I got two Nanos so that I could leave one, permanently, in each of a pair of laptops. Shortly after that, I decided I should have a spare -- you know, just in case. At some point, I received another pair of Nanos as free replacements due to one of the issues that Yubico had (weak RNG or something, I think?). Those two and the "spare" are the ones that are still unopened in the package. Finally, (I'm not really sure why but) I bought a pair of the "GitHub" U2F-only Yubikeys when there was some special deal going on. Now that I think about it, I don't think I've ever even used them either. The only ones that I really use are the ones that I leave in my workstation and my primary laptop (primarily used for SSH but, to a lesser extent, for signing git commits and unlocking KeePassXC databases as well). > Why not instead e.g. a LUKS encrypted usb flashdrive? Oh, I've got probably a dozen or so of those also!

charwalker 7y ago

I love my YubiKey but it is severely underused but that's me not them. I've had 3 over the past 4 years with 1 older basic model in my desk as a backup then 1 NFC enabled key on my keyring or person. The original NFC key died and has been replaced with a more recent model but I couldn't tell you what components it supports. I should look into setting it up with more things at home.