4 ms·

Is it considered good practice to create the key on the yubi and not have a backup? Or alternatively a master key to sign the key on the yubi so you can create

Is it considered good practice to create the key on the yubi and not have a backup? Or alternatively a master key to sign the key on the yubi so you can create a new subkey if you lose the yubi?

m3nu 6y ago
You have 2 physical Yubikeys and no backup anywhere else. One way to achieve it is by generating it on a RAM disk and throwing it away, once it's on both Yubikeys. I blogged about it here https://blog.snapdragon.cc/2019/04/27/using-a-yubikey-to-secure-ssh-on-macos/ https://blog.snapdragon.cc/2019/04/27/using-a-yubikey-to-sec... (for macOS)
- sebazzz 6y ago
  Windows users might find this useful: https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide
brippalcharrid 6y ago
Ideally each key will be generated on the device and be unexportable. That's a major part of the value of a Yubikey/smartcard/HSM, because it provides Non-Repudiation, and it enables you to be reasonably certain that it is impossible for the key to exist outside of the physical device. You can use multiple devices to generate multiple keys to give you persistent access in case a device fails or is lost. Software generally accommodates multiple (public) keys per client for this reason. With an SSH CA, the server ultimately trusts the CA key, and client keys are used for authentication via the client certificates. I think you can use Yubikeys and relatively inexpensive HSMs (eg. Nitrokeys) for this. https://framkant.org/2016/10/use-a-smart-card-or-hsm-to-securely-store-your-ssh-ca-keys/ https://framkant.org/2016/10/use-a-smart-card-or-hsm-to-secu...