4 ms·

Neither the pgpcard (which I got from g10code while they were still selling them) nor my 100 or so Yubikeys purchased over the last 5 years support ed25519.

p_l 6y ago
As far as I understand, none of the hw token vendors support ed25519, because none of the secure element vendors do. Your best bet is AFAIK ECDSA with NIST parameters.
- cjcampbell 6y ago
  Yubikey is supporting ed25519 as of firmware 5.2.3 (https://www.yubico.com/blog/whats-new-in-yubikey-firmware-5-2-3/ https://www.yubico.com/blog/whats-new-in-yubikey-firmware-5-...)
  - captn3m0 6y ago
    I’ll try to upgrade, thanks
    - dmm 6y ago
      You can't upgrade the Yubikeys. You have to buy a new one. https://support.yubico.com/support/solutions/articles/15000006434-upgrading-yubikey-firmware https://support.yubico.com/support/solutions/articles/150000...
      - sterlind 6y ago
        Ugh that's really frustrating. If it's for security, why can't they just blank the key like they do when the master key is used?
        cjcampbell 6y ago
        Ahh, I should have made that more clear in my comment. Definitely frustrating, as those dang keys aren’t cheap!
      - Avamander 6y ago
        "When we do release new firmware, we ensure the new YubiKey will function the same as older versions, so there is no need to purchase new YubiKeys to ensure compatibility." Seems false, doesn't it?
  - p_l 6y ago
    Now THAT is a good news piece :) I just happened to be considering new yubikeys, maybe I will finally migrate everything. Though I could support ed25519 with my previous idea on handling it (where yubikeys serve as decryption device for elsewhere stored crypto machine.
cortesoft 6y ago
Yeah, we use ed25519 almost everywhere, except we have some networking gear that doesn't support it.
saghm 6y ago
This might be a dumb question, but 100 yubikeys? Do you use this many yourself, or do you give them to other people?
- D2187645 6y ago
  1 yubikey per service provider?

p_l 6y ago

As far as I understand, none of the hw token vendors support ed25519, because none of the secure element vendors do. Your best bet is AFAIK ECDSA with NIST parameters.

cjcampbell 6y ago
Yubikey is supporting ed25519 as of firmware 5.2.3 (https://www.yubico.com/blog/whats-new-in-yubikey-firmware-5-2-3/ https://www.yubico.com/blog/whats-new-in-yubikey-firmware-5-...)
- captn3m0 6y ago
  I’ll try to upgrade, thanks
  - dmm 6y ago
    You can't upgrade the Yubikeys. You have to buy a new one. https://support.yubico.com/support/solutions/articles/15000006434-upgrading-yubikey-firmware https://support.yubico.com/support/solutions/articles/150000...
    - sterlind 6y ago
      Ugh that's really frustrating. If it's for security, why can't they just blank the key like they do when the master key is used?
      - cjcampbell 6y ago
        Ahh, I should have made that more clear in my comment. Definitely frustrating, as those dang keys aren’t cheap!
    - Avamander 6y ago
      "When we do release new firmware, we ensure the new YubiKey will function the same as older versions, so there is no need to purchase new YubiKeys to ensure compatibility." Seems false, doesn't it?
- p_l 6y ago
  Now THAT is a good news piece :) I just happened to be considering new yubikeys, maybe I will finally migrate everything. Though I could support ed25519 with my previous idea on handling it (where yubikeys serve as decryption device for elsewhere stored crypto machine.

cortesoft 6y ago

Yeah, we use ed25519 almost everywhere, except we have some networking gear that doesn't support it.

saghm 6y ago

This might be a dumb question, but 100 yubikeys? Do you use this many yourself, or do you give them to other people?

D2187645 6y ago
1 yubikey per service provider?