5 ms·

No, if you don't use resident keys you need the files (as the keys need to come from somewhere). The keys aren't copied to the device, they're generated on the

No, if you don't use resident keys you need the files (as the keys need to come from somewhere). The keys aren't copied to the device, they're generated on the device, more or less.

OJFord 5y ago
> No, if you don't use resident keys you need the files (as the keys need to come from somewhere). Right, but I already have it on the device, I'm talking about using an already provisioned device with this new-ish OpenSSH feature; or whether it does something 'special' that means the key needs to be ('resident' or not) generated by this feature? Thinking about it though it's probably not for me, since SSH is not the only and probably the minority of my use, since I also use the encryption key (e.g. with `pass`) and signing (e.g. git commits, for no particular reason). > The keys aren't copied to the device, they're generated on the device, more or less. In your blog post you say it produces two files, the private and public keys. If it generated on device it wouldn't (be able to) have the private key?
- StavrosK 5y ago
  > I'm talking about using an already provisioned device with this new-ish OpenSSH feature Talking about these things is a bit confusing because the keys do so much, but the simple answer is that you'll need to generate a new key, yes. You need to get the key from the device, at no point will you have the private key outside the device, which means you won't be able to use one you generated previously. > In your blog post you say it produces two files, the private and public keys. If it generated on device it wouldn't (be able to) have the private key? I may be misunderstanding your question, but the "private" key it generates is more of a reference to the one existing on the device, not a standalone private key that you get when you generate one with ssh-keygen. The way it actually works is that these devices come with some randomness baked in and they use that to derive all the private keys you need with various cryptographic techniques. You can never extract any of those private keys (which is where the security lies) .

No, if you don't use resident keys you need the files (as the keys need to come from somewhere). The keys aren't copied to the device, they're generated on the device, more or less.

OJFord 5y ago

> No, if you don't use resident keys you need the files (as the keys need to come from somewhere). Right, but I already have it on the device, I'm talking about using an already provisioned device with this new-ish OpenSSH feature; or whether it does something 'special' that means the key needs to be ('resident' or not) generated by this feature? Thinking about it though it's probably not for me, since SSH is not the only and probably the minority of my use, since I also use the encryption key (e.g. with `pass`) and signing (e.g. git commits, for no particular reason). > The keys aren't copied to the device, they're generated on the device, more or less. In your blog post you say it produces two files, the private and public keys. If it generated on device it wouldn't (be able to) have the private key?

StavrosK 5y ago
> I'm talking about using an already provisioned device with this new-ish OpenSSH feature Talking about these things is a bit confusing because the keys do so much, but the simple answer is that you'll need to generate a new key, yes. You need to get the key from the device, at no point will you have the private key outside the device, which means you won't be able to use one you generated previously. > In your blog post you say it produces two files, the private and public keys. If it generated on device it wouldn't (be able to) have the private key? I may be misunderstanding your question, but the "private" key it generates is more of a reference to the one existing on the device, not a standalone private key that you get when you generate one with ssh-keygen. The way it actually works is that these devices come with some randomness baked in and they use that to derive all the private keys you need with various cryptographic techniques. You can never extract any of those private keys (which is where the security lies) .