3 ms·
For SSH, you can use cheaper FIDO2 hardware to split your key between a computer and say a Google USB titan key or similar. For Windows, you need to compile (c
by csdvrx 5y ago
For SSH, you can use cheaper FIDO2 hardware to split your key between a computer and say a Google USB titan key or similar.
For Windows, you need to compile (cf https://gist.github.com/martelletto/6a7cf806c6433ac9ce71d66afb94d70e https://gist.github.com/martelletto/6a7cf806c6433ac9ce71d66a... ) then ssh-keygen -t ecdsa-sk
For Linux, if you need to recompile: https://cloud.google.com/compute/docs/tutorials/ssh-with-sk https://cloud.google.com/compute/docs/tutorials/ssh-with-sk
- microtonal 5y agoOn modern Macs, you can also use the Secure Enclave for SSH private keys: https://github.com/maxgoedjen/secretive https://github.com/maxgoedjen/secretive
- vbezhenar 5y agoYou can use TPM on Intel PC for SSH as well. Seems a little bit hacky, but it should work.
- _wldu 5y agoYou should avoid ecdsa and use ed25519 instead. https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html https://www.schneier.com/blog/archives/2007/11/the_strange_s...
- willis936 5y agoOpenSSL's ECDSA implementation does not use Dual_EC_DRBG. You can read about what is actually done to make ECDSA keys here. https://wiki.openssl.org/index.php/Creating_an_OpenSSL_Engine_to_use_indigenous_ECDH_ECDSA_and_HASH_Algorithms https://wiki.openssl.org/index.php/Creating_an_OpenSSL_Engin...
- tptacek 5y agoNone of this has anything to do with ECDSA. Dual_EC_DRBG is a random number generator, not a signature algorithm.
- guerby 5y agoOn debian : debian 10 backports repository has openssh 8.4 with FIDO2 support builtin so no recompile needed there. debian 11 has 8.4 in its regular repository.