4 ms·

Why use gpg at all? SSH supports FIDO.

dfshsdfjsfj 5y ago
FIDO is still of extremely limited availability. I'm still running into hosts I need to access that can only use RSA/DSA keys, as opposed to the ed25519 key on my Yubikey, nevermind FIDO.
Sharparam 5y ago
I tried the FIDO2 way of authenticating to SSH when I finally had a Linux system with new enough versions of OpenSSH et.c in the repos. It works quite nicely, but the PIN has to be entered every time I auth to SSH. This may be a desirable feature to some, but I prefer the GPG way of the PIN being cached until the key is removed from the system. (This could possibly be a shortcoming of KWallet, as it would pop up the dialog asking for the PIN, but checking the "remember this password" would achieve absolutely nothing, and besides, I wouldn't want to save it permanently, which that checkbox would otherwise do.)
- RL_Quine 5y ago
  I don't have any PIN entry at all with FIDO.
  - Sharparam 5y ago
    But then someone with your key just has direct access?
    - RL_Quine 5y ago
      It's a second factor, not first. This is fine.
      - GekkePrutser 5y ago
        But this is not FIDO2 in CTAP (passwordless) mode, which is what the previous poster referred to. It's FIDO1 and it's not supported by default in SSH, only with some PAM plugins. OpenSSH supports FIDO2 passwordless mode natively in the latest versions.
- GekkePrutser 5y ago
  Ooh yeah I definitely don't want this either. I want GPG to ask for the pincode once, and the yubikey to require a physical touch for each authentication (including the first, obviously). This way it can't be automated by malware either (a pincode can be sniffed and replayed through the keyboard driver, the physical touch can't). The PIN is great against attackers that find your key on the street. Not against a determined attacker that is already on your computer. For that the physical touch thing is a great solution (though the yubikey doesn't require it by default, you can easily turn it on). Asking the pin upon first use and a touch every time is the perfect compromise between security and usability IMO. There's still some weakness around attackers with physical access but they are more easily mitigated.
GekkePrutser 5y ago
Good point but it's not well supported yet. There's no mobile clients I know of that support it (let alone with agent forwarding which I really need for jumpboxes). And of course once you do fido, you're back to the same issues around SSH keys that certificates are a solution to (as the article demonstrates). So moving to Fido is not a whole lot better than using SSH keys which work very well everywhere. Also, another important point: I also use GPG a lot to encrypt files. It's great to use the same key (sometimes, for sensitive stuff I use a different OpenPGP card) and toolchain (always) for this. So I need it anyway, might as well use it for SSH authentication as well.

FIDO is still of extremely limited availability. I'm still running into hosts I need to access that can only use RSA/DSA keys, as opposed to the ed25519 key on my Yubikey, nevermind FIDO.

Sharparam 5y ago

I tried the FIDO2 way of authenticating to SSH when I finally had a Linux system with new enough versions of OpenSSH et.c in the repos. It works quite nicely, but the PIN has to be entered every time I auth to SSH. This may be a desirable feature to some, but I prefer the GPG way of the PIN being cached until the key is removed from the system. (This could possibly be a shortcoming of KWallet, as it would pop up the dialog asking for the PIN, but checking the "remember this password" would achieve absolutely nothing, and besides, I wouldn't want to save it permanently, which that checkbox would otherwise do.)

RL_Quine 5y ago
I don't have any PIN entry at all with FIDO.
- Sharparam 5y ago
  But then someone with your key just has direct access?
  - RL_Quine 5y ago
    It's a second factor, not first. This is fine.
    - GekkePrutser 5y ago
      But this is not FIDO2 in CTAP (passwordless) mode, which is what the previous poster referred to. It's FIDO1 and it's not supported by default in SSH, only with some PAM plugins. OpenSSH supports FIDO2 passwordless mode natively in the latest versions.
GekkePrutser 5y ago
Ooh yeah I definitely don't want this either. I want GPG to ask for the pincode once, and the yubikey to require a physical touch for each authentication (including the first, obviously). This way it can't be automated by malware either (a pincode can be sniffed and replayed through the keyboard driver, the physical touch can't). The PIN is great against attackers that find your key on the street. Not against a determined attacker that is already on your computer. For that the physical touch thing is a great solution (though the yubikey doesn't require it by default, you can easily turn it on). Asking the pin upon first use and a touch every time is the perfect compromise between security and usability IMO. There's still some weakness around attackers with physical access but they are more easily mitigated.

GekkePrutser 5y ago

Good point but it's not well supported yet. There's no mobile clients I know of that support it (let alone with agent forwarding which I really need for jumpboxes). And of course once you do fido, you're back to the same issues around SSH keys that certificates are a solution to (as the article demonstrates). So moving to Fido is not a whole lot better than using SSH keys which work very well everywhere. Also, another important point: I also use GPG a lot to encrypt files. It's great to use the same key (sometimes, for sensitive stuff I use a different OpenPGP card) and toolchain (always) for this. So I need it anyway, might as well use it for SSH authentication as well.