4 ms·
Something else that is quite nice is that you can switch to certificate auth and use your yubikey to protect an ed25519-sk certificate authority.
by enasterosophes 4y ago
Something else that is quite nice is that you can switch to certificate auth and use your yubikey to protect an ed25519-sk certificate authority.
- endre 4y agothis.
- stingraycharles 4y agoHow does that work, do you know a good tutorial for this?
- dnet 4y agoI made my own CA for this because nothing else could provide transparency regarding certificate issuance (whether an attacker issued a "spare" backdoor certificate) - source code: https://github.com/silentsignal/zsca https://github.com/silentsignal/zsca - my talk about the design and results: https://pretalx.hsbp.org/camppp7e5/talk/D3E9HN/ https://pretalx.hsbp.org/camppp7e5/talk/D3E9HN/
- enasterosophes 4y agoLook for a tutorial on ssh certificate auth, and use ed25519-sk keys for the CA.
- Diti 4y agoBut PIV only supports keys up to 2048 bits. :<
- enasterosophes 4y agoI didn't say anything about PIV. The article I was replying to is talking about sk keys, and so am I.