4 ms·

Secretive is great. I use it on my T2 and M-series Macs and feel much better with keys sitting in those machines' secure enclaves than I did back when it was ju

Secretive is great. I use it on my T2 and M-series Macs and feel much better with keys sitting in those machines' secure enclaves than I did back when it was just sitting in ~/.ssh/ for anything to grab. I just wish there were something as clean as Secretive for using generic PC TPMs or YubiKeys in place of a Secure Enclave under Windows and Linux. Currently have a Linux laptop halfway through setting that up and it's messy in comparison.

judge2020 4y ago
For Windows, it seems it's possible[0, see footnote], however there are problems like general incompatibilities [1], and official support status is " We have this in our backlog. At this point it's not prioritized.". 0: https://github.com/tavrez/openssh-sk-winhello https://github.com/tavrez/openssh-sk-winhello 0.footnote: "Windows Hello also supports other types of authenticators like internal TPM device(if they support generating ECDSA or Ed25519 keys, they can be used instead of FIDO/U2F security keys)." 1: https://github.com/tavrez/openssh-sk-winhello/issues https://github.com/tavrez/openssh-sk-winhello/issues 2: https://github.com/PowerShell/Win32-OpenSSH/issues/1804#issuecomment-850500721 https://github.com/PowerShell/Win32-OpenSSH/issues/1804#issu...
- redninja83 4y ago
  Its possible to do, and once set up its a reasonably smooth process. - Init Your TPM - Create a key+cert on your TPM using certutil.exe - Grab your public key - Use WinCryptSSH (https://github.com/buptczq/WinCryptSSHAgent https://github.com/buptczq/WinCryptSSHAgent) as your SSH agent and away you go These are very simplified steps, but there are howtos floating around (eg https://blog.habets.se/2016/10/Windows-SSH-client-with-TPM.html https://blog.habets.se/2016/10/Windows-SSH-client-with-TPM.h...)
boustrophedon 4y ago
It's actually very easy on linux now: You just use the two -sk key types released in Feb 2020 https://www.openssh.com/txt/release-8.2 https://www.openssh.com/txt/release-8.2 `ssh-keygen -t ed25516-sk` or `ecdsa-sk` and then you touch your yubikey when unlocking the key, the same time as you would type a password. Question for anyone else reading: Does it make sense to use a password with -sk keys? I don't think it would make a difference either way.
- frutiger 4y ago
  > Does it make sense to use a password with -sk keys? I don't think it would make a difference either way. Only if you want to protect your keys from being used by someone that has access to the private key + yubikey (i.e. someone physically present). In other words, the -sk type private key is useless without the yubikey as well.
  - boustrophedon 4y ago
    Physical presence makes sense. I didn't really think it through but it's just the same as any other 2FA: you want something you know and something you have. Thanks.
- flemhans 4y ago
  Are there any Linux-friendly laptops with a TPM built in? It's nice not to have to rely on an external yubikey
  - kitsunesoba 4y ago
    It's not a perfect rule but anything a generation or two behind and has a GPU that's either integrated (Intel or AMD) or discrete AMD with Intel wifi and bluetooth are going to have a pretty good chance of handling a reasonably recent Linux distro (e.g. Fedora or Ubuntu non-LTS) well. While Nvidia provides official Linux drivers, I've personally had more trouble out of them than I have the stock Linux drivers for Intel and AMD GPUs. Any laptop that is listed as supported by Windows 11 will have an onboard TPM.

judge2020 4y ago

For Windows, it seems it's possible[0, see footnote], however there are problems like general incompatibilities [1], and official support status is " We have this in our backlog. At this point it's not prioritized.". 0: https://github.com/tavrez/openssh-sk-winhello https://github.com/tavrez/openssh-sk-winhello 0.footnote: "Windows Hello also supports other types of authenticators like internal TPM device(if they support generating ECDSA or Ed25519 keys, they can be used instead of FIDO/U2F security keys)." 1: https://github.com/tavrez/openssh-sk-winhello/issues https://github.com/tavrez/openssh-sk-winhello/issues 2: https://github.com/PowerShell/Win32-OpenSSH/issues/1804#issuecomment-850500721 https://github.com/PowerShell/Win32-OpenSSH/issues/1804#issu...

redninja83 4y ago
Its possible to do, and once set up its a reasonably smooth process. - Init Your TPM - Create a key+cert on your TPM using certutil.exe - Grab your public key - Use WinCryptSSH (https://github.com/buptczq/WinCryptSSHAgent https://github.com/buptczq/WinCryptSSHAgent) as your SSH agent and away you go These are very simplified steps, but there are howtos floating around (eg https://blog.habets.se/2016/10/Windows-SSH-client-with-TPM.html https://blog.habets.se/2016/10/Windows-SSH-client-with-TPM.h...)

boustrophedon 4y ago

It's actually very easy on linux now: You just use the two -sk key types released in Feb 2020 https://www.openssh.com/txt/release-8.2 https://www.openssh.com/txt/release-8.2 `ssh-keygen -t ed25516-sk` or `ecdsa-sk` and then you touch your yubikey when unlocking the key, the same time as you would type a password. Question for anyone else reading: Does it make sense to use a password with -sk keys? I don't think it would make a difference either way.

frutiger 4y ago
> Does it make sense to use a password with -sk keys? I don't think it would make a difference either way. Only if you want to protect your keys from being used by someone that has access to the private key + yubikey (i.e. someone physically present). In other words, the -sk type private key is useless without the yubikey as well.
- boustrophedon 4y ago
  Physical presence makes sense. I didn't really think it through but it's just the same as any other 2FA: you want something you know and something you have. Thanks.
flemhans 4y ago
Are there any Linux-friendly laptops with a TPM built in? It's nice not to have to rely on an external yubikey
- kitsunesoba 4y ago
  It's not a perfect rule but anything a generation or two behind and has a GPU that's either integrated (Intel or AMD) or discrete AMD with Intel wifi and bluetooth are going to have a pretty good chance of handling a reasonably recent Linux distro (e.g. Fedora or Ubuntu non-LTS) well. While Nvidia provides official Linux drivers, I've personally had more trouble out of them than I have the stock Linux drivers for Intel and AMD GPUs. Any laptop that is listed as supported by Windows 11 will have an onboard TPM.