4 ms·
Even better, if possible switch to something like PGP keys on Yubikey which prevents exfiltration of the private key, and will only sign things when you enter P
by progbits 4y ago
Even better, if possible switch to something like PGP keys on Yubikey which prevents exfiltration of the private key, and will only sign things when you enter PIN / touch the device.
- doubled112 4y agoThis has been my SSH key solution for a while now. Worked smoothly on most systems. Kind of messy on Windows, because there are so many SSH agent implementations, but GPG4Win's latest version works with the native SSH now. Real progress.
- tkanarsky 4y agoI find that the PIV smart card stack is needlessly complicated if all you're trying to do is add a resident SSH key to your yubikey. Look at `ed25519-sk` [0], which is supported by default by recent versions of OpenSSH (and dropbear? idk) [0]: https://news.ycombinator.com/item?id=29231396 https://news.ycombinator.com/item?id=29231396
- doubled112 4y agoPGP is definitely complicated if you’re not going to use it for other functionality. And that’s completely separate to the PIV functionality on the key.
- tkanarsky 4y agoOh, I was under the impression that PIV referred to the smart card protocol and PGP was an application making use of that protocol, something like TCP and HTTP. Looks like I'm mistaken, thanks!
- egberts1 4y agoNot the map you are looking for but there is this comparison chart of SSH clients and its algorithms. https://ssh-comparison.quendi.de/comparison/cipher.html https://ssh-comparison.quendi.de/comparison/cipher.html
- doubled112 4y agohttps://github.com/rupor-github/win-gpg-agent/blob/main/docs/pic1.png https://github.com/rupor-github/win-gpg-agent/blob/main/docs... Don’t forget this diagram of all the agents, protocols and bridges you might hit on Windows.
- egberts1 4y agoThat is the scariest system diagram chart that I have ever seen. It should be a prime example of what NOT to do.