3 ms·

This is a great idea. I now exclusively use SSH keys on hardware security modules of some kind. I use "Secretive", a mac app that does the same, plus a yubikey

This is a great idea. I now exclusively use SSH keys on hardware security modules of some kind. I use "Secretive", a mac app that does the same, plus a yubikey using yubikey-agent (https://github.com/FiloSottile/yubikey-agent https://github.com/FiloSottile/yubikey-agent; there are too many complicated ways to use SSH keys with a yubikey this is one of the friendliest ones). Depending on the security and frequency of which I access the service impacts whether I need presence confirmation or use secretive versus the yubikey. I would be remiss to mention there are existing SSH TPM projects, not sure how this one differentiates. It seems to at least have the user experience pretty simple, similar to yubikey-agent (and secretive), and unlike some of the existing solutions which have quite a few extra steps: https://github.com/tpm2-software/tpm2-pkcs11/blob/master/docs/SSH.md https://github.com/tpm2-software/tpm2-pkcs11/blob/master/doc... I really love it when projects like this address there are "competitors" or other software in the space and provide a fair comparison. It would be great to see one of those here :) For example you can easily use SSH FIDO keys but they aren't supported by all server sides, ECDSA keys often are (though not always!) etc :)

linsomniac 3y ago
The ; got included in the yubikey-agent URL: https://github.com/FiloSottile/yubikey-agent https://github.com/FiloSottile/yubikey-agent Thanks for those pointers!
- Foxboron 3y ago
  It's not written in the README.md, but `ssh-tpm-agent` is very much a copy-paste of `yubikey-agent` but with a bit better testing and the yubikey part swapped with TPM stuff.
zhfliz 3y ago
have you considered using ykcs11? ykcs11 allows you to use the native SSH agent (or even no agent at all for individual ssh invocations) with an ssh key on a yubikey using their pkcs11 provider. https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PKCS11.html https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PK...
- Foxboron 3y ago
  When you see a guide containing a 7 step manual to do something that should be simple, it's worth taking a step back and consider the question if you can make this valueable security feature more easily accessible. Side-loading so-names into your security critical apps is probably something you should be more critical of as well.
  - zhfliz 3y ago
    are you extending this to the usage of yubikey-agent and ssh-tpm-agent as well? both variants, whether it's using a PKCS11 provider using a standardized interface, or using a completely custom SSH agent, will need to deal with secret material. although I'm no expert on the inner workings of SSH, I'd expect there to not be much difference between having the OpenSSH agent interface with ykcs11 (which is also open source and can be reviewed) and using an alternative agent with piv capabilities that was found on github.
    - Foxboron 3y ago
      > are you extending this to the usage of yubikey-agent and ssh-tpm-agent as well? No, as they never get loaded into the ssh binary and are external programs communicating over an interface. Consider reading over the recent qualys vulnerability report on how messy this dloading of pkcs11 actually is. https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh... >both variants, whether it's using a PKCS11 provider using a standardized interface, or using a completely custom SSH agent, will need to deal with secret material. `ssh-tpm-agent` is not dealing with secret material. That is delegated to the TPM and we are only in the business of telling the TPM to sign stuff for us. Yubikey-agent does create a private key on the machine before inserting it into the yubikey. I would not call these two things equal and there are a difference to what the potential impact is. >although I'm no expert on the inner workings of SSH, I'd expect there to not be much difference between having the OpenSSH agent interface with ykcs11 (which is also open source and can be reviewed) and using an alternative agent with piv capabilities that was found on github. There is a separation of concerns here though.

linsomniac 3y ago

The ; got included in the yubikey-agent URL: https://github.com/FiloSottile/yubikey-agent https://github.com/FiloSottile/yubikey-agent Thanks for those pointers!

Foxboron 3y ago
It's not written in the README.md, but `ssh-tpm-agent` is very much a copy-paste of `yubikey-agent` but with a bit better testing and the yubikey part swapped with TPM stuff.

zhfliz 3y ago

have you considered using ykcs11? ykcs11 allows you to use the native SSH agent (or even no agent at all for individual ssh invocations) with an ssh key on a yubikey using their pkcs11 provider. https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PKCS11.html https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PK...

Foxboron 3y ago
When you see a guide containing a 7 step manual to do something that should be simple, it's worth taking a step back and consider the question if you can make this valueable security feature more easily accessible. Side-loading so-names into your security critical apps is probably something you should be more critical of as well.
- zhfliz 3y ago
  are you extending this to the usage of yubikey-agent and ssh-tpm-agent as well? both variants, whether it's using a PKCS11 provider using a standardized interface, or using a completely custom SSH agent, will need to deal with secret material. although I'm no expert on the inner workings of SSH, I'd expect there to not be much difference between having the OpenSSH agent interface with ykcs11 (which is also open source and can be reviewed) and using an alternative agent with piv capabilities that was found on github.
  - Foxboron 3y ago
    > are you extending this to the usage of yubikey-agent and ssh-tpm-agent as well? No, as they never get loaded into the ssh binary and are external programs communicating over an interface. Consider reading over the recent qualys vulnerability report on how messy this dloading of pkcs11 actually is. https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh... >both variants, whether it's using a PKCS11 provider using a standardized interface, or using a completely custom SSH agent, will need to deal with secret material. `ssh-tpm-agent` is not dealing with secret material. That is delegated to the TPM and we are only in the business of telling the TPM to sign stuff for us. Yubikey-agent does create a private key on the machine before inserting it into the yubikey. I would not call these two things equal and there are a difference to what the potential impact is. >although I'm no expert on the inner workings of SSH, I'd expect there to not be much difference between having the OpenSSH agent interface with ykcs11 (which is also open source and can be reviewed) and using an alternative agent with piv capabilities that was found on github. There is a separation of concerns here though.