2 ms·
Both. FIDO2 compliant devices need to implement ECDSA at minimum, which means you can use non-discoverable keys for SSH at minimum. Yubikeys, and some others,
by heavyset_go 3y ago
Both. FIDO2 compliant devices need to implement ECDSA at minimum, which means you can use non-discoverable keys for SSH at minimum.
Yubikeys, and some others, also implement Ed25519 and discoverable key storage, so you can store SSH keys on the Yubikey itself.
- wkat4242 3y agoYes be aware that the discoverable slots are very limited (I forget but I think it's 8) and they are also used for passwordless use with websites. There's no way to reassign those slots right now short of wiping the whole key.
- heavyset_go 3y agoAt least with Yubikeys, there are 25 discoverable key slots and you're able to pick and choose which keys you want to delete or save at any time using the Yubico Authenticator.
- wkat4242 3y agoHmm I don't have that option. Perhaps my firmware is too old. Unfortunately Yubikeys can't be updated anymore since the early NEOs :(