3 ms·
As a counter-point, my SSH keys are bound to my laptop's secure enclave and it's not possible for me to back them up. I have recovery mechanisms for regaining
by andrewaylett 2y ago
As a counter-point, my SSH keys are bound to my laptop's secure enclave and it's not possible for me to back them up.
I have recovery mechanisms for regaining access if I lose all my keys, but (while I'll admit that the tooling for managing public keys in the general case is lacking) you're not supposed to (need to) copy private keys between devices.
- ziml77 2y agoThat was basically what I was going to say too. The most secure keys are the ones that can't be transferred. If I want protection against the loss of a hardware security key like a Yubikey, I have to get a second one and register that one as a secondary key to log in. Technically you can generate a GPG key and load that onto multiple Yubikeys, but that's not as secure as letting the Yubikey itself generate the key. Plus if you only use one GPG key and one of the Yubikeys is lost (but not destroyed) then you have to rewrite all the remaining Yubikeys with a new GPG key since you can't selectively revoke them.