4 ms·
For what it's worth: You can set no-touch-required on a key (it's a generation-time option though).
by ahlCVA 10mo ago
For what it's worth: You can set no-touch-required on a key (it's a generation-time option though).
- palata 10mo agoSure, but then it is set to no-touch for every FIDO2 interaction I have. I don't want to touch for signing, but I want to touch when using it as a passkey, for instance.
- Avamander 10mo agoUse the PIV applet for SSH and signing Git commits instead? Git supports S/MIME and SSH can use keys over PKCS#11 basically out-of-box on OSs that don't ship gpg-agent (that just interferes with SmartCard usage in general).
- ahlCVA 10mo agoThis is a per-credential setting, so you can have your SSH signing key be a no-touch key and still use touch confirmation for everything else. (see "uv" option here https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorMakeCredential https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-cl... - the -sk key types in SSH are just a clever way of abusing the FIDO protocol to create a signing primitive)
- palata 10mo agoOh, I need to check this! Thanks!