Hacker News Reader

Comment by beagle3 | Hacker News Reader

Neither the pgpcard (which I got from g10code while they were still selling them) nor my 100 or so Yubikeys purchased over the last 5 years support ed25519.

View on HN

As far as I understand, none of the hw token vendors support ed25519, because none of the secure element vendors do.

Your best bet is AFAIK ECDSA with NIST parameters.

Yubikey is supporting ed25519 as of firmware 5.2.3 (https://www.yubico.com/blog/whats-new-in-yubikey-firmware-5-...)

I’ll try to upgrade, thanks

You can't upgrade the Yubikeys. You have to buy a new one.

https://support.yubico.com/support/solutions/articles/150000...

Ugh that's really frustrating. If it's for security, why can't they just blank the key like they do when the master key is used?

Ahh, I should have made that more clear in my comment. Definitely frustrating, as those dang keys aren’t cheap!

"When we do release new firmware, we ensure the new YubiKey will function the same as older versions, so there is no need to purchase new YubiKeys to ensure compatibility."

Seems false, doesn't it?

Now THAT is a good news piece :)

I just happened to be considering new yubikeys, maybe I will finally migrate everything. Though I could support ed25519 with my previous idea on handling it (where yubikeys serve as decryption device for elsewhere stored crypto machine.

This might be a dumb question, but 100 yubikeys? Do you use this many yourself, or do you give them to other people?

1 yubikey per service provider?

Yeah, we use ed25519 almost everywhere, except we have some networking gear that doesn't support it.

Reply on news.ycombinator.com