Hacker News Reader

Comment by ratorx | Hacker News Reader

You don’t need a file on the client for resident keys. You have to run a command to load them into the SSH agent, but you don’t need any information for that.

https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht...

View on HN

Ahhhh. The key thing I was missing was `ssh -K`. This works, but isn't really quite what I was hoping for. It's effectively using the SK as a glorified flash drive to transfer the secret key. I was kinda hoping to avoid storing the private key on the local machine at all. There are upsides to this strategy however, especially given how simple it is and how it maintains compatibility with tools which require secret key material directly.

I may end up using a mix of this and a GPG integration once I learn more about how that works with SSH. I still need to dig into PIV/PAM/Keychain/FileVault/etc...

Thanks for the top though :)

I’m not sure, but I’d be surprised if the secret key leaves the SK. If you remove it, SSH doesn’t work. `-K` configures a pointer so SSH knows where to look to find the private key (on the SK). It is the same as non-resident keys, but stores the private key pointer on the SK as well.

> I was kinda hoping to avoid storing the private key on the local machine at all.

I may be misunderstanding but I use U2F with OpenSSH (8.3). The private key is not on the local machine. It's still SSH public/private key pair but the private key on the computer is only a "key handle", not the real private key. The private key is protected on the security key. I don't mind copying that private key around: although it looks like a private key, it's just a key handle and not the actual private key.

Good point. I'm not being precise, sorry.

Still, I'm trying to avoid leaving so many breadcrumbs on my systems if they aren't needed.

Not using SSH resident keys myself yet, but you also require key identifiers for your gpg keys on the local machine if you use yubikeys with gpg afaik.

Ugh, now I'm having the dreaded ERROR: Failed to connect to YubiKey when running ykman fido info. :(

Reply on news.ycombinator.com