MalwareLab on Nostr: #SSH keys with #Yubikey are very convenient and secure way to login. And you can have ...
#SSH keys with #Yubikey are very convenient and secure way to login. And you can have as many SSH keys as you want (*) protected with a single Yubikey or other #FIDO2 authenticator.
(*) I mean standard (non-resident) ed25519-sk and ecdsa-sk public/private keys.
There is also option to generate the resident key, where the credential id file is stored in Yubikey and not on your computer. But this is kind of equivalent of storing file with your credential id file on USB flashdrive and keep it together with Yubikey. The resident keys can be extracted from Yubikey.
And yes, I write credential id file instead of private key, because the generated file with private key is not the true private key. Instead, it is kind of seed/key handle and the true secret is stored in Yubikey and cannot be extracted.
* Non-resident keys are ideal for systems where #privacy is important if the YubiKey is lost or stolen.
* Resident keys are ideal for ease of access where the FIDO2 PIN is known.
More info: https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html
#cryptography #authentication #fido2 #webauthn #2FA #MFA
(*) I mean standard (non-resident) ed25519-sk and ecdsa-sk public/private keys.
There is also option to generate the resident key, where the credential id file is stored in Yubikey and not on your computer. But this is kind of equivalent of storing file with your credential id file on USB flashdrive and keep it together with Yubikey. The resident keys can be extracted from Yubikey.
And yes, I write credential id file instead of private key, because the generated file with private key is not the true private key. Instead, it is kind of seed/key handle and the true secret is stored in Yubikey and cannot be extracted.
* Non-resident keys are ideal for systems where #privacy is important if the YubiKey is lost or stolen.
* Resident keys are ideal for ease of access where the FIDO2 PIN is known.
More info: https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html
#cryptography #authentication #fido2 #webauthn #2FA #MFA
quoting nevent1q…lqjaHow To Set Up SSH Keys With YubiKey as two-factor authentication (U2F/FIDO2) https://www.cyberciti.biz/security/how-to-set-up-ssh-keys-with-yubikey-as-two-factor-authentication-u2f-fido2/ #linux #unix #openssh #freebsd #macos