The easiest solution I was able to come up with this morning uses Key Encryption Key principles for execution. This is fairly common when using multiple SSH keys on servers in the cloud. You can use a cloud based HSM to encrypt/decrypt the keys you need to use without having to store it locally. This was when your encrypted keys are left on the disk, and attacker doesn't have access to the master key.
To implement this within your environment you need the following:
- A gpg configured Yubikey (or other GPG key system)
- A target file to encrypt/decrypt
- A slightly modified configuration file
For the purposes of this article, I'm going to assume the reader has already configured their Yubikey. If you haven't done this (I realize OP has), you can register your key with gpg with these directions:
https://support.yubico.com/support/solutions/articles/15000006420-using-your-yubikey-with-openpgp
The first thing you'll want to do is determine which key you want to perform the local encryption and decryption. Try running:
gpg --list-keys
This will output a few lines. We need the content of the PUB line for the key associated with the yubikey:
pub 2048R/E48EFBC7 2019-01-20
Specifically, we need the 8 characters "E48EFBC7". Once we have the characters, we can copy them to our configuration file to ensure we use the yubikey key by default. To do this, update the following line in the gpg.conf file (~/.gnupg/gpg.conf):
default-key E48EFBC7
By default, this line is commented out, you'll need to uncomment it. As a side note, this is NOT required, but it is helpful. Instead of trying to specify a key for encryption, you can make the application leverage your Yubikey by default.
The next configuration will be altering the recipient. Again, this is optional but definitely helpful. Scroll down and uncomment the following line within the gpg.conf file:
default-recipient-self
Now your gpg agent is set to automatically use your yubikey for encryption/decryption and to make the target recipient your encrypting key.
With this in place, you can now start encrypting and decrypting your certificates. To encrypt simply run the following command:
gpg -o <output.gpg> -e <ssh.key>
To decrypt;
gpg -o <ssh.key> -d <output.gpg>
Decryption will ask for your Yubikey PIN.
Some finer notes:
- Run a chmod 600 on your ssh keys when they are un-encrypted to make sure only the direct owner has permission to read the key.
- Remove decrypted keys when they are not longer needed.
- You can still add a key to your ssh keys to protect them even when they are decrypted.
