5

OpenSSH version 8.2 introduced support for FIDO/U2F hardware authenticators, via the new public key types "ecdsa-sk" and "ed25519-sk".

I currently have SSH authentication set up in combination with gpg subkeys by using my security key in GPG mode. I am wondering if there is any benefit (especially security related) to the native support over the old GPG solution, but could not find any obvious ones.

1 Answer 1

1

The answer depends on your environment. If you have a few personal systems secured with SSH with Security Keys with GPG or PIV and you've migrated off of deprecated RSA keys then I see no problem.

If you are part of a larger enterprise, then shifting to the SK keys provides a few management benefits:

  • Hardware vs Software keys can be easily distinguished in authorized_keys (those with sk- are hardware), and support for these keys can be easily determined by the SSH(D) version (8.2p1 or later).

  • SSHD allows you to lock down supported key types in sshd_config using PubkeyAcceptedKeyTypes, so now you can easily create systems where only hardware generated keys are allowed (and pass an audit that your system meets these requirements).

  • SK keys require keygen on hardware. PIV allowed import, not sure on GPG.

  • There is no need to make sure PIV and/or GPG libraries are kept up to date. No need for extra command line options for hardware key handlers (PKCS11, etc).

All in all, the SK keys are just cleaner and easier to support and manage, particularly if you need to create environments that only allow connections authenticated by hardware-generated keys.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .