Using a hardware security token as a second factor is generally considered quite a boost in security. But one of the issues I'm having is how to backup the (digital) keys used in the hardware device (especially in cases when just adding multiple hardware keys is not desired or an option).
I'm currently using an open source hardware device from
SoloKeys (https://solokeys.com/). This device also allows interaction via a commandline application (https://github.com/solokeys/solo-python) which would give the possibility to generate a custom digital key to be used on that device (that idea is also used for the
DiceKeys, see https://www.crowdsupply.com/dicekeys/dicekeys).
From what I understand this should give the possibility to:
- generate a digital key on an airgapped computer
dd if=/dev/urandom of=KEYFILE bs=256 count=1
- backup that file into a password manager
- use that file to generate the key on the hardware security device
In case the hardware device gets lost, it should be trivial to 'regenerate' a new one using a new hardware device and the stored keyfile.
Now my questions are:
- how can I do that?
- is that considered to be a smart thing to do or do I miss something?