Using a hardware security token as a second factor is generally considered quite a boost in security. But one of the issues I'm having is how to backup the (digital) keys used in the hardware device (especially in cases when just adding multiple hardware keys is not desired or an option).

I'm currently using an open source hardware device from SoloKeys (https://solokeys.com/). This device also allows interaction via a commandline application (https://github.com/solokeys/solo-python) which would give the possibility to generate a custom digital key to be used on that device (that idea is also used for the DiceKeys, see https://www.crowdsupply.com/dicekeys/dicekeys).

From what I understand this should give the possibility to:

  1. generate a digital key on an airgapped computer e.g. using dd if=/dev/urandom of=KEYFILE bs=256 count=1
  2. backup that file into a password manager
  3. use that file to generate the key on the hardware security device

In case the hardware device gets lost, it should be trivial to 'regenerate' a new one using a new hardware device and the stored keyfile.

Now my questions are:

  1. how can I do that?
  2. is that considered to be a smart thing to do or do I miss something?

For a key from SoloKeys, you can't do it. All the private keys are generated inside.

Since it is open-sourced, if you modify the source and add your own software interface or even special hardware interface, it is quite doable. But be sure to keep the interface and internal supporting logic at a high security level.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.