How do I generate SSH keys inside my yubikey, on Ubuntu?
There seems to be nowhere to look for this info.
9
-
See developers.yubico.com/SSH– mti2935Apr 4, 2022 at 1:04
-
2Can you generate keys on the Yubikey in any method?– schroeder ♦Apr 4, 2022 at 8:47
-
2Further, what is the threat vector which precludes you from following the linked procedure? Generate it, send it to yubikey and then securely delete it. This would only be unacceptable if the resource generating the key is not completely in your control.– foreverskaApr 4, 2022 at 18:35
-
3Boy, what an attack vector. The private key to an ed25519 key is any given random number. Rolling a 32 sided die gives you a nice 6bits of information per roll, you need 256. I'd start rolling because I can't find reference that it's possible to generate keys inside a yubikey.– foreverskaApr 5, 2022 at 14:50
-
3I'll ask again... "Can you generate keys on the Yubikey in any method?" You ask about doing it on Ubuntu, but does the OS matter? Does the device even have this functionality? I'm thinking that this isn't a security question but a product support question. This sounds like a "does this product have this function?" question. Have you asked Yubikey?– schroeder ♦Apr 6, 2022 at 12:31
|
Show 4 more comments
2 Answers
I asked the question verbatim on reddit r/yubikey and got the following answer, along with another with some reference to gpg.
ssh-keygen -t ed25519-sk -O resident # resident means, that the key will be generated on the yubikey
It produce the following output:
user@pc:~$ ssh-keygen -t ed25519-sk -O resident
Generating public/private ed25519-sk key pair.
You may need to touch your authenticator to authorize key generation.
Enter PIN for authenticator:
Enter file in which to save the key (/home/user/.ssh/id_ed25519_sk):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/user/.ssh/id_ed25519_sk
Your public key has been saved in /home/user/.ssh/id_ed25519_sk.pub
The key fingerprint is: SHA256:ztpJ8rTSlo07BQ0LyL6hI2X9/CE9fTdy0EQZhAnxc74 user@pc
https://www.reddit.com/r/yubikey/comments/tzfgas/generating_key_inside_yubikey/
-
Enter file in which to save the key (/home/user/.ssh/id_ed25519_sk):wouldn't it generate in the local OS? Apr 9, 2022 at 2:44 -
If you have a reddit account, the person in that thread seems to be very knowledgeable. BUT, '-o resident' was explained as the option which forces the yubikey to generate the key on device. Instead of passing back the private key it seems to pass back a "handle" to the key on the device. Per this thread: reddit.com/r/sysadmin/comments/hzxdbf/… Apr 9, 2022 at 3:05
Type the following commands on the command line:
gpg --edit-card
admin
generate
-
2Your answer could be improved with additional supporting information. Could you explain what do the different commands do, and how this answer could complement or correct already existing answers.– YurikoOct 18, 2022 at 5:50