OpenSSH 8.2 added -sk key types that allow for FIDO/U2F hardware authenticators (like a YubiKey, etc.)

yubikey-agent allows for the same functionality, except it (a) requires an additional client on top of OpenSSH, and (b) is scoped to only YubiKeys.

Is there any advantage to using yubikey-agent?


1 Answer 1


Is there any advantage to using yubikey-agent?

This question is explicitly addressed in the documentation for yubikey-agent. To cite from Alternatives | Native FIDO2:

Native FIDO2
Recent versions of OpenSSH support using FIDO2 tokens directly. Since those are their own key type, they require server-side support, which has only recently reached Debian and GitHub.

FIDO2 SSH keys by default don't require a PIN, and require a private key file, acting more like a second factor. yubikey-agent keys always require PINs and can be ported to a different machine simply by plugging in the YubiKey. (With recent enough tokens such as a YubiKey 5, a similar setup can be achieved by using the verify-required and resident options, after setting a FIDO2 PIN with YubiKey Manager: the private key file will still be required, but it can be regenerated from the YubiKey.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .