How to use USB-Stick instead of passphrase?

Question

I wanted to know if something exists that would allow the following.

Whenever I use my RSA key(when using ssh for example) I'm prompted for my passphrase. I would like to, instead of being prompted for it, if a "USB-Key" is plugged in, it would use it instead of the passphrase.

But if the USB is not plugged in, then would have a fallback to the passphrase prompt.

If there is a solution to this could someone point it to me? Or at least give me some keywords/links for me too refine my search for it?

Answer 1

Check out yubikey for a possible idea

http://www.yubico.com/products/services-software/personalization-tools/static-password/

Edit: Note that even Yubikey recommends not storing the entire key on the device...

From the Yubikey website:

Yubico recommends users to use the YubiKey in static password mode for only part of their password. Users are recommended to manually enter a simple and easy-to-remember first part of their password, then use the YubiKey to enter a strong second part to their password. For example: Users can set their password to Sunny33rcltrcihbkkiulnveuenervidliliifv, where “Sunny33” is manually entered by the users and “rcltrcihbkkiulnveuenervidliliifv” is stored in and entered by the YubiKey

Answer 2

You could store the password in a Keepass database stored with the RSA key and encrypt it with a keyfile which is on the USB stick. To make myself clear:

Your harddisk:

• RSA key
• encrypted Keepass database that requires a keyfile (consider EFS or LUKS/dmcrypt encryption on top of that if you think someone could both steal your USB key and access your harddisk)

Your USB key:

• Keepass keyfile

The idea is that should you loose your USB key, it contains data that is useless without the harddisk, while you can still (hopefully) remember your RSA key's password.

If set up correctly, all you need to do is have Keepass running and use the USB key's keyfile, and when prompted for your password CTRL+ALT+A should enter your RSA key's passphrase. Depending on what you actually use that key for you can even store the RSA key directly in Keepass, e.g. for SSH via KeeAgent (requires KeePass 2.x) or PuttyAgent (for KeePass 1.x)

Answer 3

This sounds like a bad idea to me, since anybody finding/grabbing your USB stick can thereafter use your RSA key. The typical alternative would be using a smartcard (some are available in USB form factor), where application of the key is still protected by a PIN, so the factor "something-you-know" is still necessary. It may be possible, that the PIN needs to be entered only once per (smart card) session, i. e. as long as the card is in the reader.

Answer 4

Over-complications lead to security vulnerabilities as well as loss of account access. I developed a shell which generates a 4096bit RSA password protected key pair. When mounted to your workstation, point any local SSH key based authenticated applications toward to public key in your mounted USB disk drive. I have a secondary PGP encrypted file which when decrypted, provides a secure text password which is different from the one used to encrypt the ssh key and also is used as the password for any plain text password based authentication systems by entering the master pass phrase which adheres to the “Something you know” principle. This allows plain text passwords to be saved and used securely and also automatic authentication whenever an RSA key pairs can be used to authenticate. All of this is done with 2 very highly researched and documented utilities, one of which is native to most OS types. All you need: ssh-keygen terminal utility, GPG tools and any sort of mountable removable storage :)