**peter hessler @openbsd** @phessler@bsd.network · 2019-01-21T05:57:17Z

peter hessler @openbsd @phessler@bsd.network

peter hessler @openbsd @phessler@bsd.network

Thanks to msfriedl, #OpenSSH now supports #ECDSA keys stored in PKCS#11 tokens such as #Yubico Yubikey 4. This is available in CVS/git HEAD now and will be in the OpenSSH 8.0 release.

(H/T djm@)

https://lists.mindrot.org/pipermail/openssh-unix-dev/2019-January/037468.html

Jan 21, 2019, 05:57 · · Web · · ·

**Combat Unicorn** @kurtm@bsd.network · Jan 21, 2019, 05:58

**Combat Unicorn** @kurtm@bsd.network · Jan 21, 2019, 05:58

Jan 21, 2019, 05:58

Combat Unicorn @kurtm@bsd.network

@phessler My lackey will be happy. He's been using GPG to simulate ssh-agent in order to use his Yubikey. Sounded super-horrible to me (because GPG).

**peter hessler @openbsd** @phessler@bsd.network · Jan 21, 2019, 06:00

**peter hessler @openbsd** @phessler@bsd.network · Jan 21, 2019, 06:00

Jan 21, 2019, 06:00

peter hessler @openbsd @phessler@bsd.network

@kurtm it'll be good only if his OS of choice updates their software this decade.

**Combat Unicorn** @kurtm@bsd.network · Jan 21, 2019, 06:02

**Combat Unicorn** @kurtm@bsd.network · Jan 21, 2019, 06:02

Jan 21, 2019, 06:02

Combat Unicorn @kurtm@bsd.network

@phessler I have it on pretty good authority that his OS of choice will do so. Although... let me check.

Hey @phessler! OpenBSD going to update their OpenSSH to the new version soon?

**peter hessler @openbsd** @phessler@bsd.network · Jan 21, 2019, 06:03

**peter hessler @openbsd** @phessler@bsd.network · Jan 21, 2019, 06:03

Jan 21, 2019, 06:03

peter hessler @openbsd @phessler@bsd.network

@kurtm probably ships in tomorrow's snapshot. worst case, check back on May 1.

**Combat Unicorn** @kurtm@bsd.network · Jan 21, 2019, 06:05

**Combat Unicorn** @kurtm@bsd.network · Jan 21, 2019, 06:05

Jan 21, 2019, 06:05

Combat Unicorn @kurtm@bsd.network

Thanks @phessler !

Well, there you go @phessler. @phessler says the code should be in tomorrow's snapshot.

**Edd Barrett** @ebarrett@mastodon.social · Jan 21, 2019, 11:00

**Edd Barrett** @ebarrett@mastodon.social · Jan 21, 2019, 11:00

Jan 21, 2019, 11:00

Edd Barrett @ebarrett@mastodon.social

@phessler Does this mean we can ditch gpg-agent for ssh auth via yubikey?

**peter hessler @openbsd** @phessler@bsd.network · Jan 21, 2019, 11:02

**peter hessler @openbsd** @phessler@bsd.network · Jan 21, 2019, 11:02

Jan 21, 2019, 11:02

peter hessler @openbsd @phessler@bsd.network

@ebarrett yes. I watched djm@ demo it in the hackroom

**ｉｒｌ** @irl@57n.org · Jan 21, 2019, 13:58

**ｉｒｌ** @irl@57n.org · Jan 21, 2019, 13:58

Jan 21, 2019, 13:58

ｉｒｌ @irl@57n.org

@phessler Will this cause GnuPG and OpenSSH to fight over the YubiKey instead of fighting over the socket?

**peter hessler @openbsd** @phessler@bsd.network · Jan 21, 2019, 20:36

**peter hessler @openbsd** @phessler@bsd.network · Jan 21, 2019, 20:36

Jan 21, 2019, 20:36

peter hessler @openbsd @phessler@bsd.network

@irl I guess? I don't install gnupg.

**ｉｒｌ** @irl@57n.org · Jan 21, 2019, 20:41

**ｉｒｌ** @irl@57n.org · Jan 21, 2019, 20:41

Jan 21, 2019, 20:41

ｉｒｌ @irl@57n.org

@phessler Ok. Thanks.

Resources

Developers

What is Mastodon?

bsd.network

More…