Hacker News Reader

Comment by bonyt | Hacker News Reader

Neat! Out of curiosity, the YK4 supports PKCS#11 in PIV mode, why use GPG instead of that? I use it for SSH all the time. For SSL, I believe that OpenSSL has a pkcs11 engine.

https://developers.yubico.com/YubiHSM2/Usage_Guides/OpenSSL_... (for the YubiHSM2, but the YK4 also supports PKCS#11 with OpenSC)

P.S. The color caps on those yubikeys in the photo are cool, are they 3D printed?

View on HN

GPG agent is just a convenience thing. It's already there and usable for most people with yubikey setups,

Yup the caps are 3d printed! https://twitter.com/Benjojo12/status/929445558275756032

/ https://www.thingiverse.com/thing:2641499

I’ve done both and found the GPG route marginally more reliable but YMMV. You might run in to fewer issues if you’re not on macOS; one example of a problematic interaction is that the official OpenSC installer package installs a tokend plugin that grabs the card as soon as you plug it in; but gpg wants to open it in exclusive mode even though it really only needs the OpenPGP applet, not the PIV applet.

(I’m happy to accept that it’s GPG behaving badly here; the bottom line is just that if you want to use your card for and GPG and SSH and apparently TLS, gpg might be easier to get working than trying to use gpg + anything else. FWIW I hear gpgtools (the Mac distribution) merged a patch that fixed that behavior.)

I did not knew about that, thank you! I instantly changed my SSH key for the generated key in my YubiKey Neo and use it everywhere.

Here is a tutorial is anyone is interested: https://developers.yubico.com/PIV/Guides/SSH_with_PIV_and_PK...

Yeah, it's cool! A couple extra tips:

- You can put "PKCS11Provider /usr/lib...." in your .ssh/config file (even tied to a specific Host block) to make it load the module automatically instead of having to use an argument every time you run ssh/sftp/scp/etc.

- For windows, putty-cac works well with the built-in smartcard/crypto API (CAPI), even on machines where you don't have administrative access (like my work machine). It even has its own version of pageant, so it'll work with tools like WinSCP as well.

https://risacher.org/putty-cac/ https://github.com/NoMoreFood/putty-cac/releases

Yep, putty cac works very nice. The only downside I found compared to gpg agent is that cac does not forget PIN when the card is removed (gpg agent does that and I like it).

I tried on both OS X and Linux, works fine, though on Linux it asks for the PIN every time, which is very annoying.

Do you know a solution for that?

I think you can add it to ssh-agent with

ssh-add -s /usr/lib/....

But, it's acting funny for me, particularly if I remove the key.

I did, but it’s still asking the PIN every time :(

I've found it a little easier to get going with GPG, especially on different operating systems. IIRC with PKCS you have to tell the SSH client to use a particular plugin? Whereas with GPG you just need GnuPG and have it act as the SSH agent. Plus you can forward the GnuPG socket and then anything you do on the remote server that requires GPG will pass through to the Yubikey -- I find this useful with pass and for signing Maven artifacts, just tap the Yubikey when encrypting/decrypting.

Reply on news.ycombinator.com