Hacker News Reader

Comment by Metus | Hacker News Reader

You aren't. It is the same with Yubikeys, if you use them. You are supposed to generate a certificate per user and device they are using for authentication, which is not a big deal at least for remote login on servers, as you can set an arbitrary number of valid SSH keys.

View on HN

You are supposed, yes, but it is not necessary with Yubikeys. You can still import private keys into your Yubikey. At work we are using this for group access to some appliances that annoyingly limit the number of SSH authorized keys you can teach them.

Also, there are arguments against generating RSA keys with closed-source software (don't tell me that's all pure hardware in a smartcard). For one, generating keys that are vulnerable to something exotic is very much a viable threat, and yubikeys in particular had an issue where some accidentally created very weak keys.

Sure, you need to make sure the key doesn't leak on it's way, but that's not really the issue.

> and yubikeys in particular had an issue where some accidentally created very weak keys.

So did Debian between 2006 and 2008 https://certlogik.com/debian-weak-key-check/

Yes, but software is easier to fix and the problem is easier and more probable to find.

More importantly: you can check the key generator to not include a Dual_EC_DRBG.

In OpenSSL. Not in GnuPG. I'm not claiming the latter necessarily has better code, but the former's bad code quality is known.

Reply on news.ycombinator.com