News for hackers. Stuff that matters.

A comment on The default OpenSSH key encryption is worse than plaintext. Parent comment

Re:The default OpenSSH key encryption is worse than plaintext by lvh on Saturday August 04, 2018 @10:11AM (#17686907)
If you can put up with GPG cards, gpg-agent knows how to pretend to be an SSH auth socket meaning it can do your signing for you.

At key generation time you can dump the key (once!) and then feed it to paperkey as a backup.

[ Parent | on HN ]
Re:The default OpenSSH key encryption is worse than plaintext by tptacek on Saturday August 04, 2018 @01:44PM (#17687754)
Why would you do this? Isn't it almost just as simple to generate a second software key and paper-key that? The difference between propagating one key to servers or two is a single newline character.
[ Parent | on HN ]
Re:The default OpenSSH key encryption is worse than plaintext by lvh on Saturday August 04, 2018 @02:19PM (#17687891)
Sure, I think that’s a fine option too.
[ Parent | on HN ]