News for hackers. Stuff that matters.
Re:Solo – Open-source FIDO2 security key by m-p-3 on Thursday August 16, 2018 @05:05PM (#17778416)
Is it U2F only or can it also do some of Yubikey stuff like storing GPG keys, etc?
Re:Solo – Open-source FIDO2 security key by ecesena on Thursday August 16, 2018 @05:19PM (#17778495)
First version will be fido2 only, thought the firmware is open, so easy to extend.

We'll just have to verify which features are copiable vs proprietary for yubikeys. To be honest I don't know at this point, I mostly use my keys for auth, rarely otp, but no gpg/ssh/etc.

Do you have any primary use case that you're interested in?

Re:Solo – Open-source FIDO2 security key by jtl999 on Thursday August 16, 2018 @05:54PM (#17778735)
Secure storage of GPG/SSH keys preferably 4096bit, so I can have offline "cold signing"/emergency keys that are valid for a long time.
Re:Solo – Open-source FIDO2 security key by Boulth on Friday August 17, 2018 @04:27AM (#17781177)
I'm using Yubikey for that too and would also be interested in open source solution, especially if it included ed25519 and secure, tamper proof element. (Gnuk has the former but not latter).
Re:Solo – Open-source FIDO2 security key by lovelettr on Thursday August 16, 2018 @05:58PM (#17778761)
I use mine everyday for signing Git commits and tags. Also as my SSH keys.

If it did that then it would potentially replace my YubiKey(s).

Re:Solo – Open-source FIDO2 security key by Boulth on Friday August 17, 2018 @04:26AM (#17781175)
There is also open source firmware used on old Yubikeys that could be reused: https://github.com/Yubico/ykneo-openpgp
Re:Solo – Open-source FIDO2 security key by emacsen on Friday August 17, 2018 @08:04AM (#17782136)
I've just switched over to using the Yubikey Neo, so I'd love to chime in here.

My first and primary use of my key is that I use HMAC hashing on the Yubikey to unlock my KeepPassCX database. This solution works very well for me because it works seamlessly on multiple platforms (Linux and Windows) and is also compatible with Keepass2Android for my phone. I've looked into GPG only solutions and the ones I looked at didn't offer either the cross-platform compatibility and or browser integration, which is nice. The strong advantage of the Neo (vs the other hardware keys) is the use of NFC, which means less plugging things into my phone. In an ideal world, I'd love to get NFC working with my computers too.

I also use the PGP/SSH smartcard capabilities of my Yubikey on Linux (Ubuntu) and that's been flawless. I don't use SSH on Windows, but I hear the integration there is fairly solid as well.

I've not yet begun to use U2F for authentication, yet. My focus is on my most important services first, which is my passwords and logins. I'll be moving to U2F soon though.

If there was a way to store my passwords easily using PGP instead of HMAC, I'd be interested in that. The issue isn't the storage, but the interface to that storage being easy to use and cross platform (which is not the domain of the hardware, obviously). If I had that, I could consider not needing the HMAC.

I've heard that there is a way to use U2F offline for SSH, but I haven't looked into it. I'm still using SSH keys for things like SSH and Git. Perhaps if there was a solution to that, I might drop the GPG requirement, but I'd need either HMAC or GPG for decryption of my password database, so in any case, FIDO alone isn't enough.

Re:Solo – Open-source FIDO2 security key by nbraud on Friday August 17, 2018 @01:32PM (#17784440)
Regarding password storage with GPG, there is pass(1) (https://passwordstore.org) which is a wrapper around Git and GnuPG, and there are a number of front-ends for it. :)
Re:Solo – Open-source FIDO2 security key by nbraud on Friday August 17, 2018 @01:35PM (#17784463)
You mentioned the firmware is open, but I couldn't find it anywhere. Could you post a link, ideally to the Git repository where it's developed?
Re:Solo – Open-source FIDO2 security key by tptacek on Thursday August 16, 2018 @05:21PM (#17778514)
It's an upgrade to a part that used an ATECC508A crypto chip and an 8051, so presumably not.