News for hackers. Stuff that matters.

A comment on Secretive – macOS native app to store SSH keys in the Secure Enclave. Parent comment

Re:Secretive – macOS native app to store SSH keys in the Sec... by corty on Saturday June 27, 2020 @05:08PM (#23664693)
You are supposed, yes, but it is not necessary with Yubikeys. You can still import private keys into your Yubikey. At work we are using this for group access to some appliances that annoyingly limit the number of SSH authorized keys you can teach them.
[ Parent | on HN ]
Re:Secretive – macOS native app to store SSH keys in the Sec... by namibj on Sunday June 28, 2020 @02:02AM (#23667014)
Also, there are arguments against generating RSA keys with closed-source software (don't tell me that's all pure hardware in a smartcard). For one, generating keys that are vulnerable to something exotic is very much a viable threat, and yubikeys in particular had an issue where some accidentally created very weak keys.

Sure, you need to make sure the key doesn't leak on it's way, but that's not really the issue.

[ Parent | on HN ]
Re:Secretive – macOS native app to store SSH keys in the Sec... by Xylakant on Sunday June 28, 2020 @06:52AM (#23667955)
> and yubikeys in particular had an issue where some accidentally created very weak keys.

So did Debian between 2006 and 2008 https://certlogik.com/debian-weak-key-check/

[ Parent | on HN ]
Re:Secretive – macOS native app to store SSH keys in the Sec... by namibj on Wednesday July 01, 2020 @02:35PM (#23704834)
In OpenSSL. Not in GnuPG. I'm not claiming the latter necessarily has better code, but the former's bad code quality is known.
[ Parent | on HN ]
Re:Secretive – macOS native app to store SSH keys in the Sec... by corty on Sunday June 28, 2020 @03:56PM (#23671568)
Yes, but software is easier to fix and the problem is easier and more probable to find.
[ Parent | on HN ]
Re:Secretive – macOS native app to store SSH keys in the Sec... by namibj on Wednesday July 01, 2020 @02:36PM (#23704844)
More importantly: you can check the key generator to not include a Dual_EC_DRBG.
[ Parent | on HN ]