Security keys are now supported for SSH Git operations

Re:Security keys are now supported for SSH Git operations by tialaramex on Wednesday May 19, 2021 @08:03AM (#27207421)

Your Yubikey (but not Yubico's cheaper Security Key product and the dozens of other similar cheaper products) is able to do public key signatures exactly like the ones SSH supports anyway, so GitHub didn't do anything to support those.

But modern OpenSSH can do FIDO, the same technology that drives U2F and its replacement WebAuthn, and is in all those cheaper and more popular products. FIDO won't sign arbitrary data with keys, it will only perform a very specific operations and so OpenSSH grew a whole separate set of public key authentication types to support that approach, and GitHub is announcing their support for these extra types.

There are some neat features beyond "this makes cheaper devices work" but GitHub mostly does not use them, although they do choose to require that your Security Key verify you are present (typically by touching a sensor or clicking a physical button) whereas your existing Yubikey setup might not be doing that and GitHub can't force you to.

[ Parent | on HN ]

Re:Security keys are now supported for SSH Git operations by noahtallen on Wednesday May 19, 2021 @05:24PM (#27214659)

Another big benefit is ease of use setting up the Yubikey. My understanding is that these newer key types can be generated very easily using the ssh tools which already exist on your systems. Previously, it was very common to set up GPG keys and integrate them with SSH, which is not only more work but also fairly involved.

These new key types make it a lot easier to get up and running with storing your SSH key on your Yubikey. I would have used this format instead of GPG when I was setting up a Yubikey a month ago, but GitHub (and some other providers I use) didn’t support a new enough OpenSSH version.

[ Parent | on HN ]