It's actually very easy on linux now: You just use the two -sk key types released in Feb 2020 https://www.openssh.com/txt/release-8.2

`ssh-keygen -t ed25516-sk` or `ecdsa-sk` and then you touch your yubikey when unlocking the key, the same time as you would type a password.

Question for anyone else reading: Does it make sense to use a password with -sk keys? I don't think it would make a difference either way.

> Does it make sense to use a password with -sk keys? I don't think it would make a difference either way.

Only if you want to protect your keys from being used by someone that has access to the private key + yubikey (i.e. someone physically present).

In other words, the -sk type private key is useless without the yubikey as well.

Physical presence makes sense. I didn't really think it through but it's just the same as any other 2FA: you want something you know and something you have. Thanks.

Are there any Linux-friendly laptops with a TPM built in?

It's nice not to have to rely on an external yubikey

It's not a perfect rule but anything a generation or two behind and has a GPU that's either integrated (Intel or AMD) or discrete AMD with Intel wifi and bluetooth are going to have a pretty good chance of handling a reasonably recent Linux distro (e.g. Fedora or Ubuntu non-LTS) well. While Nvidia provides official Linux drivers, I've personally had more trouble out of them than I have the stock Linux drivers for Intel and AMD GPUs.

Any laptop that is listed as supported by Windows 11 will have an onboard TPM.

For Windows, it seems it's possible[0, see footnote], however there are problems like general incompatibilities [1], and official support status is " We have this in our backlog. At this point it's not prioritized.".

0: https://github.com/tavrez/openssh-sk-winhello

0.footnote: "Windows Hello also supports other types of authenticators like internal TPM device(if they support generating ECDSA or Ed25519 keys, they can be used instead of FIDO/U2F security keys)."

1: https://github.com/tavrez/openssh-sk-winhello/issues

2: https://github.com/PowerShell/Win32-OpenSSH/issues/1804#issu...

Its possible to do, and once set up its a reasonably smooth process.

- Init Your TPM

- Create a key+cert on your TPM using certutil.exe

- Grab your public key

- Use WinCryptSSH (https://github.com/buptczq/WinCryptSSHAgent) as your SSH agent and away you go

These are very simplified steps, but there are howtos floating around (eg https://blog.habets.se/2016/10/Windows-SSH-client-with-TPM.h...)