OpenSSH has built-in support for FIDO security keys since version 8.2 (released in 2020). This means you can protect your SSH private keys using security keys, similar to how this can be done with OpenPGP smart cards and cryptographic tokens that support PKCS#11.
Although such devices all allow you to protect your private keys using cryptographic hardware, the benefits on using FIDO include:
- FIDO is easier to use, especially for beginners
- security keys can be used on the web as well to store passkeys
- no need for vendor-specific software (like PKCS#11 modules)
- security keys are inexpensive
- FIDO features device attestation, which lets you cryptographically prove you are using a specific security key make and model.
In this talk, we will give a short introduction to FIDO security keys, and provide several demos of the use of security keys with OpenSSH, such as signing arbitrary data, authenticating to remote systems, and using key attestation.
The talk consists of a number of demos that participants can follow along on their system. Participants can bring their own security key (any vendor will do). If they do not own a security key one will be provided to them.
IMPORTANT NOTESIn this hands-on workshop, you will use FIDO security keys with OpenSSH for authentication, signing and attestation. To maximize our time together, please have the following set up before the session:
Prerequisites: Participants should bring a laptop and a FIDO2 security key (we'll have some available at the session). Please have the following installed:OpenSSH 8.2+ (8.9+ preferred). Check with
ssh -V Git 2.34+. Check with
git --version Python 3.10+
. Check with
python3 -V Docker Desktop:
https://www.docker.com/products/docker-desktop/ libfido2:
https://developers.yubico.com/libfido2/ A GitHub account
To save time during the workshop, please also run:
docker pull ubuntu:latest git clone https://github.com/YubicoLabs/fido-openssh-workshop.gitmacOS users: the built-in OpenSSH may not support FIDO security keys. Install via Homebrew:
brew install openssh libfido2
