yubikey | GPG is useful for authenticating yourself over SSH and / | Encryption library

Im trying to store AWS access secret key in yubikey,but, as static password in "scan mode", it is not possible to store, because AWS secret exceeds 38 characters.

Now im thinking of way to store AWS secret, as in "official" way they do with SSH --> https://gist.github.com/artizirk/d09ce3570021b0f65469cb450bee5e29 , but no luck for now ( and i have very few expectation for this "path" )

Maybe someone have any suggestions?

I am currently working my way into libfido2 and trying to figure out how to use wrapped private keys with it.

Yubico says in the FAQs that with YubiKey 5 unlimited key pairs can be used for FIDO U2F; however, for FIDO2 only space for 25 resident keys is promised.

1. Does "FIDO2" mean that resident keys are used and that FIDO2 cannot be used with (external) wrapped private keys?

2. If this is the case, does libfido2 offer any possibility to work with FIDO U2F and wrapped keys instead?

3. If so, how does libfido2 need to be configured to do this? How can I provide the library with the appropriate protected private key. At least in "fido2-assert" I don't see a way to do this when I want to create an assertion on the client.

(The function accepts four specific parameters description here, and the only one that I understand could bring the private key is the "credential id". But the name makes me doubt if my request is possible with this parameter).

I am grateful for any answer!

EDIT: In the meantime I found this link to some Solo Keys developer pages describing how it works on Solo Keys. It seems the private key is calculated on the fly - in this case credential id would work as seed for the calculation)

I recently purchased a YubiKey for two-factor authentication, but I don't know how to connect it to GitHub.

Can anyone help me?

I understand that WebauthN is designed to perform authentication, but I'd like to use my Yubikey to create symmetric encryption keys to encrypt content on my web browser without relying on a backend server.

Here's my approach:

• During the assertion challange ( navigator.credentials.get({ publicKey }) ) the Yubikey signs a challenge string that the client sends to the authenticator.
• I extract the signed challenge, hash it with SHA256 and use it as my new symmetric encryption key for AES256 encryption.
• As long as the same challenge string is sent to the Yubikey, the encryption key will always be the same.

In order to be able to decrypt the content on the web browser. I would have to be in possession of the Yubikey and the challenge string for 2 factor authentication.

Is there anything wrong with this approach?

With the eminent demise of the u2f api, I'm trying to move to WebAuthn APIs using the AppId extension to support security keys previously registered with U2F. As best I can tell from reading the docs I think I am doing it correctly, however, when attempting to authenticate I am prompted by my browser to tap my key, and my key is blinking, but upon tapping it I get the error "You're using a security key that's not registered with this website". In comparing the existing u2f authentication request I'm using the same appid and key handle.

Example U2F sign request:

I am using a piv on a Yubikey loaded with trusted certificates to do mutual tls with a server. I am using this golang pkcs11 library which is a wrapper over opensc-pkcs11.so

I am implementing a signer interface using the yubikey so that it can be used as a private key with go's crypo/tls library.

My signer function looks like this (I have added data in the error for debugging):

after buying a Yubikey 5 NFC for technical interest (firmware 5.2.7) and setting up FIDO2 authentication where possible, I ran into the problem that I could no longer connect to my GitLab server via SmartGit because the second factor is not requested and therefore I can't connect to the server.

I then decided to deal with it on Windows 10 via Git Bash and SSH. Unfortunately, the documentation here assumes a lot of prior knowledge and I am an absolute beginner on the subject. In the meantime I managed to connect to the server with Git Bash and SSH using a locally generated SSH certificate.

Now I would like to use the Yubikey instead of the certificate stored locally on the computer. Unfortunately, all instructions (e.g. this one https://docs.github.com/en/github/authenticating-to-github/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent#generating-a-new-ssh-key-for-a-hardware-security-key) lead to the same error message for me:

I am using openconnect --protocol=gp vpn.mysite.com and it says its connecting, but it is waiting for the SAML authentication. The command and authentication works on my debian machine it prompts for a username and password, but trying on my other linux machine it does not seem to want to prompt for authentication. This is the output: