What is the -sk ending for ssh key types?

In OpenSSH FIDO devices are supported by new public key types "ecdsa-sk" and "ed25519-sk", along with corresponding certificate types.

To quote:

FIDO/U2F Support

This release adds support for FIDO/U2F hardware authenticators to OpenSSH. U2F/FIDO are open standards for inexpensive two-factor authentication hardware that are widely used for website authentication. In OpenSSH FIDO devices are supported by new public key types "ecdsa-sk" and "ed25519-sk", along with corresponding certificate types.

Source: https://www.openssh.com/txt/release-8.2


-sk SSH key-pairs can be either ecdsa-sk or ed25519-sk. The -sk extension stands for security key. Note that an ed25519-sk key-pair is only supported by new YubiKeys with firmware 5.2.3 or higher which supports FIDO2. This means YubiKeys with firmware below 5.2.3 are only compatible with ecdsa-sk key-pairs. If possible, generate an ed25519-sk SSH key-pair for this reason. Source: https://cryptsus.com/blog/how-to-configure-openssh-with-yubikey-security-keys-u2f-otp-authentication-ed25519-sk-ecdsa-sk-on-ubuntu-18.04.html

Tags:

Ssh

Related

If Postgres trusts localhost connections, is it dangerous to visit random websites? How can I prevent a computer from turning ON? Does complexity of salt in password hashing matter? Does Google collect and store data about activity done in Incognito mode? Is automated and digitized ballot processing inherently more dangerous than manual pencil and paper? Why do SSL certificates have country codes (or other metadata)? Why use HTTPS in the DP-3T Protocol? Does 2FA Help Prevent Unauthorized Access in Phishing Attacks? Attack against OTP Cipher What is the impact of an exposed secret key for a JWT token implementation? Is splitting a REST API server from a Web server considered a security threat? Why doesn't a simple HTTP request to display a remote web page violate the same-origin policy?

Recent Posts