logoalt Hacker News

sidneythekidney • today at 7:39 PM • 0 replies • view on HN

Resident keys have their "metadata" stored on the yubikey, in an exportable way. This means using the same ssh-key on a different computer is as easy as plugging in the yubikey and typing ssh-keygen -K. With a non-resident key you’d have to copy the "privatekey", which contains the metadata needed to use the key, to the other computer first.

The downside with resident keys is that someone stealing the yubikey can see what resident keys are on it, and then possibly use those keys (if they aren’t protected). Newer firmware comes with ways to protect against this, but you’d have to enable it.

[1] has more details

1: https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.ht...