Secure Shell (SSH) is often used to access remote systems. It provides a cryptographically secure channel over an unsecured network. SSH uses public-key cryptography to authenticate the remote system and allow it to authenticate the user.
SSH also offers passwordless authentication. In this scenario, a public-private key pair is generated. The public key is placed on all remote systems and grants access to the owner of the matching private key. The owner is responsible for keeping the private key secret. With a YubiKey, you can generate the private key directly on the hardware, where it cannot be exported or extracted. Even if your machine is compromised, your private key stays on the YubiKey.
The YubiKey supports four methods for hardware-backed SSH, each suited to a different situation:
FIDO2 is the simplest option for most users: one key for SSH and your other FIDO2 logins, built into OpenSSH with no extra modules.
PIV suits organizations with an established CA.
PGP fits individuals already invested in OpenPGP.
OTP covers legacy systems and older SSH servers.
Each section below covers the trade-offs and links to a step-by-step setup guide.
OpenSSH 8.2 added support for FIDO hardware authenticators, exposed through the key types ecdsa-sk and ed25519-sk and their matching certificate types. Use ssh-keygen to generate a FIDO-backed key, then use it like any other SSH key, as long as the YubiKey is plugged in.
The Security Key Series by Yubico, the YubiKey 5 Series, and the YubiKey Bio Series all support SSH authentication with FIDO2.
No vendor drivers or middleware: FIDO uses USB HID, the same interface as a keyboard
Resident key files can be downloaded from the YubiKey on any machine with ssh-keygen -K, so there are no key files to carry around
One YubiKey covers SSH and your other FIDO2/WebAuthn logins, no device dedicated to one job
Requires OpenSSH 8.2 or later; requiring a PIN for each use with verify-required needs 8.4+
On macOS, the bundled OpenSSH ships without FIDO support; install OpenSSH from Homebrew (brew install openssh) and put it ahead of the system version on your PATH
On Windows, FIDO support requires OpenSSH 8.9 or later; check ssh -V. Recent in-box Windows builds (9.x) include it, but older ones do not. If yours is older, update Windows or install Win32-OpenSSH 8.9+.
ed25519-sk keys require firmware 5.2.3+; largeBlobs (used to store SSH certificates on the key) require firmware 5.7+ on the YubiKey 5 Series
You can also use the same FIDO2 key to sign your git commits and to store SSH certificates on the key itself.
The YubiKey stores and manages RSA and Elliptic Curve (EC) asymmetric keys in its PIV module. It works with any SSH client that can communicate with smart cards through the PKCS#11 interface.
Centralized management of keys
Standardized security policies across endpoints
Wide support for PKCS#11
Ideal for organizations with an existing PKI deployment
Requires a PKI deployment (at minimum a CA), which adds complexity and ongoing maintenance
Requires a vendor PKCS#11 module, which is not built into OpenSSH
No chain validation of certificates
Each key must be revoked individually
The YubiKey stores and manages OpenPGP keys in its OpenPGP module. It works with SSH clients that integrate with the OpenPGP standard through gpg-agent.
Simple to manage keys on a single, locally controlled machine
Easy to export and share the public key
Ideal for individuals already using OpenPGP
Requires GnuPG and gpg-agent configured as your SSH agent
No key recovery if the YubiKey is lost, unless you kept an off-device backup before moving the key to the card
OpenPGP is not widely supported by credential management services
Systems administrators could previously configure two-factor authentication for SSH using the YubiKey OTP through the Yubico PAM module.
|
Note
|
The Yubico PAM module ( |
Not as secure as an asymmetric key based solution
No longer maintained (see note above)