OpenSSH + FIDO Workshop
summary
OpenSSH has built‑in FIDO support since OpenSSH 8.2 (2020) and this workshop demonstrates live exercises that generate FIDO-backed SSH keys, sign commits, store SSH certificates as large blobs/resident credentials, and show device attestation. Tools used: libfido2 / fido2-token and a Python helper plus Docker to run a local SSH server. Yubico 5xx keys store roughly 100 resident keys; macOS needs an extra FIDO provider and SSH agent/ssh-askpass quirks and Android NFC PINs cause platform caveats.
AI-written summary · about
chapters (12)
- 0:00OpenSSH FIDO workshop
- 1:07What is FIDO in OpenSSH
- 10:57FIDO specifications differences
- 23:48FIDO authenticators types
- 33:19Device attestation importance
- 41:30Inspecting FIDO security keys
- 43:18Workshop exercises setup
- 1:01:42Generating SSH keys on FIDO
- 1:13:25Signing files and commits
- 1:22:01Storing SSH certs on FIDO
- 1:27:35FIDO keys with SSH agent
- 1:35:06Troubleshooting issues Q&A
