{"id":278,"date":"2023-02-01T23:35:00","date_gmt":"2023-02-02T04:35:00","guid":{"rendered":"http:\/\/sycured.127.0.0.1.sslip.io\/?p=278"},"modified":"2024-01-14T12:47:18","modified_gmt":"2024-01-14T17:47:18","slug":"git-hosting-ed25519-sk","status":"publish","type":"post","link":"http:\/\/10.42.0.68:8080\/blog\/git-hosting-ed25519-sk","title":{"rendered":"Git hosting and ed25519-sk"},"content":{"rendered":"\n

Quick look if major Git hosting providers are up-to-date about security.<\/p>\n\n\n\n

The possibility of using ed25519-sk is a critical point when evaluating Git hosting.<\/p>\n\n\n\n

ed25519-sk<\/h3>\n\n\n\n

When you generate this type of key, you need your physical security key,<\/p>\n\n\n\n

ssh-keygen -t ed25519-sk<\/code><\/pre>\n\n\n\n
You obtain this type of output:<\/p>\n\n\n\n
Generating public\/private ed25519-sk key pair.\nYou may need to touch your authenticator to authorize key generation.\nEnter passphrase (empty for no passphrase): \nEnter same passphrase again: \nYour identification has been saved in \/home\/sycured\/.ssh\/demo_ed25519-sk\nYour public key has been saved in \/home\/sycured\/.ssh\/demo_ed25519-sk.pub\nThe key fingerprint is:\nSHA256:c3J9KE2GsDr4gXE0OYfkNqC\/ApDE5r7gP5sK2SiHUZY sycured@x9\nThe key's randomart image is:\n+[ED25519-SK 256]-+\n|..  ..+o.        |\n|.+ o ++..o .     |\n|= E . =o. . o    |\n|.+ . * o   = .   |\n|+   + + S + + .  |\n|.O   o o = . .   |\n|O = . .          |\n|o+ o.            |\n| .o+o            |\n+----[SHA256]-----+<\/code><\/pre>\n\n\n\n
The most important part is You may need to touch your authenticator to authorize key generation.<\/strong><\/p>\n\n\n\n
Each time that you want to use this key, you’ll need your physical security key (Yubikey & co) otherwise it’ll be impossible.<\/p>\n\n\n\n
For critical accounts\/repositories, it must be enforced with 1 to 3 spares stored in different safe places.
Yes, you’ll need to generate an ed25519-sk with each but it’s nothing compared to losing your access.<\/p>\n\n\n\n
Git hosting<\/h3>\n\n\n\n
\u26d4 Bitbucket<\/h2>\n\n\n\n
It’s not a surprise that Bitbucket doesn’t implement it.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\ud83c\udf89 Gitea<\/h2>\n\n\n\n
Gitea is up-to-date about ed25519-sk.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Tested on my personal Git server (self-hosted<\/a>)<\/p>\n\n\n\n
\u26d4 Gitee<\/h2>\n\n\n\n
Gitee, the Chinese platform (OSChina is the owner) doesn’t implement it.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\ud83c\udf89 GitHub<\/h2>\n\n\n\n
Of course, GitHub is up-to-date about security.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\ud83c\udf89 GitLab<\/h2>\n\n\n\n
I tested it on gitlab.com, and it’s working fine.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
If your self-hosted Gitea\/GitLab doesn’t support ed25519-sk, just update it and have an OpenSSH server >= 8.2.<\/p>\n","protected":false},"excerpt":{"rendered":"
Quick look if major Git hosting providers are up-to-date about security. The possibility of using ed25519-sk is a critical point when evaluating Git hosting. ed25519-sk When you generate this type of key, you need your physical security key, You obtain this type of output: The most important part is You may need to touch your […]<\/p>\n","protected":false},"author":1,"featured_media":85,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"saved_in_kubio":false,"footnotes":""},"categories":[28],"tags":[11,19],"_links":{"self":[{"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/posts\/278"}],"collection":[{"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/comments?post=278"}],"version-history":[{"count":1,"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/posts\/278\/revisions"}],"predecessor-version":[{"id":279,"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/posts\/278\/revisions\/279"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/media\/85"}],"wp:attachment":[{"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/media?parent=278"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/categories?post=278"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/tags?post=278"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}