Times have changed since we were last here. Since then, SSH signing has become popular¹, I got some FIDO2 security keys, and post-quantum cryptography has gotten a lot better. It's time for some renovations!

SSH authentication

We want to prevent connecting to hosts without PQC. To do so, we can simply add the following lines to our ~/.ssh/config:

Match host *
 KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512@openssh.com

This forces the use of the post-quantum key agreement algorithms now supported by OpenSSH. Any server >2022 should support at least one of these, so up-to-date systems should be compatible.

Second of all, we want to prevent key theft attacks. We can now do so using security key support in OpenSSH from 2020. This makes the private key "useless to an attacker who does not have access to the physical token". This also introduces a single point of failure into my authentication; to address this, we make backup keys. I'm not specifying here where they're hidden. :)

We can keep forwarding as we have been:

Host development-server
 Hostname xxx.xxx.xxx.xxx
 Port 22
 ForwardAgent yes

This still requires trust of the end server, but by forwarding our SSH agent, we also now can forward git signing requests. To do so, we need to specify the key and the key format that we are now using:

$ git config --global user.signingKey 'key::sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIN2gb5uGV2IkzJB8w7y3E3SlYqdMrkPA8lrOCUjCcGuQAAAABHNzaDo= addisoncrump@addisoncrump-cispa'
$ git config --global gpg.format ssh

Note especially the key:: for user.signingKey, which allows us to avoid uploading our public SSH key. Probably doesn't matter much, but I don't really want to litter an upstream .ssh folder. Now, our commits will be signed, and we will authenticate them with our security token. Huzzah!

Point of future improvement: SSH Certificates

SSH certificates are the hot new thing. I will admit that I have not yet embraced them, primarily because I still need to rely on trust-on-first-use for when I configure my servers anyways. That said, these are a clear step up, and I want to integrate them into my workflow sooner than later. I will simply need to embrace cloud-init with some publicly downloadable SSH CA...

GPG agent forwarding?

Well, now that we can sign commits with SSH, this step is pointless. Goodbye, janky GPG socket forwarding! We can now remove the following line from our upstream sshd_config:

StreamLocalBindUnlink yes