# YubiKey SSH Cheat Sheet (FIDO2 & PIV)

## 1. Referenz

| Feature | FIDO2 (Resident) | PIV (Slot 9a) |
| --- | --- | --- |
| **Präfix** | `sk-ssh-ed25519@openssh.com` | `ecdsa-sha2-nistp256` |
| **Touch** | Erforderlich | Optional (konfigurierbar) |
| **PIN** | FIDO2 PIN | PIV PIN (6–8 Zeichen) |

`~/.ssh/authorized_keys`:

```text
ecdsa-sha2-nistp256 AAAAE2VjZH... ihor_main_piv
sk-ssh-ed25519@openssh.com AAAAGn... ihor_backup_fido2

```

---

## 2. PIV Setup (Slot 9a via ykman)

```powershell
# 1. PIN ändern (Standard: 123456)
.\ykman.exe piv access change-pin --pin 123456 --new-pin 'Your6to8CharPIN!'

# 2. Key & Zertifikat generieren
.\ykman.exe piv keys generate --algorithm ECCP256 --touch-policy NEVER 9a temp.pem
.\ykman.exe piv certificates generate --subject "CN=ihor_piv" 9a temp.pem
Remove-Item temp.pem

```

---

## 3. Public Key Extraktion

### FIDO2

```bash
ssh-keygen -K

```

### PIV Windows

```powershell
# Export direkt aus dem Installationsverzeichnis
ssh-keygen -D "C:\Program Files\Yubico\Yubico PIV Tool\bin\libykcs11.dll" > $HOME\.ssh\id_piv_main.pub

```

### PIV Linux

```bash
sudo apt install opensc libccid     # Ubuntu/Debian
sudo pacman -S opensc ccid          # Arch Linux
sudo systemctl enable --now pcscd

ssh-keygen -D /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so > ~/.ssh/id_piv_main.pub # Ubuntu
ssh-keygen -D /usr/lib/pkcs11/opensc-pkcs11.so > ~/.ssh/id_piv_main.pub           # Arch

```

### PIV macOS (Apple Silicon)

```bash
brew install opensc openssh
export PATH="/opt/homebrew/opt/openssh/bin:$PATH" # In ~/.zshrc eintragen

/opt/homebrew/bin/ssh-keygen -D /opt/homebrew/lib/opensc-pkcs11.so > ~/.ssh/id_piv_main.pub

```

---

## 4. SSH-Agent

### Windows (Admin)

```powershell
Set-Service ssh-agent -StartupType Automatic; Start-Service ssh-agent
ssh-add -s "C:\Program Files\Yubico\Yubico PIV Tool\bin\libykcs11.dll"

```

### Linux

```bash
eval $(ssh-agent -s)
ssh-add -s /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so # Ubuntu
ssh-add -s /usr/lib/pkcs11/opensc-pkcs11.so           # Arch

```

### macOS (`~/.zshrc`)

```bash
export SSH_AUTH_SOCK="$HOME/.ssh/homebrew-agent.sock"
[ ! -S "$SSH_AUTH_SOCK" ] && rm -f "$SSH_AUTH_SOCK" && /opt/homebrew/bin/ssh-agent -P "*" -a "$SSH_AUTH_SOCK" > /dev/null

ssh-add -s /opt/homebrew/lib/opensc-pkcs11.so

```

---

## 5. Client Konfiguration (`~/.ssh/config`)

```text
Host *
    IdentitiesOnly yes  # Verhindert, dass der Agent im Hintergrund falsche Keys durchprobiert

Host ihorzash.com
    # Windows:
    PKCS11Provider "C:\Program Files\Yubico\Yubico PIV Tool\bin\libykcs11.dll"
    # Ubuntu:
    # PKCS11Provider /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so
    # Arch:
    # PKCS11Provider /usr/lib/pkcs11/opensc-pkcs11.so
    # macOS:
    # PKCS11Provider /opt/homebrew/lib/opensc-pkcs11.so

```

---

## 6. Commands

```powershell

Restart-Service ssh-agent

cd "C:\Program Files\Yubico\Yubico PIV Tool\bin"
.\yubico-piv-tool.exe -a status
.\yubico-piv-tool.exe -a verify-pin
.\yubico-piv-tool.exe -a change-puk
.\yubico-piv-tool.exe -a unblock-pin

 cd "C:\Program Files\Yubico\YubiKey Manager"
.\ykman.exe piv access change-management-key
```