Keys & Identities

FIDO2 security keys

Keep your SSH key on a hardware security key, such as a YubiKey, so it can never be copied off the device.

What you need

A USB security key with FIDO2 support. Termbit works with Ed25519 and ECDSA P-256 security keys, the ones OpenSSH calls ed25519-sk and ecdsa-sk.

Create a key on your device

  1. In Keys & Identities, click + New at the top and choose FIDO2 → Generate Key.
  2. Insert your security key and select it. With several keys, use Choose by Touch.
  3. Enter the device PIN if it has one.
  4. Enter a label and choose the algorithm. Ed25519 is preferred when the device supports it.
  5. Choose the options:
    • Resident Key: stores the key on the device, so you can restore it on another Mac.
    • Require Touch: you touch the key every time you sign in. On by default.
    • Require PIN: you also enter the device PIN every time.
  6. Click Generate, touch the key when it blinks, then click Save, or Save & Export to Host to add it to a server right away.

Use a key that’s already on your device

In Keys & Identities, click + New and choose FIDO2 → Add from Device, enter the PIN and select the keys to add. This works for resident keys. For other keys, import the key file you got when you created it, with Import from File.

Sign in

Add the public key to the server with Export to Host, as described in SSH keys, then select the key for the host.

When you connect, Termbit asks you to enter the PIN or touch the key when needed. If the key isn’t plugged in, just insert it and the sign-in continues.

Keep in mind