yubikey-git: three keys, one per YubiKey; any one of them will do

5 files changed, 30 insertions, 6 deletions

diff --git a/config/ssh/yubikey-git/config b/config/ssh/yubikey-git/config
index a878c92..f74db8f 100644
--- a/config/ssh/yubikey-git/config
+++ b/config/ssh/yubikey-git/config
@@ -1,16 +1,20 @@
-# git over ssh to git.soarez.net with the YubiKey git key: git clone
-# git@git.soarez.net:sz/<name>.git, one touch of the key per fetch or push.
+# git over ssh to git.soarez.net with the YubiKey git keys: git clone
+# git@git.soarez.net:sz/<name>.git, one touch of a key per fetch or push.
 #
 # Read only on a host that opted in: `yubikey-git enable` links this file into
 # ~/.config/ssh/enabled.d/, which config/ssh/entry includes. See bin/yubikey-git.
 #
-# The key is id_ed25519_sk_git beside this file, a FIDO2 key whose private half
-# never leaves the YubiKey. The file is only its handle: useless without the
-# YubiKey, and the YubiKey signs nothing without a touch. git.soarez.net accepts
-# it for git on the repositories and nothing else.
+# The keys are the id_ed25519_sk_git* files beside this file, one FIDO2 key per
+# YubiKey, whose private half never leaves it. Each file is only a handle:
+# useless without its YubiKey, and the YubiKey signs nothing without a touch.
+# git.soarez.net accepts them for git on the repositories and nothing else. Any
+# one will do: ssh passes over those whose YubiKey is not plugged in. After
+# adding one here, re-run `yubikey-git enable` on each host that opted in.
 
 Host git.soarez.net
   User git
+  IdentityFile ~/.ssh/id_ed25519_sk_git_main_nfc
+  IdentityFile ~/.ssh/id_ed25519_sk_git_backup_nfc
   IdentityFile ~/.ssh/id_ed25519_sk_git
   IdentitiesOnly yes
   # Pinned, not learned: on a machine we do not trust, the first connection is
diff --git a/config/ssh/yubikey-git/id_ed25519_sk_git_backup_nfc b/config/ssh/yubikey-git/id_ed25519_sk_git_backup_nfc
new file mode 100644
index 0000000..eacefe9
--- /dev/null
+++ b/config/ssh/yubikey-git/id_ed25519_sk_git_backup_nfc
@@ -0,0 +1,9 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAASgAAABpzay1zc2
+gtZWQyNTUxOUBvcGVuc3NoLmNvbQAAACBE1NcemsA6aigy5wfYux6V7NITOnpUC8+hOjaT
+hFFgzQAAAARzc2g6AAAA8NK/OQXSvzkFAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY2
+9tAAAAIETU1x6awDpqKDLnB9i7HpXs0hM6elQLz6E6NpOEUWDNAAAABHNzaDoBAAAAgIBx
+G++mRhZdhD+F5F/LCFg+miSuX+bCL1Vim5K9tG9mcBXZyqetZkzxfyMtOiCJJQ6ZLDYijA
+TMFSiqJd0eb/bbq+xad55ELGZ4DwqUvwUUybcqUcya43XIa5tGBLg2hOwVsMr8oR6FdU2E
+msg9QdFvEA3DrQYeZpD9RGSV303JAAAAAAAAAA5iYWNrdXAtbmZjLWdpdAECAw==
+-----END OPENSSH PRIVATE KEY-----
diff --git a/config/ssh/yubikey-git/id_ed25519_sk_git_backup_nfc.pub b/config/ssh/yubikey-git/id_ed25519_sk_git_backup_nfc.pub
new file mode 100644
index 0000000..c659e53
--- /dev/null
+++ b/config/ssh/yubikey-git/id_ed25519_sk_git_backup_nfc.pub
@@ -0,0 +1 @@
+sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIETU1x6awDpqKDLnB9i7HpXs0hM6elQLz6E6NpOEUWDNAAAABHNzaDo= backup-nfc-git
diff --git a/config/ssh/yubikey-git/id_ed25519_sk_git_main_nfc b/config/ssh/yubikey-git/id_ed25519_sk_git_main_nfc
new file mode 100644
index 0000000..6b5b7cc
--- /dev/null
+++ b/config/ssh/yubikey-git/id_ed25519_sk_git_main_nfc
@@ -0,0 +1,9 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAASgAAABpzay1zc2
+gtZWQyNTUxOUBvcGVuc3NoLmNvbQAAACAP4g7w6EiRrYeb9C04vpmcO6ECKghdFvR16wEF
+CKFbUgAAAARzc2g6AAAA8CjpEMYo6RDGAAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY2
+9tAAAAIA/iDvDoSJGth5v0LTi+mZw7oQIqCF0W9HXrAQUIoVtSAAAABHNzaDoBAAAAgFUe
+jvEOuayDnp4QwQGUyp03HM/y8LFFQwq3Uqou36lhMCWrg974AIYQzQsTO/oqHkNKA2c7+d
+simGavu35U5MLqNx7orFJOoU879fAhW0vo/eu80cnXKHpDqImRQsiYt6OohwT1PvkzLH5N
+GlJ5CMHlyAiO1pnHVWfawcDRxJ1YAAAAAAAAAAxtYWluLW5mYy1naXQBAgMEBQ==
+-----END OPENSSH PRIVATE KEY-----
diff --git a/config/ssh/yubikey-git/id_ed25519_sk_git_main_nfc.pub b/config/ssh/yubikey-git/id_ed25519_sk_git_main_nfc.pub
new file mode 100644
index 0000000..b6c6cf5
--- /dev/null
+++ b/config/ssh/yubikey-git/id_ed25519_sk_git_main_nfc.pub
@@ -0,0 +1 @@
+sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA/iDvDoSJGth5v0LTi+mZw7oQIqCF0W9HXrAQUIoVtSAAAABHNzaDo= main-nfc-git