Non-extractable keys

[paroxp]

It would be beneficial if the solokeys were capable of generating non-extractable gpg and ssh keys.

• Protection against malware stealing keys
• Protection against leaking the key
• Protection against extracting the key by malicious actor

[merlokk]

Attestation was added as a Yubico-specific extension in version 3.4 of the OpenPGP Smart Card Specification

[My1]

It would be beneficial if the solokeys were capable of generating non-extractable gpg and ssh keys.

I thought this is the default already (except on a hacker device)

[merlokk]

It's part of specification 3.4. This specification now not public, but can be downloaded from their ftp If we talk about openpgp. As for u2f and fido2 - it another story

[merlokk]

https://gnupg.org/ftp/specs/OpenPGP-smart-card-application-3.4.pdf