Set up two-factor SSH and PGP with Krypton

In this blog post, I want to show you how I set up SSH and PGP keys with Krypton without storing the private keys on my laptop. Instead, the keys stay on my mobile device. Yes, I hear you thinking… Wutt, but, but, but, whaat!

No worries—bear with me. I'll walk you through it and explain some of the magic behind the Krypton commands we're about to use, so you can understand what's happening.

At the time of writing, Krypton was backed by Akamai and fully open source, including the browser extension, mobile apps, and daemon. That gave me confidence in the tool, and it also meant I could review the source code.

Your keys are stored on your mobile device, not in the cloud. We usually prefer to keep our most valuable belongings close, and in this case the keys are on the phone in your pocket. Can't get much closer than that, right? OK! Let's rock and roll!

Install Krypton

To get started with Krypton, we first need to install the daemon, browser extension, and mobile app.

Let's start with the browser extension. Also install the mobile app for your device.

At the time of writing, kr supports macOS (10.10+) and 64-bit Linux (Debian, RHEL, CentOS, and Fedora with systemd). Unfortunately, Windows users can't use Krypton's SSH and PGP features, but they can use its other non-developer features.

Windows users can scroll to the end, where I've linked two alternative posts explaining how to set up SSH without 2FA. Those approaches also work on Linux and macOS, and I still use them on some of my laptops.

To install the daemon, run the following command in your terminal.

curl https://krypt.co/kr | sh

SSH setup

kr pair

This displays a QR code in your terminal. Scan it with the Krypton app on your phone to pair the Krypton daemon krd on your laptop with your mobile device.

Pairing also adds the following SSH configuration on your laptop.

# Added by Krypton
Host *
    IdentityAgent ~/.kr/krd-agent.sock
    ProxyCommand /usr/local/bin/krssh %h %p
    IdentityFile ~/.ssh/id_krypton
    IdentityFile ~/.ssh/id_ed25519
    IdentityFile ~/.ssh/id_rsa
    IdentityFile ~/.ssh/id_ecdsa
    IdentityFile ~/.ssh/id_dsa%

This configuration is where the magic happens when you connect to a server over SSH or push or pull with Git.

Before we can do that, we need to authorize our public key. View it with the following command.

$ kr me
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCq/z0K0ZqozIfwyAI1fa2ddt3Lq3+I9GRrKVlsf57nfAwiCnemWhimTlxHJ2TsWKBkxYnq5lGNpD5G4NyOlDQLUHy1g1eHbPiXgmDIbaUZ0OSo/BwwK+tBb9Y51VvCeHilP1J3WMznfE+Uo9yJLT6NsRTV56C0jzH9K3ay3L1iUCiwKRw2uwRsFZo7owp6yzS/5ktDy9qJ9FU+AYA1a9AvF2tJ2wiAwSVnd4h6EZZP8btuSbDt4B3iF47XgUpJ38lX0C5BIhsuCrHxypCeurFAFk6p5KENoxfa7s58jug6sN9Pk+DYHUTntjWAjZYCJk/Kp96tsrRlNJD/lYWGt5NyaUz4Js3/maQQxyhYWa9X5i/g4LSGQpratPEJQySqVva364zcsMAtHWwpqq8ctqoAqaoU48u4y0XWt/PHHQStlrRXyR9uhPkW2dR4bhqYznA03uEBO+GcbnJiDCw18+l+R2+PkSg6omXdVyv/3slUP/HSrWKAAoTGaZMrxzBKFIvNn0lTtqVHeWZoqwIIUs5HY5SWy8ZMLLnIGxYcuYJpScgA8Nt/QSBptu/lndp9rL2bxdl/UDMbhefwVGjubCxL8r6/uVkmjHHc0moErEl/qFTdcRqoIGl7m2Vt7cYQ+JRoxtJjy9wSKW7pUMdgjguVgUTNOQSuMEFzhqB5ERX13Q== Marco'siPhone
 
Copy this key to your clipboard using "kr copy" or add it to a service like Github using "kr github". Type "kr" to see all available commands.

You also have commands for copying the key, such as kr copy, or adding it to GitHub with kr github. Use these to add your public key to your GitHub profile or another Git service. You'll usually find the relevant settings in the SSH section of your profile.

To authorize your key on a server, run ssh-copy-id marco@server and approve the request on your phone.

Awesome, right? We've configured two-factor SSH. That was a lot of words, but it only took a few clicks and commands.

PGP setup

Now let's look at setting up two-factor PGP. Normally, creating the keys, running a PGP agent, and configuring Git to sign commits takes some expertise. That gives many of us plenty of reasons—or excuses—not to sign our commits. Let's put those aside and see how Krypton makes the setup easier.

Run the following command, approve the action on your mobile device, and follow the interactive steps.

kr codesign

Upload the public key to GitHub or your preferred Git provider so it can mark your signed commits as verified. If you missed it during setup, you can retrieve your PGP public key later with the following command.

$ kr me pgp
-----BEGIN PGP PUBLIC KEY BLOCK-----
Comment: Created with Krypton
 
mQINBF3CuUEDEACq/z0K0ZqozIfwyAI1fa2ddt3Lq3+I9GRrKVlsf57nfAwiCnem
WhimTlxHJ2TsWKBkxYnq5lGNpD4G5NyOlDQLUHy1g1eHbPiXgmDIbaUZ0OSo/Bww
K+tBb9Y51VvCeHilP1J3WMznfE+Uo9yJLT6NsRTV56C0jzH9K3ay3L1iUCiwKRw2
uwRsFZo7owp6yzS/5ktDy9qJ9FU+AYA1a9AvF2tJ2wiAwSVnd4h6EZZP8btuSbDt
4B3iF47XgUpJ38lX0C5BIhsuCrHxupCeurFAFk6p5KENoxfa7s58jug6sN9Pk+DY
......
......
......
Eqhpz7w10X8TA9D3Dv+/8ZHkgc3Jfg5vrKu1F/zA+7jF7BqaT5oDlfLtE+Y1E3Wx
iMyAuoTUCvbmwKwnhTzrfxxPdzqJLeWF5OqfzIPoO4s4gqygugc4iFiZHf9C6N0l
Xu4b0viSvW/4w2OTVRd/hXVC+Bl6je2yt7wOTOh2AT7tWtNzyB7qLaZLhD+Fj+6i
c15tc2VRyPTn2dqKWZXSeg==
=pXN5
-----END PGP PUBLIC KEY BLOCK-----
 
Copy this key to your clipboard using kr copy pgp or add it to Github using kr github pgp. Type kr to see all available commands.

So how does this work? You might have noticed the output while setting up your PGP key: Krypton adds settings to our Git config to enable commit signing.

[commit]
    gpgSign = true
[gpg]
    program = /usr/local/bin/krgpg
[tag]
    forceSignAnnotated = true

The krgpg program requests approval from your paired mobile app to sign the commit using the private key stored only on your mobile device.

Browser setup

Click the browser extension to pair your mobile device for other integrations, such as 2FA for Facebook. Feel free to play around with those yourself.

Wrapup

If you decide this setup isn't for you, run the following commands to unpair and uninstall Krypton.

kr unpair
kr uninstall

If you prefer a regular SSH setup, have a look at these posts:

• How to use SSH comfortably from the terminal
• Put your SSH experience on Windows on steroids

Thanks for sticking with me to the end! Please share this post with your colleagues and friends.