Yubikey FIDO2 SSH and MacOS

Even on MacOS Sequoia ssh does not support FIDO2. You need to install openssh using brew, otherwise you may get error Cannot download keys without provider when you try to import resident keys from Yubikey using ssh-keygen -K.

After you install openssh brew install openssh, restart terminal and make sure which ssh displays /opt/homebrew/bin/ssh.

Another problem that you may face, which is not related to MacOS is error Provider "internal" returned failure -1. The problem is that you may generate SSH key on Yubikey without FIDO PIN. But if you do not set FIDO PIN, you cannot import the key. Fortunately you can set the PIN later.

ykman fido access change-pin

Leave a Reply

Your email address will not be published. Required fields are marked *