Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

How do YubiKeys work? Are there any alternatives?

share|improve this question

2 Answers 2

up vote 16 down vote accepted

I have one, and I'd recommend them! I actually got it for free from the Yubico guys, when I was attending BSidesLondon.

Think of it as an RSA secure-key, except much smaller, cheaper and without a battery. You get (essentially) the same security, though YubiKeys have a signficantly larger keyspace than the RSA ones. They're also incredibly sturdy, and can be fully immersed in water without damage.

Here's mine:


I know this sounds like an advert, but they really are great. Compared to carrying around a bunch of those secure-keys, they're almost unnoticeable on a keyring.

As for how they work, they validate against a cloud service that Yubico run, and provide two-factor authentication. All the server software is open-source, and they're happy for you to run your own authentication servers. It's entirely transparent.

Have a dig around on their website, there's plenty of technical info and descriptions on there.

share|improve this answer
Is a subscription service required? Does one have to pay a monthly fee? –  Gabriel Fair Jul 31 '12 at 18:00
@GabrielFair Nope, it's free. From their website: "Provided with free hosted validation service, YubiCloud" –  Polynomial Aug 1 '12 at 8:18
Since you mention "Think of it as an RSA secure-key", one important difference to be aware of is the fact that it uses the symmetrical AES encryption, so theoretically someone stealing their HSM (without being detected) could obtain your key and claim being you, which an asymmetric encryption like RSA would not permit due to the server then only storing a public key... –  Tobias Kienzler Sep 4 '13 at 14:25

Have a look over here http://www.linuxjournal.com/magazine/yubikey-one-time-password-authentication

The following outtake is written by Drik Mekel, author of the previously linked article:

Each time you press the button on the device, it generates a one-time password and sends it to the host machine as if you had entered it on a keyboard. This password then can be used by the service to authenticate you as a user.

I suggest you read through the 5 page article (as this is to much to take over here)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.