Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The YubiKey personalization tool allows someone to configure a YubiKey for HOTP, challenge response, and a variety of other authentication formats.

YubiKey offers a number of personalization tools for both logical slots of the hardware device.

When I ran the personalization tool on OSX it appears I can view and edit the default "secrets' of the device.

enter image description here

(actual values redacted for privacy)

Question

  • Is it correct that a default shipment of a Yubikey can have its secrets read with anyone with this software?

  • Is the only and correct way to secure a yubi key is to set a password using the following utility?

enter image description here

share|improve this question
    
Could it be that this is just a confusing UI, and those are not the current secrets? See the "auto-generated" in the header... –  MattJ Aug 31 '13 at 10:47

2 Answers 2

TL;DR

You may be misunderstanding the security trade-offs that a YubiKey offers. All security controls involve trade-offs; YubiKeys with YubiCloud authentication involves key escrow.

Authentication with YubiKeys

Out of the box, YubiKeys are pre-configured to authenticate against the YubiCloud. The default mechanism appears to involve storing your AES secret key server-side. Yubico claims:

There is no access to AES secrets even for administrations of the backend KSM servers.

Even if true, I would expect any key-escrow system to be fundamentally vulnerable to physical threats and brute-force attacks. Assuming you trust Yubico to escrow your keys in the first place, anyone with physical control of the Hardware Security Module or its contents could mount an attack.

The bottom line is that if you use the YubiCloud authentication mode, you will be trusting Yubico with your secret key even if you change it. Changing your key only makes sense if you are using an alternative back-end for authentication, or if you believe your currently-stored key has been compromised in some way.

Password Protection in the Personalization Tool

What this feature is doing is providing an administrative password for preventing re-configuration of the key. You may want to look at the source code, but the "Configuration Protection" password is just that: a password to prevent unauthorized changes to the key. Section 3.2 of the API documentation says:

[T]his approach is targeting destructive attacks as the interface does not provide any means of retrieving secret information. The configuration interface is write only, and the term destructive attack refers to an opponent that wants to erase or modify the settings of a device.

In my opinion, this feature is most useful in preventing end users from misconfiguring or re-purposing an organizationally-owned YubiKey. Your mileage may vary.

share|improve this answer

I don't think it is reading the data from the device. This being impossible is one of the fundamental principles of such a hardware token.

The UI in your screenshot gives a couple of hints that the values in those fields are not from the key. Firstly it says "auto-generated" above them. Secondly the status in the sidebar says only slot 1 is configured, but you are configuring slot 2 (empty).

One way to verify this would be to restart the application and see if those values change. If so, it is simply generating values for you as a convenience (even if it isn't being 100% clear about that).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.