Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

From what I understand, a YubiKey stores a secret key which can be used to generate passwords to enter a server.

How does a YubiKey protect it's secret key?

If it is plugged into an infected computer, wouldn't the secret key be compromised?

Also, is it possible for a computer virus to "infect" a YubiKey?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

If it is plugged into an infected computer, wouldn't the secret key be compromised?

The yubikey stores the key on its internal storage media -- the exact mechanism varies depending on the type of key. When yubikey is plugged into a computer, it is recognized as a USB keyboard. Pressing the sole button on the yubikey will send a string of characters containing your one-time password, just as if they were typed via a USB keyboard. The manufacturer assures that the secret key used to generate one-time passwords can never be read off of the device, regardless of the software installed on the computer it's plugged into.

Also, is it possible for a computer virus to "infect" a YubiKey?

Everything is possible, but would be very hard considering the limited functionality of a yubikey.

share|improve this answer
    
How does it actually assure that the secret key cannot be read off the device? Couldn't a smart rootkit on the computer be able to rewrite the YubiKey software and/or retrieve the secret key? –  Pacerier Nov 12 '13 at 17:56
    
USB interface is limited to the API the device supports -- it's not an instant full-access backdoor to the device or anything like that. Supposedly, there is no mechanism in the yubikey's API to either rewrite the keys or retrieve the keys, so the manufacturer assures us that it's impossible. Whether you trust the manufacturer or not, I leave that up to you. –  mricon Nov 12 '13 at 18:06
    
@mcricon. So simply put, we can plug our YubiKey into an infested computer and leave it "plugged in" for 24 hours a day without compromising the security of the secret key? –  Pacerier Nov 13 '13 at 0:49
    
If you're looking for assurances, I can't offer them. :) However, that's how it's supposed to work, yes. –  mricon Nov 13 '13 at 1:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.