1

Given that U2F as implemented for instance by the YubiKey is stateless I am wondering if any password manager supports encrypting each individual password stored in a password collection using U2F.

This would help against the common problem that opening the password manager is already a large security risk (think CTRL+A, CTRL+C to copy all entries) and prevent giving away your complete passwords just because an attacker recorded one challenge/response communication for a single key.

Background:

  • U2F is not an encryption standard, but a authentication standard and uses public/private keys for authentication of server challenges.
  • Based on its use of public/private key signatures though it should be possible for a password manager to keep "handles" for each stored password, which after being signed by the U2F device yield the actual encryption key.
  • See here for a potential use of u2f for simple text encryption. I don't think it the right way to use the handle as a salt, but the general idea is there.
Improve this question

1 Answer 1

Reset to default
1

U2F can't be used to encrypt anything. U2F devices can be asked only two things :

  • Enroll a new identity (Create a new key pair)
  • Authenticate using an existing Identity. (Sign the hashed server challenge with few other info)

So I don't think your question makes sens, but perhaps you can give more details.

Improve this answer
5
  • U2F devices can only sign things, really (Yubikey does not even store any secret). But isn't a signature enough to turn a stored sequence of bytes into a potential encryption key?
    – Christopher Oezbek
    Mar 14, 2017 at 19:35
  • @ChristopherOezbek It's poor form at best to use non-random key sources, and a security hole that you might not see at worst. I strongly advise you don't do it, or ask on crypto.stackexchange.com where you might get a better answer.
    – Jeff Ferland ♦
    Mar 14, 2017 at 19:46
  • @JeffFerland At the moment my password manager does not even encrypt each individual password, but just everything together. So I am looking for anything that might help me go above static password to open my password vault.
    – Christopher Oezbek
    Mar 14, 2017 at 19:59
  • Use a hardware device that can support asymmetric encryption (OpenPGP card, Yubikey 4, etc.) and encrypt each password individually. The Yubikey 4 can require physically touching the device to perform decryption, and OpenPGP cards can be put inside external card readers.
    – Jeff Ferland ♦
    Mar 15, 2017 at 1:43
  • by the way, I don't understand what you are trying to achieve by that... It doesn't protect against phishing, it doesn't protect against local attacks... just saying...
    – FredericMARTIN
    Mar 15, 2017 at 18:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .