Is it possible for an infected endpoint to steal private keys from a FIDO U2F Hardware Token / Yubikey? What attacks exist against these hardware tokens? What mitigations are possible? For the scope of this question it's limited to U2F Keys, some Yubikeys allow you to store SSH and GPG Keys those are outside the scope of this question.


No, this is not possible. Secrets can't be extracted from Yubikey tokens once they've been written. U2F keys don't even allow the secret to be written.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.