1

I'm getting conflicting information on how the security keys are stored and used. Where are the public and private keys stored? If the private key is stored on the Yubikey itself, how many can it hold?

If the both keys are stored on the service you are authenticating against (Gmail), does it send the yubikey the private key to unencrypt to use the private key for signing?

Yubikey Website:

During the registration process, the key pairs are generated on the device (secure element) but the key pairs are not stored on the YubiKeys. Instead, the key pair (public key and encrypted private key) are stored by each relying party/service that initiated the registration. Therefore, this approach allows for an unlimited number of services to be associated with the U2F-certified YubiKeys.

FIDO Website:

The U2F device and protocol need to guarantee user privacy and security. At the core of the protocol, the U2F device has a capability (ideally, embodied in a secure element) which mints an origin-specific public/private key pair. The U2F device gives the public key and a Key Handle to the origin online service or website during the user registration step. Later, when the user performs an authentication, the origin online service or website sends the Key Handle back to the U2F device via the browser. The U2F device uses the Key Handle to identify the user's private key, and creates a signature which is sent back to the origin to verify the presence of the U2F device. Thus, the Key Handle is simply an identifier of a particular key on the U2F device.

https://fastmail.blog/2016/07/23/how-u2f-security-keys-work/

https://developers.yubico.com/U2F/

https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fido-u2f-overview-v1.2-ps-20170411.html#site-specific-public-private-key-pairs

https://www.yubico.com/authentication-standards/fido-u2f/#toggle-id-4

2

The keys can be either stored on the device, or encrypted and returned in the key handle. Both are allowed (and mentioned) by the spec.

From the implementation considerations:

U2F tokens might not store private key material, and instead might export a wrapped private key as part of the key handle.

Also in the raw message format specification:

A key handle [length specified in previous field]. This a handle that allows the U2F token to identify the generated key pair. U2F tokens may wrap the generated private key and the application id it was generated for, and output that as the key handle.

This leaves the decision to the manufacturer of the U2F device.

Yubico chose to return the encrypted private key as the key handle, allowing an unlimited number of credentials.

If a device manufacturer chooses to store the private key on the device itself, the number of possible keys will be limited by the amount of storage available. You'd have to look at the specs for a specific device.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.