Should the serial number of multi factor devices be removed?

Question

I'm trying to understand the relationship between the serial number of a multi factor device and the cryptographic material behind it.

I don't want to blindly assume that the serial number is just a "lookup table" to the cryptographic information backing it up.

So for the major vendors (Gemalto, RSA, Yubikey, etc) is the serial number on the back of a token "sensitive" and should it be removed?

This question is on the premise that the serial number could be written down by a 3rd party and they could emulate the cryptography... thus breaking the premise of "something you have"

Answer 1

The serial number is not the seed used to generate the codes used for authentication. The serial number is used to assign a particular device to a particular user. If you remove that serial number from the back of the device you are most likely only inhibiting your ability to reuse that token should its owner ever be changed. The concern is if the vendors algorithm becomes leaked. There is no known attacks that can occur simply via using a serial number fo a two factor authentication device.

Answer 2

I would suggest NOT filing off the serial number.

Typically the authentication credential store contains some permutation of the following: - the user's identifier (ie, username) - the token identifier (ie, serial number) - the user's password

The token identifier is combined with a seed key and the current time stamp to figure out the current "key" that is submitted by the user along with their username. If a different user submitted this "key", it should not work because it does not match the username and password of the true user.

When a user looses or breaks a token, they should report it via the serial number, and a new token and new serial number would be issued. At that point, you want the administrators to be able to easily identify the old and new serial numbers and remove the old serial number. Human error being what it is, I'd say don't make the serial number hard to determine, or it will become hard to verify which entry is the old token and which is the new.

Several times, I've had to identify multiple tokens held by a given user (I work in a high security system where 1 user can have several tokens, each for a different purpose) - being able to look up the serial number on the token in the database is the best way to avoid locking out the user account with bad password attempts. A random serial number is FAR better, in these cases, than putting a label on the token saying "access to top secret system".

That said, serial numbers are linked to a security function and should be treated with some degree of care - it shouldn't be used for authentication, and when transmitted, make sure users transmit it securely.