I just discovered the YubiKey NEO which seems like a pretty awesome device for maintaining security for a variety of different things including computer login, SSH private keys, GPG private keys, and even password safes applications.
I generally understand how systems like Google Authenticator work, wherein the server and the client share a private key which generates 6-digit number keys based on the current time. This makes sense, as both sides need to compute these values on the fly and verify them. The client generates a key, sends it to the server, and the server computes the key based on the current time; if it matches, a successful login occurs.
However, in other cases, notably in static files like private SSH keys, private GPG keys, and password safes, how would something like the YubiKey NEO assist in being able to unlock the private file? Encrypting these files using a passphrase or using a file as a seed for a passphrase is straightforward, but how would one-time passwords work with this?
My particular use-cases are:
- Being able to log into my Linux desktop.
- Being able to further secure my GPG private keys.
- Being able to further secure my SSH private keys.
- Being able to further secure my password safe (KeePass, Password Safe, etc.).