Questions tagged [yubikey]

YubiKey is an USB authentication key developed by Yubico.

Filter by
Sorted by
Tagged with
1 vote
0 answers
44 views

Certify using Yubikey

I just started using a Yubikey 5. I've set up GPG according to this excellent guide, and now I have 3 working ECC key pairs on my Yubikey: Sign/S :: ed25519, Encrypt/E :: cv25519, Authentication/A :: ...
telephone's user avatar
  • 111
17 votes
5 answers
5k views

How do Yubikeys improve security if I am typically also forced to enable other, weaker 2FA methods?

It is typically recommended to enable 2FA wherever possible. Moreover, it is typically recommended to enable not just any 2FA method, but Yubikeys in particular. Yubikeys are considered to be the ...
gaazkam's user avatar
  • 5,945
0 votes
0 answers
63 views

YubiKey Bio for SSH login: Do I have to reauthenticate?

I'd like to use YubiKey Bio for SSH-logins. I'm wondering how often I have to show my fingerprint for authentication when I start new sessions. What's the interval? If I start a new session every 5 ...
Kevin Meier's user avatar
2 votes
0 answers
172 views

Why are Yubico Yubikeys limited to 32 OATH accounts? [closed]

Is the 32 OATH QR code account limit on Yubikeys due to a storage constraint? Because the Yubikey 5 series has been out for a few years now it'd be amazing if there is a new version released soon with ...
AdamHurwitz's user avatar
0 votes
1 answer
218 views

Can the private key inside a yubikey be known to anyone, e.g. the NSA?

I wonder if the NSA can force Yubico (or their secure element chip supplier), a US company located in Palo Alto, California, to hand over the private keys stored in the secure element of the yubikey ...
AND's user avatar
  • 11
0 votes
0 answers
72 views

SSH ecdsa-sha2 key changed?

I use a yubikey with device-generated ssh keys to login on my servers. A few months ago I've created a ssh keypair on our cloud provider (OVH) with this value (truncated): ecdsa-sha2-nistp256 AAAA......
jorrnart's user avatar
0 votes
1 answer
84 views

What mechanism stops smartcards and YubiKeys from exporting private keys?

How are the above devices built and what is the mechanism that seals them off from giving out private keys? Are the sign/decrypt operations somehow soddered into their hardware, is it a tiny piece of ...
Cigarette Smoking Man's user avatar
3 votes
1 answer
511 views

When is FIPS certification important?

I was looking at YubiKeys and noticed that they sell FIPS certified keys alongside non-FIPS certified keys. Both seem to have the same feature sets, but the FIPS certified keys are more expensive. ...
Unknown's user avatar
  • 185
3 votes
1 answer
375 views

Can someone with access to only my Yubikey gain access to my server that has SSH access via an ED25519-sk keypair?

My understanding is that an ED25519-sk SSH key generated by OpenSSH generates a private key stub that lives on your host machine. This stub is just a reference to the actual private key that lives on ...
angryserver's user avatar
0 votes
1 answer
135 views

Security of using Yubikey to derive Diceware password?

I bought a new Yubikey, and am currently setting it up to use on my desktop PC. Previously the PC was secured with password only, and I'd like to use the Yubikey as an alternative: instead of using ...
Danya02's user avatar
  • 203
2 votes
0 answers
92 views

How to figure out what is requesting access to my yubikey?

I recently set up two yubikeys based on this guide. I also set it up so gpg-agent is my ssh-agent, so I can use the keys for ssh. For some reason, even without me taking any action after plugging in ...
fbence's user avatar
  • 121
0 votes
0 answers
216 views

Windows Certificate Propagation Service configuration

I'm having the same issue of this fellow user. I have a certificate stored in the Windows user personal store and in a YubiKey. When I plug the YubiKey, the Certificate Propagation Service discovers ...
n1am's user avatar
  • 1
1 vote
1 answer
665 views

How are hardware keys phishing resistant to man-in-the-middle attacks?

I've heard that hardware keys like Yubikey are phishing resistant. But I do not understand where a phished man-in-the-middle attack, which tries to "forward" the whole communication, fails ...
Gere's user avatar
  • 137
0 votes
1 answer
83 views

How to create, use and backup android signing keys without trusting the computer?

I did a lot of research on how to securely create, use and backup android signing keys (when using Google Play Signing is not an option). The best option seams to be a Yubikey or a Nitrokey HSM 2 and ...
Alai's user avatar
  • 1
1 vote
1 answer
472 views

Securely SSH a server from an intermediary remote machine (possibly with Yubikey)

I am doing remote devevelop on a remote dev machine. From the remote machine, I need to SSH to other servers and services like the Github. Everything is on the Internet. My desktop is much more secure ...
Tom Bennett's user avatar
1 vote
0 answers
790 views

Reading SSH private key physically stored on yubikey to remote into external PC

I was wondering if it's possible to only store and read a ssh private key on a yubikey and not read the private key the yubikey generated from a client computer? Currently the only way it seems to ...
SneakyShrike's user avatar
1 vote
0 answers
330 views

SSH authentication with GPG failing with a new Yubikey with the same gpg keys as the old one

I have a MacBook M1 on which I have been using a Yubikey 5 to authenticate SSH logins to various systems. I recently got a Yubikey 5C so I wouldn't have to use adapters. I moved my keys over to it ...
user28598's user avatar
2 votes
0 answers
72 views

Yubikey Private Key Generation & Storage 5 Series vs Bio Key

References: Yubico’s Take on U2F Key Wrapping https://www.yubico.com/blog/yubicos-u2f-key-wrapping/ Key generation https://developers.yubico.com/U2F/Protocol_details/Key_generation.html Discoverable ...
CyberMedics.org's user avatar
1 vote
1 answer
132 views

Is there a way to store a verification-hash of a secret on a 'consumer HSM' like Yubikey or another WebAuthn device?

Context: I'm trying to design an SRS solution for your personal secrets - "Anki for passwords." (This is mostly a learning-exercise, to help me develop my intuition for writing secure(-ish?) ...
ELLIOTTCABLE's user avatar
1 vote
1 answer
305 views

Digital Signature Generation

In short, I need to place a Digital Signature into slot 9c of my Yubikey. If you generate the certificate from the Yubikey; then the private key is not exportable. So I'm attempting to generate the ...
Oort's user avatar
  • 11
0 votes
1 answer
430 views

When hardening my SSH key, why would I use yubikey-agent instead of the built-in `-sk` key type native to OpenSSH?

OpenSSH 8.2 added -sk key types that allow for FIDO/U2F hardware authenticators (like a YubiKey, etc.) yubikey-agent allows for the same functionality, except it (a) requires an additional client on ...
angryserver's user avatar
1 vote
1 answer
552 views

ed25519-sk vs. gpg-agent on Yubikey

According to my understanding of this document, Yubikey is capable of running ed25519-sk and gpg-agent. Which one is more secure? Obviously, ed25519-sk wouldn't work, if the SSH server is old, but ...
Thomas G. Lau's user avatar
2 votes
0 answers
796 views

Can't sign commit with yubikey, GPG missing something

I don't know much about how yubikeys work, but I'm trying to sign a commit with one of them and I don't even know how to debug the problem. I got: gpg --list-keys /home/lz/.gnupg/pubring.kbx ----------...
Rafaelo's user avatar
  • 31
1 vote
1 answer
432 views

What exactly happens when you use 2FA with "Password" + "Yubikey HMAC" Login in KeepassXC?

Usecase: KeepassXC is configured with a Passward + Yubikey HMAC. I am trying to understand the exact steps that happen. I think the first five Steps are clear: Open KeepassXC Enter Password Select ...
foshyboy's user avatar
3 votes
3 answers
1k views

Is a hardware based 2FA more resistant to phishing than SMS or TOTP?

As I understand, modern phishing is kind of like a man-in-the-middle attack. Let's say, for example that User u has an account in Domain d where he has an SMS based 2FA enabled. This is what the ...
Agnishom Chattopadhyay's user avatar
0 votes
1 answer
900 views

Using Yubico YubiKey 5 NFC for local data encryption

I'm interested in buying a Yubikey but want to know if you can use a Yubikey to generate a symmetric key for file encryption on selected files on a PC. Or if you need some sort of extension like HMAC-...
romes's user avatar
  • 3
-1 votes
2 answers
3k views

How to generate SSH keys inside yubikey?

How do I generate SSH keys inside my yubikey, on Ubuntu? There seems to be nowhere to look for this info.
Guerlando OCs's user avatar
3 votes
2 answers
2k views

Can I use Yubikey to encrypt a file without PGP?

I have a Yubikey 5 Series and would like to use it to encrypt a file, so that a physical presence of my Yubikey would be required to decrypt it. I know you can save a PGP key onto Yubikey and use it ...
Sergei Fomin's user avatar
0 votes
1 answer
110 views

Will Lastpass ignore old 2FA tokens from the Yubikey? (tokens leaked accidentally)

Somestimes I press on my yubikey accidentally and it writes the token on the screen and even sends automatically to the person I'm talking to on some chat, because it presses enter. This happened ...
Guerlando OCs's user avatar
0 votes
1 answer
816 views

Is it possible to bruteforce Yubikey's PIN when using it as PIV/Smart card?

I'm considering using Yubikey to log in to my Mac. However, in my threat model I have to assume that it will fall into the wrong hands, hence the question: does Yubikey have any mechanisms that ...
jgeoirgnlsfnv's user avatar
1 vote
0 answers
140 views

Fido U2F, can a modified client theoretically register the same key multiple times? YubiKey Wrapped PrivateKey Method

Context I was answering a question about how YubiKey can generate "infinite" keypairs for Fido U2F but doesn't need to store them locally. This leads to my initial question: Initial Question ...
PathToLife's user avatar
0 votes
0 answers
693 views

importing private key stub from piv card into gpg on another pc

Sorry for puzzling terminology, I'm very new to field and it's really hard to me to orient in these new things. (maybe, probably, there isn't 'private key stub' I just saw that term used somewhere, ...
Martin Mucha's user avatar
2 votes
0 answers
283 views

Is it possible to regenerate the stub private key from just the physical key in OpenSSH?

Let's say I make an id of type ed25519-sk and have it reside on my yubikey. OpenSSH makes two files, id_ed25519_sk, a stub private key, and id_ed25519_sk.pub the corresponding public key. If I lose ...
nimish's user avatar
  • 121
0 votes
0 answers
116 views

How to best support multiple hardware keys (yubikeys, etc.) as a web app?

I've implemented second factor authentication for my web app via FIDO U2F, and am testing using a Yubikey. I have read that it is best practice to associate multiple hardware keys in case one is lost, ...
Julian H. Lam's user avatar
2 votes
1 answer
784 views

Using "Retired"/Extra slots (82-95) on Yubikey

Most tutorials that cover smartcard functionality of the Yubikeys use slots 9a (PIV Authentication), 9c (Digital Signature) and 9d (Key Management). However, there are also slots 82-95 (Retired Key ...
simon's user avatar
  • 171
8 votes
1 answer
330 views

How sensitive is the primary key stub of an ed25519 security key (~/.ssh/id_ed25519_sk)?

Now that OpenSSH supports Elliptic curve security keys (since version 8.2), it's possible to generate a ed25519-sk key on a hardware security key: $ ssh-keygen -t ed25519-sk -C comment This generates ...
Petr's user avatar
  • 517
0 votes
3 answers
844 views

How could someone's account that is secured by MFA Yubikey be compromised?

Let's say that I purchased a MFA Yubikey device to secure my accounts. If an attacker wanted to compromise my accounts that are secured with this YubiKey, would this be possible without having the ...
Rideboards's user avatar
31 votes
3 answers
5k views

Is a USB security key trackable among websites?

If I have a security key (U2F key) like yubikey and use it on websites A and B and the owner of these two websites is the same, can the website owner know that I am the same user?
cooker's user avatar
  • 391
0 votes
1 answer
499 views

Can FIDO2 Authentication be used for native application?

I'm currently working on a project, which has a Web API, which is to be consumed by a native application. For the sake of brevity, assume that the application cannot be re-written to be a Web ...
Eren's user avatar
  • 11
2 votes
2 answers
929 views

Virtual Yubikey [closed]

If reports are to be believed, Google and others are starting to force 2FA on user accounts starting late ~2021: https://www.theverge.com/2021/10/5/22710421/google-security-2fa-inactive-account-...
nehfan's user avatar
  • 37
1 vote
1 answer
289 views

Sharing Yubikey via SSH

I have a MacBook which has a Yubikey. I usually don't use my MacBook for any development. I use a remote Linux server. I would like to sign my commits with Yubikey instead of a gpg key. Can I share my ...
Naveen's user avatar
  • 113
3 votes
0 answers
311 views

Move signing subkey to authentication slot on YubiKey (OpenPGP card)?

My PGP primary key is only used for certification—I use a separate subkey for signing. Like this: sec rsa4096/0x891781D0EDC66456 ...
Richard Hansen's user avatar
2 votes
2 answers
542 views

Are there still ways that OTP is safer than FIDO?

From my reading I understand that USB keys (for example Yubikeys) are more secure than OTP authentication apps (such as Google Authenticator). The primary reason is that FIDO is done without human ...
northerner's user avatar
7 votes
3 answers
14k views

A stolen security key enables full access; why are such keys considered more secure than authenticator apps?

Now that I've purchased and programmed a couple of YubiKeys, I have a question about the security and usefulness of such security keys. Assume in the following scenarios that one's username is easily ...
Joseph_N's user avatar
0 votes
1 answer
729 views

Why my yubikey is not protected by a PIN to log into Google?

I just setted my yubikey on Google so I can login into Google without any passwords. However, I don't even have to put a PIN on the yubikey, it simply works. I find this very very dangerous as anyone ...
Guerlando OCs's user avatar
1 vote
0 answers
2k views

"Failed connecting to the YubiKey. Make sure the application has the required permissions." [closed]

I have a Yubikey version 5.2.7 and I can't generate any new certificates on yubikey manager app, which is weird since I have already generated two certs (on 9d slot) and they worked fine. Now the ...
Gibberish's user avatar
  • 111
0 votes
1 answer
582 views

Can yubikeys prevent cookie stealing?

When you log into a website, it stores cookies that let your browser access the website without having the password. Given that some sites support yubikey for login, does it mean that the yubikey ...
Guerlando OCs's user avatar
9 votes
1 answer
4k views

How does ed25519-sk actually works?

My google-foo failed me as most "how it works" sections related to fido are very... let's say... consumer-oriented. So openssh supports U2F natively when using the appropriate elliptic-curve-...
Jane's user avatar
  • 93
1 vote
1 answer
541 views

Use local GPG key only as a backup when keycard is not available

My question is essentially the same as this one: How to force GPG to use a Keycard when it is available which asks how to force GPG to use a keycard when one is available. That question was asked in ...
Myridium's user avatar
  • 156
2 votes
1 answer
2k views

GPG not recognizing YubiKey 5 NFC on Windows 10

I am trying to setup a YubiKey 5 NFC with GPG on Windows 10 to ultimately use it to sign git-commits. This is a new topic for me and I ran into some issues that got me stuck now. I ran into this error:...
Wolfone's user avatar
  • 121